The Platform Blueprint

In a traditional system, a human authenticates and the system acts on their behalf. In an agentic system, a human authenticates and then delegates authority to an agent, which may further delegate to sub-agents, each of which takes actions in the world. Every link in that chain must be traceable back to the original human identity.

This layer performs two functions. The first is non-repudiable authentication — not just "logged in," but verified, role-confirmed, and session-bounded, with every agent acting on behalf of a specific human recorded with its own unique identity. The second is risk materiality classification: every request receives a risk tier before any other processing begins, determining which governance requirements apply to everything that follows.

Policy enforcement must precede reasoning. An agent should not "think its way out of" its constraints — policy is a pre-condition, not a post-check. This layer enforces the institution's risk appetite as a technical requirement, not a policy hope.

Three capabilities are essential here. Policy version pinning records the exact version of every applicable policy document at the time of the request — so that when a question arises eighteen months later, the decision is still interpretable against the rules that were active when it was made. Data minimisation constrains the agent to the minimum data access required for the specific task. And SOP constraint definition limits agent autonomy for process-driven tasks to a defined procedure template rather than unconstrained judgment.

The model's training data is not ground truth — it is a prior, and priors are not evidence. What a language model learned during training about a regulation, policy, or entity may be months or years out of date. In regulated industries, this gap is not a minor inconvenience. It is a compliance risk.

This layer manages knowledge inputs with institutional rigour. Retrieved context is validated for freshness before it reaches the reasoning layer. Every retrieved document is assigned a citation token that travels through every subsequent layer and appears in the final audit artefact — making evidence traceable from claim back to source. Data sovereignty rules from L2 govern which sources can be accessed.

The agent does not freely design its own workflow. It decomposes the goal within the SOP envelope received from L2. Steps outside that envelope require explicit escalation. Before any step executes, the agent is prompted to reflect on its plan and confirm it adheres to the user's intent and the applicable constraints — the verified plan is logged for human review before execution begins.

For complex use cases, multi-agent coordination delegates sub-tasks to specialist agents — every delegation is recorded, every output tracked back to its originating task. Long-running workflows are checkpointed durably: if the system fails at step N, execution resumes from the last checkpoint, not from the beginning. This is operational resilience as a compliance requirement.

Acting in the world creates irreversible consequences. An email sent cannot be unsent. A regulatory filing submitted represents the institution's formal legal position. The fifth layer enforces least-privilege access per step, per task — not per session. When the step completes, that access is revoked.

For actions that are irreversible, high-stakes, or anomalous, the layer pauses the workflow and presents the proposed action to a human reviewer in a contextual, digestible format. This is meaningful oversight, not nominal oversight: the human receives exactly what they need to make an informed decision, with enough friction that approval requires actual engagement. Every tool call is issued with an idempotency key — retries do not duplicate actions, charges, or audit entries.

Language models produce probabilistic outputs. A plausible-sounding conclusion may be factually incorrect. A consistently reasoned finding may be systematically biased. Five core risks must be tested for in every regulated deployment and monitored continuously after: hallucination and inaccuracy, bias in decision-making, undesirable content, data leakage, and vulnerability to adversarial manipulation.

This layer sits between the agent's output and the world that will act on it. Nothing exits the platform's control boundary without passing through it. Hallucination detection cross-references every claim against citation tokens from L3. Bias detection examines output patterns across demographic and entity dimensions. Confidence scoring ensures that uncertain outputs are presented as "requiring review" rather than conclusions. In multi-agent workflows, contradictions between specialist agents are surfaced rather than silently passed into the final output.

Every serious system has logs. Logs record events. This layer records lineage — the causal chain from user intent to final output, with every link documented and every link verifiable. The most important concept here is source-to-decision linkage: every meaningful claim in every output is linked to the specific retrieved document, with its citation token, that supports it. A claim that cannot be cited is not permitted to appear as a conclusion.

Policy version archiving stores the exact state of every policy document that governed this decision — so that historical decisions remain interpretable against the rules that existed at the time they were made, not the current rules. Human acknowledgment records store who approved each significant checkpoint, what they were shown when they approved it, and when the approval occurred. Continuous drift detection monitors accumulated behaviour across all requests and feeds signals back to L1 — tightening risk profiles and governance requirements as warranted by the evidence.