Reference architecture

Governed Agent Architecture

A bounded agent control plane for state, tool authorization, delegated credentials, approvals, verification, recovery, and audit.

18 minVerified 2026-07-214 primary sources
A governed production AI reference architecture with observable, secured service boundaries.

Architecture

A bounded agent control plane for state, tool authorization, delegated credentials, approvals, verification, recovery, and audit.

Intent and policy
Validated request
Controlled execution
Independent verification
Telemetry and response
Conceptual teaching model synthesized from:Building Effective AI AgentsTrustworthy Agents in PracticeModel Context Protocol Architecture and Tools SpecificationOAuth 2.0 Security Best Current Practice

The architecture separates intent, policy, state, execution, evidence, and response. Each boundary has one accountable owner and an observable contract. Probabilistic components may propose or classify; deterministic software owns permissions, budgets, state transitions, and release conditions.

Architecture claim
Representative test
Production signal
Decision gate
Review or rollback
Conceptual teaching model synthesized from:Building Effective AI AgentsTrustworthy Agents in PracticeModel Context Protocol Architecture and Tools SpecificationOAuth 2.0 Security Best Current Practice

Decisions

| Decision | Required evidence | Review trigger | |---|---|---| | Keep state transitions and stop policy outside model reasoning. | Versioned test, trace, or architecture record | Material workload, provider, policy, or data change | | Authorize the exact normalized tool action at execution time. | Versioned test, trace, or architecture record | Material workload, provider, policy, or data change | | Verify authoritative postconditions independently of the proposing model. | Versioned test, trace, or architecture record | Material workload, provider, policy, or data change | | Checkpoint committed effects so recovery cannot repeat them silently. | Versioned test, trace, or architecture record | Material workload, provider, policy, or data change |

Alternatives and trade-offs

A centralized control plane simplifies policy and evidence collection but can become a latency and availability dependency. Distributed enforcement reduces central bottlenecks but requires consistent identity, versions, and audit semantics. Prefer the smallest boundary that can enforce the invariant and prove the outcome.

Failure modes

  • Tool availability is treated as permission.
  • Long-lived credentials enter prompts or traces.
  • Retries repeat non-idempotent effects.
  • The agent grades its own action as successful.

Operational checklist

  • [ ] Every run has time, token, tool, cost, and consequence budgets.
  • [ ] High-impact actions bind approval to exact parameters.
  • [ ] Credentials are short-lived and audience-bound.
  • [ ] Recovery distinguishes retry, compensate, stop, and escalate.
  • [ ] Audit evidence excludes hidden reasoning and secrets.

Connected practice

Sources

  • anthropic-effective-agents
  • anthropic-trustworthy-agents
  • mcp-specification
  • oauth-security-bcp