A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents

• URL: http://arxiv.org/abs/2606.12320v1
• Date: Wed, 10 Jun 2026 16:54:47 GMT
• Title: A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents
• Abstract summary: We present a reference architecture for the governance of production AI agents.<n>We define a taxonomy of six interruption primitives that generalize allow and deny, state and argue for four correctness invariants.<n>We demonstrate the foreclosure of seven production-agent threats across five concrete adjudications.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Enterprise security was built to govern data boundaries: the protected surface was data at rest and in transit, and the controls -- access control, data-loss prevention, perimeter inspection -- governed crossings of that boundary. Production AI agents dissolve this assumption. An agent reads context, calls tools, invokes connectors, and modifies systems of record on an enterprise's behalf, so risk moves inside the workflow, into sequences of individually-permitted actions that may transform a business process no one authorized. Existing policy engines do not extend to this regime: they evaluate request-time decisions against atomic principals, where agentic systems require stateful evaluation against composite principals whose authority attenuates through delegation chains. We present a reference architecture for the runtime governance of production agents, built from four composable primitives: a five-plane decomposition (a reasoning plane that adjudicates intent, and four enforcement planes -- network, identity, endpoint, data -- that realize the decision), stop-anywhere mediation, composite principals with capability attenuation, and audit as a structured evidence substrate. We define a taxonomy of six interruption primitives that generalize allow and deny, state and argue for four correctness invariants, and demonstrate the foreclosure of seven production-agent threats across five concrete workflows. A reference implementation of the policy-engine core supplies measured evidence: attenuation correctness and evidence reconstructability hold on every trial, adjudication runs in single-digit microseconds, and the audit substrate's tamper-evidence behaves exactly as designed. We are explicit about scope: the architecture governs delegated action, not model behavior, and a full-system evaluation against a live agent benchmark is the invited next step.

