Computing analytics windows…
Computing analytics windows…
This is a read-only, illustrative model of how a future vendor-neutral control layer would resolve configuration across three enforcement layers. It is the conceptual bridge to a future cockpit — shown as a model. It controls nothing: no live agents, no auth, no writes, no backend calls. Everything below is resolved by a local reference merge and is synthetic. This is audit infrastructure / trust telemetry; enforcement is the direction of travel, not a shipped capability.
Illustrative model. Nothing here is connected to a live agent. There are no apply/write paths — the model resolves and shows configuration, it never changes anything. Honesty is per-effect: every resolved effect carries its own provenance (layer · execution mode · posture · proof · origin), and the honesty ceiling is WHITE_BOX — attestation/TEE are stubs, shown as proof: stubbed, never as verified.
Five named modes, each a default that composes the underlying knobs across the three layers. Guarded is the default. Modes set a baseline; the deny-biased merge below can only tighten from there.
Watch only. Every layer records; none acts. The model surfaces what *would* happen without changing anything — the most honest posture for a read-only observatory.
Default
The default balanced posture. Hard floors enforce in the kernel; the sidecar tightens high-risk actions inline; the control plane advises. Reversible, audited delegation within a tier.
Deny-biased. The sidecar blocks anything not explicitly permitted for the tier; the control plane enforces in observe-then-act mode. For sensitive workloads where ambiguity should fail closed.
Widest reversible autonomy the agent’s tier permits — but never beyond it. Floors still bind; the tier ceiling is the hard boundary. Higher tiers earn more headroom, never an exemption.
Hard stop. The kernel denies first; nothing below the human-override line can loosen it. The break-glass posture for an active incident.
The nine dimensions along which the model can be scoped. Each maps to the enforcement layer that resolves it, is marked exists-today vs net-new (honesty about what is built), and carries its precedence rank in the deny-biased merge (lower wins).
9 dimensions · ordered by precedence
| Dimension | Enforcement layer | Maturity | Precedence | What it scopes |
|---|---|---|---|---|
| Per-agent | Sidecar | exists-today | 3 | Pin a posture to a specific agent identity, overriding broader scopes. |
| A2A relationship | Control plane | net-new | 4 | Constrain a requestor→handler delegation edge between two agents. |
| Channel | Sidecar | exists-today | 5 | Scope by transport/channel (e.g. tool call, network egress, A2A bus). |
| Action class / capability | Sidecar | exists-today | 6 | Scope by capability the action exercises (read / write / spend / deploy). |
| Per-factor | Sidecar | net-new | 6 | Scope by an individual trust factor’s satisfaction (one of the 16). |
| Data sensitivity | Control plane | net-new | 7 | Scope by classification of the data touched (public → restricted). |
| Time window | Control plane | net-new | 7 | Scope by time (business hours, change-freeze windows, incident windows). |
| Per-tier | Kernel | exists-today | 8 | Scope by the agent’s trust tier T0–T7; the tier ceiling is a hard bound. |
| Risk class | Kernel | exists-today | 9 | Scope by the canonical risk level of the action (LOW → CRITICAL). |
Pick an operation mode and an example scope below to explore — read-only — how the reference merge resolves it across the three layers. The selection lives in the URL (shareable, no storage); it only chooses which illustrative resolution is shown, it applies nothing. The input intent is agent cascade-03 (tier T6) attempting a CRITICAL spend over egress on restricted data, under guarded mode. Toggle the floors and scopes below and watch a stricter layer cap the intent.
Choose a scope — read-only · shown, never applied
In-process execution boundary. Posture + layer-mode. Hard floors live here.
Hard floor "industry floors (locked)" caps the verdict; lower scopes may only tighten further. — decided by industry floors (locked).
Execution-mode conflicts resolve to the most restrictive (block > inline > deferred). — decided by most-restrictive across layers.
Kernel layer-mode is set by the chosen operation mode; floors enforce here first. — decided by operation mode · Guarded.
Per-agent policy envelope. Governance mode resolves the agent’s effective posture.
Sidecar governance mode resolves the per-agent effective posture under the human-override line. — decided by operation mode · Guarded.
Channel posture sets the default execution mode for caused effects on that transport. — decided by channel scope.
Fleet/orchestration advisory plane (CogniGate, advisory v0.x). Direction of travel: enforcement.
Escalation routes through the control plane (CogniGate, advisory v0.x); attestation is a stub, so its proof is honest-stubbed. — decided by operation mode · Guarded.