PaperlayerView exact revision on arXiv

Source-linked AI summary

Agentic Architecture of Information Systems. The AAM/5C Model: A Reference Model for Distributed Autonomy

Laurent Goujon

arXiv:2610.30221v1cs.SEcs.MA

TL;DR

At the scale of hundreds of interacting components, maintaining an information system’s dependency map and responding at incident pace can exceed what a human team can deliver. This book proposes AAM/5C as a prescriptive reference model and derives H7a and H8a from its specification under a guarantee contract.

  • Problem

    At hundreds of interacting components, maintaining the dependency map and responding at incident pace increasingly exceed what a human team can deliver.

    Source: Executive Summary · p. 3

  • Method

    AAM/5C is a prescriptive model specifying required layers, invariants, and decision rights, backed by falsifiable hypotheses and an epistemic status.

    Source: Enterprise Architecture and… · p. 16

  • Results

    Under the stated guarantee contract, H7a and H8a follow from the specification.

    Source: §7.4.3 · p. 65

  • Takeaways & Limitations

    AAM/5C fixes the content of a standards-compliant architecture description rather than replacing the description itself.

    Source: Enterprise Architecture and… · p. 16

    The security properties depend on key custody arrangements that the book does not specify; they do not hold if custody fails.

    Source: §7.4.3 · p. 64

Abstract

from arXiv · show

Large organizations increasingly face what this book calls the cognitive complexity wall: at the scale of hundreds of interacting components, maintaining the dependency map and reacting at the pace of incidents exceeds what a human team can deliver. This conceptual volume proposes AAM/5C, in which five capabilities (Capture, Comprehend, Choose, Coordinate, Control) are instantiated across seven logical layers, L1 to L7. A single authorization rule, R-AUT, separates who proposes, who decides and who executes: a probabilistic planner (L4) proposes; a governance layer (L6) decides under signed policies and records its verdict in a signed evaluation proof; a security layer (L5) issues a short-lived act token bound to that proof; a policy enforcement point verifies both before the target layer materializes the act. Under an explicit guarantee contract, two analytical statements (H7a, H8a) hold by construction. The other statements of its ten hypotheses (H1 to H10), including log completeness (H7b) and non-bypass of the enforcement point (H8b), are refutable, and the protocol that could refute them is fixed before any measurement. The contribution of the book is a prescriptive reference model that articulates, under this single authorization rule, known mechanisms and adds three constructs, all to be validated: the Validation step of the Distributed Autonomy Loop, the ephemeral authority surface and the cognitive dependency plane. The book positions them against autonomic computing, multi-agent systems, enterprise architecture and agent protocols (MCP, A2A), gives an authorization policy in Rego and a partial TLA+ specification of peer consensus, and sets out a validation program with quantified milestones. It reports no empirical results. This English edition is a translation of the French original, produced with the assistance of AI tools and validated by the author.

Trademarks and Legal Notices · Sources of Intellectual Inspiration · Part III — Assessment and Outlook

This section presents AAM/5C as a conceptual reference architecture for distributed autonomy, positioning it alongside established approaches and distinguishing its proposed additions. It notes that its guarantees rely on explicit assumptions, its hypotheses await empirical validation, and comparative assessment of market frameworks remains future work; the book reports no empirical results.

Objective

  • AAM/5C equips architects with five Capabilities across seven logical layers to address the cognitive complexity of large Information Systems while retaining governance and security constraints.Its guiding rule is that intelligence may propose but acts require explicit authorization, audit, and reversibility.Source: Executive Summary · p. 3, Objective · p. 13

Scope and Status of the Book

Reading Conventions

  • Only H7a and H8a are theoretically guaranteed under explicit assumptions; the other hypotheses are refutable, and the book reports no empirical results.The guarantee contract requires an enforcement point on every execution path, intact keys, and an executed act identical to the verified act.Source: Executive Summary · p. 3, Objective · p. 13, Reading Conventions · p. 14

Autonomic Computing and Self-Adaptive Architectures

  • Unlike MAPE-K, AAM/5C inserts deterministic validation between deliberation and execution, separating the probabilistic planner from the authority to execute.It retains the autonomic loop and observability as prerequisites for autonomy.Source: Autonomic Computing and Self-Adaptive… · p. 15

