A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents
Krti Tallam
Abstract
Enterprise security was built to govern data boundaries: the protected surface was data at rest and in transit, and the controls -- access control, data-loss prevention, perimeter inspection -- governed crossings of that boundary. Production AI agents dissolve this assumption. An agent reads context, calls tools, invokes connectors, and modifies systems of record on an enterprise's behalf, so risk moves inside the workflow, into sequences of individually-permitted actions that may transform a business process no one authorized. Existing policy engines do not extend to this regime: they evaluate request-time decisions against atomic principals, where agentic systems require stateful evaluation against composite principals whose authority attenuates through delegation chains. We present a reference architecture for the runtime governance of production agents, built from four composable primitives: a five-plane decomposition (a reasoning plane that adjudicates intent, and four enforcement planes -- network, identity, endpoint, data -- that realize the decision), stop-anywhere mediation, composite principals with capability attenuation, and audit as a structured evidence substrate. We define a taxonomy of six interruption primitives that generalize allow and deny, state and argue for four correctness invariants, and demonstrate the foreclosure of seven production-agent threats across five concrete workflows. A reference implementation of the policy-engine core supplies measured evidence: attenuation correctness and evidence reconstructability hold on every trial, adjudication runs in single-digit microseconds, and the audit substrate's tamper-evidence behaves exactly as designed. We are explicit about scope: the architecture governs delegated action, not model behavior, and a full-system evaluation against a live agent benchmark is the invited next step.
AI Impact Assessments
(1 models)Scientific Impact Assessment
1. Core Contribution
The paper proposes a reference architecture for runtime governance of production AI agents, arguing that enterprise security's traditional boundary-based model (data at rest/in transit) is insufficient when agents perform sequences of delegated actions against enterprise systems. The architecture rests on four composable primitives: (1) a five-plane decomposition separating a reasoning plane (adjudication) from four enforcement planes (network, identity, endpoint, data); (2) stop-anywhere mediation across seven points in the agent execution loop with six interruption primitives generalizing allow/deny; (3) composite principals with capability attenuation (authority can only diminish along delegation chains); and (4) an audit substrate producing structured, tamper-evident, reconstructible evidence records. Four correctness invariants are stated and argued structurally.
The central insight — that agentic systems require *stateful, plan-aware adjudication against composite principals* rather than stateless, request-time evaluation against atomic principals — is well-articulated and genuinely important. The paper clearly identifies five structural gaps in existing policy engines (request-gated not plan-aware, atomic principals, absolute authority, stateless, Boolean output) and designs each primitive to address one or more gaps.
2. Methodological Rigor
This is fundamentally an architecture paper, not an empirical systems paper, and it should be evaluated accordingly. The rigor is mixed:
Strengths in rigor: The definitions are precise (composite principal, capability attenuation, effective capability set, evidence record, reconstructability). The adjudication algorithm is stated formally with complexity analysis. The four invariants are stated clearly enough to be falsifiable. The threat model is well-scoped with explicit exclusions.
Weaknesses in rigor: The invariants are "argued structurally, not formally proved" — the paper acknowledges this but it remains a significant gap. The correctness claims (Claim 5) follow from the algorithm's construction rather than from formal verification. The reference implementation validates only the policy-engine core with synthetic workloads; the agent runtime and enforcement planes are *modeled*, not real. The microbenchmarks (Table 4-5) confirm internal properties (attenuation correctness on 5,000 random chains, sub-20μs adjudication latency, evidence reconstruction soundness on 1,000 synthetic workflows) but say nothing about system-level behavior. The paper is forthright about this — the full-system evaluation is explicitly deferred — but the gap between the architecture's ambition and its empirical validation is substantial.
The case studies (Section 9) are threat-walkthrough demonstrations, not experiments. They show *how* the architecture would foreclose each threat but do not measure whether it actually does so against real agents or real attacks. The evaluation framework (Section 10) is thoughtfully designed with joint safety-utility metrics, but it is a proposal, not executed evaluation.
3. Potential Impact
The problem addressed is real and commercially consequential. As enterprises deploy tool-using agents against production systems, the governance gap the paper identifies — between request-time authorization and plan-level, delegation-aware adjudication — is genuinely unserved. The architecture could influence:
The practical impact depends heavily on adoption, which the paper addresses realistically (staged brownfield deployment starting at MP5). The dependency on runtime cooperation is the most significant barrier.
4. Timeliness & Relevance
The paper is highly timely. Production deployment of tool-using agents is accelerating, and the governance gap is increasingly recognized. The paper cites recent work (CaMeL, AgentDojo, MCP security systematizations) and positions itself clearly within the emerging agentic-security literature. The problem will only grow more urgent as multi-agent delegation becomes common. The architecture addresses an emerging bottleneck — not a solved problem — and does so at the right level of abstraction (action governance rather than model alignment).
5. Strengths & Limitations
Key strengths:
Notable weaknesses:
Summary
This is an ambitious architectural paper that clearly identifies a real and important problem, proposes a well-structured solution grounded in established security theory, but lacks the empirical validation needed to confirm its claims. The composite principal model with structural attenuation is genuinely novel and well-formulated. The paper's primary value is as a conceptual framework and vocabulary for a nascent field, rather than as validated engineering. Its impact will depend on whether subsequent work — by the author or others — can instantiate the evaluation framework against real agents and real attacks.
