The Reference Architecture

The previous chapters defined what governed AI agent deployment requires. This chapter defines how — the technical architecture that makes Level 4 governance possible without sacrificing the speed and flexibility that makes AI agents valuable in the first place.

The architecture is organized into four layers, each addressing a distinct concern:

The LLM Gateway Pipeline

Every LLM call — whether from an AI agent executing a task, a coding session generating code, or a direct user request — passes through a 10-stage security pipeline. The gateway is not optional or configurable — it is the only path to the LLM.

Stage details

Cascading Governance

Policy doesn't live in one place. It cascades through a 4-level hierarchy, with the most restrictive level winning at any point of conflict:

What cascades

The cascade is resolved at request time with a 60-second TTL cache. Policy changes propagate within one minute. No restart required.

Envelope Encryption

Content encryption at rest uses a 3-level envelope encryption architecture. This is the same pattern used by AWS, GCP, and Azure for their managed encryption services.

What triggers encryption

Encryption is not a toggle — it's governance-driven. When a HIPAA or GDPR governance pack is enabled on a tenant, encryption auto-activates for:

KMS provider options

Kill Switch Hierarchy

When something goes wrong, speed matters more than process. The kill switch provides three levels of emergency halt, each cascading downward:

The kill switch is implemented as a governance module — it inherits the cascading policy system. A tenant-level kill switch overrides any team or agent-level setting. This ensures that emergency containment is always possible, even if a team has misconfigured its own governance.

Data Residency (BYOS)

Enterprise customers can store data in their own infrastructure. The platform stores pointers — not the data itself.

BYOS is not just "store files in S3." It's an architectural pattern where the platform never holds the data. Memory content, reports, generated documents, and file attachments all flow through the customer's storage. The platform holds metadata: paths, content hashes, sync status, and encryption key references.

Multi-Provider LLM Routing

No vendor lock-in. The platform supports 6 LLM providers with automatic routing based on model name. BYOK (Bring Your Own Key) is mandatory at all tiers — customers provide their own API keys.

Model selection is per-agent, per-team, or per-task. Model aliases (claude-sonnet-latest) resolve at deploy time. When a model is deprecated, the lifecycle manager re-routes agents automatically.

Agent Execution Model

Agents execute in a standard ReAct loop: the LLM thinks, calls a tool, observes the result, and decides what to do next. Every tool call in this loop passes through the authorization check and the LLM Gateway.

The execution loop has built-in safety limits: 100 tool calls per session (configurable), cost ceiling per session ($5.00 default), and loop detection (same tool called 5+ times with >80% argument similarity triggers circuit breaker).

Chapter Summary

The reference architecture implements the Five Pillars as running infrastructure: the LLM Gateway secures every model interaction with a 10-stage pipeline and cumulative hash integrity proof. Cascading governance resolves policy in real-time through a 4-level hierarchy. Envelope encryption protects content at rest with governance-triggered activation. The kill switch provides instant emergency containment at any hierarchy level. BYOS keeps data in the customer's infrastructure with pointer-only storage on the platform side.

The next chapter translates this architecture into an Implementation Playbook — a phased rollout plan with role-by-role guidance for CISOs, CIOs, platform teams, and business owners.