FlagThis

Abstract

Enterprise security was built to govern data boundaries: the protected surface was data at rest and in transit, and the controls (access control, data-loss prevention, perimeter inspection) governed crossings of that boundary. Production AI agents dissolve this assumption. An agent reads context, calls tools, invokes connectors, and modifies systems of record on an enterprises behalf, so risk moves inside the workflow, into sequences of individually-permitted actions that may transform a business process no one authorized. Existing policy engines do not extend to this regime: they evaluate request-time decisions against atomic principals, where agentic systems require stateful evaluation against composite principals whose authority attenuates through delegation chains. We present a reference architecture for the runtime governance of production agents, built from four composable primitives: a five-plane decomposition (a reasoning plane that adjudicates intent, plus four enforcement planes for network, identity, endpoint, and data that realize the decision); stop-anywhere mediation; composite principals with capability attenuation; and audit as a structured evidence substrate. We define a taxonomy of six interruption primitives that generalize allow and deny, state and argue for four correctness invariants, demonstrate the foreclosure of seven production-agent threats across five concrete workflows, and propose an evaluation framework that treats safety and utility as joint objectives. A reference implementation of the policy-engine core supplies measured evidence: attenuation correctness and evidence reconstructability hold on every trial, adjudication runs in single-digit microseconds, and the audit substrates tamper-evidence behaves exactly as designed. We are explicit about scope: the architecture governs delegated action, not model behavior; its invariants are argued structurally, not formally proved; and the reference implementation validates the architectures internal claims, leaving a full-system evaluation against a live agent benchmark as the invited next step.