The layered architecture that replaces frontend + database + manual operations, grouped into Engagement (who and what talks to your agents), Capabilities (how they decide and act) and Data (what is kept, and as which kind of record). Each layer carries a specific statutory hook: oversight that is not in the layer where the action happens cannot stop it. The layer taxonomy is adapted from the Al-Risk.ai / Agentico.ai agentic enterprise stack model (2025); the obligations mapping is ours. Everything on this page is assembled from the existing knowledge graph — each layer, threat, pattern and use case links back to the node it came from, so you can audit the claim rather than take it. RAIN does not enforce anything at runtime; it maps which obligation attaches to which execution layer and what evidence that layer owes.
Graph v2.21.0 · 7 execution layers in 3 tiers · 6 agent-specific threats · 12 oversight patterns · 20 agentic use cases profiled
These are the failure modes that only appear once a system acts rather than answers. Open any node to see which controls and patterns in the graph derive from it.
LLM06 Excessive Agency
Over-broad rights/functions of autonomous agents lead to uncontrolled actions.
Lethal Trifecta
Untrusted external input + privileged access + irreversible external actions in one agent: any successful context manipulation becomes a potentially catastrophic incident. Break at least one leg architecturally.
Cascading Multi-Agent Failure
One agent's erroneous intermediate output (hallucination, goal drift from the assigned objective over multi-step plans, poisoned context) propagates unchecked through downstream agents and triggers automated cascade decisions — emergent behavior no single-agent review ever approved, with unclear liability boundaries between agent operators. Grows with orchestration depth (central orchestrator vs decentralized message bus) and autonomy tier.
Deceptive AI Impersonation
A voice or chat agent is perceived as human, or claims capabilities and commitments it cannot honour, breaching transparency and consumer-protection duties.
Agent-to-Agent Impersonation & B2A Fraud
An external agent presents itself as a trusted counterparty (or replays a legitimate counterparty's credentials) and transacts with your agent. Because both sides are machines, the usual human friction is absent: attribution, mandate and liability all have to be resolvable from the interface record alone.
Standing-Credential Compromise of Non-Human Identities
Agents hold long-lived, broadly scoped credentials because that was easiest to ship; a single compromised agent then inherits everything the credential can reach, and the blast radius is the union of all its permissions. The agentic form of excessive agency, expressed in identity rather than in prompts.
MCP Gateway / Proxy
Central chokepoint for agent tool traffic: default-deny tool ACLs (tools/list vs tools/call), schema & argument inspection, credential injection from vault, rate limits, full audit mirror. Regulatory root cause: the base MCP protocol enforces no authentication or authorization at protocol level — Host/Client/Server topology with Tools/Resources/Prompts primitives ships without an identity layer, so a policy-enforcing gateway is not optional hardening but the only place Art. 12/15 duties can be enforced for tool calls.
Agentic Zero Trust
Unique cryptographic identity per agent; short-lived, finely-scoped tokens (OAuth 2.1 + PKCE); On-Behalf-Of flow so an agent can never see more than its triggering user.
Propose-Action Objects
Agents never call target APIs directly: they emit typed proposal objects (endpoint, params, risk estimate, rationale) validated by the governance layer before execution; idempotent execution layer.
Durable Checkpointing (Pause & Resume)
At oversight gates the complete operational state — working memory, conversation history, tool arguments, intermediate artifacts — is serialized into a durable checkpoint (fast KV store for sub-ms lookups, transactional backend as recovery anchor, vector store for semantic caching of past human decisions). On approval the agent deserializes and resumes at the exact step; matched precedents can shortcut re-planning entirely.
Per-Action Autonomy Tiering
Tools tagged read-only / reversible-write / irreversible-write; controls layer routes each action to the matching oversight mode. Mode selection is per action type, never per agent.
Guardian Agents (Runtime Policy Enforcement)
Autonomous supervisory agents outside the supervised agent's reasoning loop: stateful threat engines with graph-based cross-session history (catch multi-turn injection, gradual exfiltration, incremental privilege escalation), event-driven exposure visibility (permission drift, new connectors), and contextual risk correlation into unified issues — interception before execution, not post-hoc logging.
Dual-Gate Validation Pipeline
Input and output validation as two independent gates (MLCommons-hazard-class semantic filters, groundedness checks, structural validators: LLM Guard sub-ms–10 ms, Llama Guard <90 ms, NeMo <50 ms, Guardrails AI 50–200 ms). Latency economics decide the architecture: sequential gate chains add 300–800 ms per agent action; parallel evaluation collapses total added latency to the slowest single check — run independent checks concurrently, reserve sequential ordering for true dependencies.
Shadow-Mode Execution
Run governance controls in observe-and-score mode before enforcement: the policy engine and guardrails evaluate every agent action and log verdicts without blocking, yielding empirical false-positive/negative rates and calibrated thresholds. De-risks the enforcement cutover, produces baseline evidence for Art. 9 risk estimation, and is the standard migration path when retrofitting controls onto a live workflow.
Human-on-the-Loop Statistical Sampling
For lower-risk batch workflows, agents execute autonomously while auditors review a statistically representative random sample per batch to track accuracy, error classes and drift.
Cognitive Orchestrator
The reasoning and control plane of an agentic workflow: goal decomposition, tool selection across enterprise APIs, confidence scoring per step, and a human-machine interface exposing progress, limitations and a global halt. It is the architectural home of AI Act Art. 14 oversight — oversight that lives only in a downstream UI cannot stop an executing agent.
Local Perimeter Execution (MCP)
Execution agents run inside the corporate perimeter and reach tools through the Model Context Protocol instead of shipping raw records to third-party model endpoints. Context is scoped to the minimum attributes the task needs, which is how data minimisation (GDPR Art. 5(1)(c)) and Art. 25 privacy-by-design survive multi-tool agent orchestration.
Materiality-Threshold Escalation
Autonomy is bounded by pre-configured limits — variance thresholds, disbursement caps, margin floors, confidence minima. Crossing a limit halts execution and routes the case to a named human with the synthesised context, rather than letting the agent proceed at degraded confidence.
Each of these carries a full compliance profile — risk class, triggered regulations, obligations, blueprint and the evidence the deployment owes.