Related papers

• Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle [65.6642776933861]
  This survey examines the protective paradigm that has grown around this intervention point.<n>We find that most protections are still validated mainly against static or weakly adaptive adversaries.<n>We close by consolidating cross-stage countermeasures and open problems for robust, composable, and deployable owner-side protection.
  arXiv  Detail & Related papers  (2026-08-05T00:46:50Z)
• Formal Verification of Agentic Systems over Operational Data [59.98246281888422]
  Agentic systems driven by large language models (LLMs) are increasingly deployed in real-world where they act on persistent operational data.<n>Existing approaches do not provide such system-level guarantees.<n>We study here the verification of agentic systems comprising a single LLM and a tool orchestration harness over relational operational data.
  arXiv  Detail & Related papers  (2026-08-04T13:01:30Z)
• Towards Trustworthy Embodied Intelligence: A Systems Framework and Graded Trustworthiness Levels [53.63220028820581]
  Embodied intelligence integrates learned perception and decision making with real-time computation, control, and physical interaction.<n>We define trustworthy embodied intelligence as the sustained capacity to execute specified tasks reliably.
  arXiv  Detail & Related papers  (2026-07-28T17:50:44Z)
• Agent Security Needs Redefinition through a Holistic Framework [46.88917910966891]
  Defenses ask whether an instruction looks malicious. Benchmarks ask whether an agent performs a harmful sounding action.<n>We operationalize contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory.
  arXiv  Detail & Related papers  (2026-07-24T06:43:09Z)
• AgentReputation: A Decentralized Agentic AI Reputation Framework [3.6704226968275253]
  We propose textbfAgentReputation, a decentralized, three-layer reputation framework for agentic AI systems.<n>The framework separates task execution, reputation services, and tamper-proof persistence to both leverage their respective strengths and enable independent evolution.<n>In quantifying, AgentReputation provides a decision-facing policy engine that supports resource allocation, access control, and adaptive verification escalation.
  arXiv  Detail & Related papers  (2026-04-30T12:33:39Z)
• Decision Evidence Maturity Model for Agentic AI: A Property-Level Method Specification [0.0]
  Agentic AI systems produce decision evidence at scale through execution telemetry, but property-level reconstruction often fails.<n>We name this pattern the container fallacy: the automatic equation of evidence-container presence with audit sufficiency.<n>This paper specifies the Decision Evidence Maturity Model (DEMM), a property-level reconstructability method for agentic decisions.
  arXiv  Detail & Related papers  (2026-04-29T09:59:36Z)
• Structural Enforcement of Goal Integrity in AI Agents via Separation-of-Powers Architecture [0.10152838128195464]
  Policy-Execution-Authorization (PEA) architecture is a "separation-of-powers" design that enforces safety at the system level.<n>PEA decouples intent generation, authorization, and execution into independent, isolated layers connected via cryptographically constrained capability tokens.
  arXiv  Detail & Related papers  (2026-04-26T10:31:13Z)
• Auditable Agents [10.007755929469814]
  LLM agents call tools, query databases, delegate tasks, and trigger external side effects.<n>Once an agent system can act in the world, the question is no longer only whether harmful actions can be prevented--it is whether those actions remain answerable after deployment.<n>We distinguish accountability (the ability to determine compliance and assign responsibility), auditability (the system property that makes accountability possible), and auditing (the process of reconstructing behavior from trustworthy evidence).
  arXiv  Detail & Related papers  (2026-04-07T06:25:49Z)
• Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks [46.32011684548212]
  AI agents are vulnerable to indirect prompt injection, in which malicious instructions embedded in untrusted data can trigger dangerous agent actions.<n>This position paper discusses our vision for system-level defenses against indirect prompt injection attacks.
  arXiv  Detail & Related papers  (2026-03-31T17:15:46Z)
• ElephantBroker: A Knowledge-Grounded Cognitive Runtime for Trustworthy AI Agents [45.88028371034407]
  ElephantBroker is an open source cognitive runtime that unifies a Neo4j knowledge graph with a Qdrant vector store.<n>The system implements a complete cognitive loop (store, retrieve, score, compose, protect, learn) comprising a hybrid five source retrieval pipeline.
  arXiv  Detail & Related papers  (2026-03-26T07:03:12Z)
• Automated Self-Testing as a Quality Gate: Evidence-Driven Release Management for LLM Applications [51.56484100374058]
  We present an automated self-testing framework that introduces quality gates with evidence-based release decisions.<n>We evaluate the framework through a longitudinal case study of an internally deployed multi-agent conversational AI system.
  arXiv  Detail & Related papers  (2026-03-13T20:44:15Z)
• Agents of Chaos [50.53354213047402]
  We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment.<n>Twenty AI researchers interacted with the agents under benign and adversarial conditions.<n>Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings.
  arXiv  Detail & Related papers  (2026-02-23T16:28:48Z)
• To Throw a Stone with Six Birds: On Agents and Agenthood [0.0]
  Six Birds Theory (SBT) treats macroscopic objects as induced closures rather than primitives.<n>We give a type-correct account of agency within SBT.<n>We operationalize this contract in finite controlled systems using four checkable components.
  arXiv  Detail & Related papers  (2026-02-03T10:46:23Z)
• Making LLMs Reliable When It Matters Most: A Five-Layer Architecture for High-Stakes Decisions [51.56484100374058]
  Current large language models (LLMs) excel in verifiable domains where outputs can be checked before action but prove less reliable for high-stakes strategic decisions with uncertain outcomes.<n>This gap, driven by mutually cognitive biases in both humans and artificial intelligence (AI) systems, threatens the defensibility of valuations and sustainability of investments in the sector.<n>This report describes a framework emerging from systematic qualitative assessment across 7 frontier-grade LLMs and 3 market-facing venture vignettes under time pressure.
  arXiv  Detail & Related papers  (2025-11-10T22:24:21Z)
• SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints [59.645885492637845]
  SOPBench is an evaluation pipeline that transforms each service-specific SOP code program into a directed graph of executable functions.<n>Our approach transforms each service-specific SOP code program into a directed graph of executable functions and requires agents to call these functions based on natural language SOP descriptions.<n>We evaluate 18 leading models, and results show the task is challenging even for top-tier models.
  arXiv  Detail & Related papers  (2025-03-11T17:53:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.