Architecture Overview
7 Layers + 1
Enforcement Core
Enforcement Core
7
Security Layers
1
Enforcement Kernel
9
Enforcement Points
3
Data Flow Types
Identity Layer
Defines Who
Every agent run gets a signed workload identity, short-lived credentials, and a unique session ID.
RBAC / Policy Layer
Defines What May Be Attempted
Role and attribute-based decisions determine what tools, data, and actions are permitted before execution begins.
Sandbox Layer
Defines Where Execution Happens
Ephemeral, isolated runtimes with network allowlists, read-only mounts, and no host escape path.
MCP Gateway
Defines How Tools Connect
All model-to-tool connections are brokered, validated, and sanitized — no direct model-to-system access.
Deterministic Kernel
Defines What State Changes Are Admissible
The critical differentiator. Validates invariants, transitions, and approvals before any mutation is committed to reality.
Observability + Governance
Defines What You Can Prove + Own
Immutable audit logs, trace correlation, compliance reporting — upgrades guardrails into runtime governance.
A secure agentic system should never let the model write directly to reality. It should only let the model propose — while a deterministic control plane decides whether the proposed change is valid enough to commit.
Data Flow Analysis
Trace how a request moves through each enforcement layer
Architecture Diagram
Click any node to jump to its layer detail
User / Human Approver
task submission · approval token issuance
↓
Identity & Trust Layer
agent_id · run_id · trust_level · signed claims
↓
RBAC / Policy Decision Layer
allowed tools · data scopes · approval required
↓
Agent Control Layer
execution plan · tool-use plan · bounded sub-task graph
MCP Gateway
sanitized context · validated tool calls
Sandbox / Tool Runner
execution result · proposed mutation
↓
⬡ Deterministic Enforcement Kernel
state transition gate · invariant check · commit validation
↓
✗ DENY
→ Audit + Alert
→ Audit + Alert
✓ ALLOW
→ Commit Proxy
→ Commit Proxy
↓
DB / Workflow / External Systems
committed state change
↓
Observability / Audit + Governance
full lineage · forensic evidence · compliance reporting
Enforcement Points
Where the architecture actually stops bad behavior