Generated Jun 11, 2026
Comparison History (13)
Paper 2 offers a concrete, algorithmically novel approach to a pressing bottleneck in AI agent development (debugging silent failures) with strong empirical validation across multiple benchmarks. While Paper 1 addresses an important real-world application (enterprise security), its high-level architectural nature may yield slower adoption. Paper 2's immediate utility for researchers and developers likely guarantees higher short-term citation rates and broader scientific impact in the fast-paced LLM community.
Benchmarks in AI typically have broader scientific impact as they establish standardized evaluation metrics that drive future research. Workflow-GYM addresses a critical gap in evaluating agents on long-horizon, professional GUI tasks, offering a platform that researchers across the field will likely use to test new models. While Paper 1 provides a strong architectural framework for enterprise security, Paper 2's benchmark will directly facilitate and measure the broader progression of agentic AI capabilities.
Paper 1 addresses a fundamental scientific question about LLM cognition—whether models have genuine internal decision structures versus superficial verbal rationalizations. The concept of 'superficial belief' is novel and contributes to the growing field of mechanistic interpretability and AI alignment. It uses rigorous behavioral methodology and has broad implications for trust in AI reasoning. Paper 2, while practically useful, is primarily an engineering reference architecture for enterprise governance—important for industry but narrower in scientific contribution, offering architectural patterns rather than new scientific insights.
Paper 1 targets a timely, high-stakes gap—runtime governance for production AI agents—where real-world adoption is immediate and cross-cutting (security, policy, systems, compliance). Its architectural primitives (five-plane decomposition, stop-anywhere mediation, composite principals with attenuation, structured audit evidence) and correctness invariants suggest durable, reusable foundations beyond a single benchmark. Paper 2 is innovative for spatial reasoning and introduces useful domains, but its impact is more scoped to MLLM reasoning methodology and benchmark performance, with less direct near-term deployment leverage than agent governance.
Paper 1 likely has higher impact due to strong timeliness and broad real-world applicability: runtime governance for production AI agents addresses an urgent enterprise need and can influence security, policy, systems, and agent architecture. It proposes a clear, composable reference architecture with correctness invariants, threat coverage across workflows, and performance measurements, suggesting methodological rigor and deployability. Paper 2 is novel and valuable for LLM proof evaluation, but its immediate applications are narrower (research-proof verification), and impact may be more confined to AI-for-math/verification communities.
Paper 1 addresses a fundamental, broadly applicable challenge in AI governance—runtime control of autonomous AI agents in enterprise settings. Its novel five-plane reference architecture, formal correctness invariants, and composable primitives tackle a timely, cross-cutting problem relevant to any organization deploying AI agents. Paper 2, while valuable, addresses a narrow civil engineering application with incremental contributions (applying existing multi-agent frameworks to barrier design). Paper 1's breadth of impact across security, AI safety, and enterprise computing, combined with its timeliness as agent deployment accelerates, gives it substantially higher potential impact.
Paper 1 introduces a novel self-supervised RL framework (OT-GRPO) for improving spatial reasoning in LRMs without ground-truth labels, addressing a fundamental capability gap with a principled methodological contribution (consistency verifiers, optimal transport-based policy optimization). It demonstrates that label-free training can match supervised approaches, which has broad implications for AI alignment and reasoning. Paper 2 proposes a reference architecture for AI agent governance—valuable for enterprise security but is more of a systems/engineering contribution with narrower scope, lacks empirical evaluation against live agents, and addresses an emerging but more application-specific problem.
Paper 1 addresses a core technical challenge in LLM agent learning (long-context interference in long-horizon tasks) with a novel end-to-end trainable framework combining hierarchical planning and information folding. It demonstrates empirical results on multiple benchmarks. Paper 2 proposes a reference architecture for AI agent governance—important practically but more incremental, combining known security concepts (planes, mediation, attenuation) into a new framework. Paper 1's contribution to fundamental agent capabilities has broader scientific impact across the rapidly growing LLM agent research community, while Paper 2 is more narrowly focused on enterprise security engineering.
Paper 2 establishes a foundational impossibility theorem for the Eliciting Latent Knowledge (ELK) problem, a critical bottleneck in AI safety. While Paper 1 provides a practical engineering framework for enterprise agent governance, Paper 2's formalization of ELK and its mathematical proof fundamentally alter the theoretical landscape of AI alignment. Foundational impossibility theorems historically dictate long-term research trajectories across the broader scientific community, giving Paper 2 a higher potential for deep, paradigm-shifting scientific impact compared to the applied architectural contributions of Paper 1.
Paper 1 addresses a fundamental, existential challenge in AGI alignment by proposing a paradigm shift from external constraint to inherent 'Existential Indifference.' Its highly novel theoretical framework, combined with empirical operationalization, has the potential to fundamentally alter the trajectory of AI safety research. While Paper 2 offers a robust, immediate solution for enterprise AI security, Paper 1's conceptual breakthrough addresses a deeper scientific problem with broader long-term implications for the safe development of superintelligence.