11ARCHITECTURE

Platform Architecture

Agent → Agent Trust Gateway → identity + policy + risk decision → protected tool/API → event/evidence pipeline.

Priority: P0
Phase: Foundation
Primary owner: CTO / Platform
Status: Blueprint

Objective

The platform should separate the management/control plane from enforcement/data-plane components. The cloud control plane manages inventory, policy, analytics and administration. Customer-side or regional gateways enforce sensitive actions close to workloads and can be deployed in modes that minimize data leaving the customer boundary.

What to build

Control Plane: tenants, users, agent registry, policy authoring, risk analytics, reporting, billing and configuration.
Runtime Gateway: request interception, identity verification, policy evaluation, redaction, approval orchestration and forwarding.
Telemetry Pipeline: append-only event ingestion, normalization, enrichment and searchable storage.
Connector Fabric: adapters for AI platforms, clouds, identity providers, SaaS, SIEM, MCP and APIs.
Evidence Store: immutable or tamper-evident records for high-value security and audit events.

Implementation decisions

Use stateless horizontally scalable gateways where possible; keep secrets in a dedicated secrets layer.
Define versioned schemas for agents, identities, tools, actions, resources, policies, decisions and evidence.
Use queues/streams for telemetry so analytics outages never block safe runtime decisions.
Design regional isolation and customer-managed deployment options early enough to avoid architectural rework.

Definition of done

A request can be evaluated locally when cloud analytics is degraded.
All components emit correlated trace IDs.
A tenant can export inventory, policies and events through APIs.

Success metrics

Gateway p95 decision latency
Control-plane uptime
Telemetry ingestion lag
Policy evaluation throughput

REFERENCE FLOW

Agent → Agent Trust Gateway → identity + policy + risk decision → protected tool/API → event/evidence pipeline.