Multi-Agent Systems

  • In AAM/5C, peer agreement through A2A is only a proposal; signed-policy authorization is required, while consensus rules protect coordination.The model adopts decentralized task allocation from the contract net [Smith 1980] but does not let agreement itself authorize execution.Source: Multi-Agent Systems · p. 16

Enterprise Architecture and Architecture Description

  • Unlike architecture-description frameworks, AAM/5C prescribes required layers, invariants, and decision authority; its 42010 conformance is partial, with further views and records still required.It fixes the content of a standards-compliant architecture description rather than replacing that description.Source: Enterprise Architecture and… · p. 16

Security of Agent Protocols and Governance

  • R-AUT assigns decision, authorization issuance, and verification to distinct components and excludes local issuance; agents and MCP servers cannot authorize acts.A compromised MCP server can still distort the context used by L6 to decide.Source: Security of Agent Protocols and… · pp. 16–17

What None of These Streams Provides

  • The model combines known mechanisms under one authorization rule and adds three constructs for validation: DAL’s Validation step, the ephemeral authority surface, and the cognitive dependency plane.The ephemeral authority surface binds each covered act, through an evaluation-proof digest, to L6’s signed decision, distinct from the token issuer.Source: What None of These Streams Provides · p. 17
  • The book draws on the shift from access control to action control and Zero Trust, extending the latter to agent intentions, while proposing bounded-time atomic revocation linked to R-AUT [NIST SP 800-207].The shift to action control is attributed to industrial practice (§1.1).Source: What None of These Streams Provides · p. 17
  • NIST Zero Trust, Open Policy Agent, and human approval in agent frameworks provide mechanisms resembling parts of R-AUT; their antecedents include reference monitors, capabilities, and normative multi-agent systems [NIST SP 800-207] [OPA 2026] [LangChain 2024] [Anderson 1972] [Dennis and Van Horn 1966] [Boella et al. 2006].The cited mechanisms respectively separate decision, credential issuance, and enforcement; evaluate tool calls before execution; or suspend execution for human review.Source: What None of These Streams Provides · pp. 17–18
  • AAM/5C adds a signed L6 evaluation-proof/L5 act-token binding, a capability envelope without local issuance, and an independent instrument to measure non-bypass (H8b), without inheriting guarantees from prior mechanisms.It also proposes a bounded-time target for atomic authority revocation and its articulation with the R-AUT chain.Source: What None of These Streams Provides · pp. 17–18
  • None of the four studied market orchestration frameworks natively provides an authorization rule comparable to R-AUT, and comparative benchmark assessment is deferred to future work.The positioning is examined in §5.2; the benchmark is left to §10.8.Source: What None of These Streams Provides · p. 18

Part I — Why · Chapter 1. Agentic Architecture of Information Systems · Toward Distributed Cognitive Autonomy

Chapter 1 argues that distributed systems’ dependency complexity exceeds the capacity for direct human supervision, motivating agentic autonomy governed by verifiable authorization. It introduces the AAM/5C capabilities and interaction protocols, while framing the model’s autonomy target as a future validation agenda rather than a demonstrated result.

1.1. The imperative of autonomy: from technical debt to cognitive debt

  • Dependency concentration, depth and instability—not simply graph density—make complex systems exceed teams’ mental capacity and turn technical debt into cognitive debt.Manual diagnosis, incident response and compliance load engineers; the proposed shift is toward engineers defining and auditing governance policies.Source: §1.1 · p. 20

Key Concepts of the Chapter

  • AAM/5C proposes action control through an ephemeral authority surface and atomic revocation, bounding permitted acts by time and scope.The authority surface is bounded by an act token and capability envelope; the target for revocation is under 500 ms. Camille’s example shows agents qualifying and negotiating an incident response for authorization while the SRE lead oversees encoded invariants.Source: Key Concepts of the Chapter · p. 19, In Practice · pp. 19–20, §1.1 · p. 20

1.2.1. Classical architecture facing the cognitive complexity wall

  • Classical architectures lack integrated decision-making agents, leaving gaps in automation, dependency understanding, component coordination, context, diagnosis and recurring operations.The chapter characterizes these as structural limits, not poor design.Source: §1.2.1 · p. 21

1.2.2. The promise of an agentic IS

  • An agentic IS overlays agents on existing components, which can negotiate a response and submit it for authorization; a 45-second execution is an illustrative scenario, not a measured result.The design target is MTTR under one minute (H1).Source: §1.2.2 · p. 22

1.3.1. The five expected Capabilities

  • AAM/5C defines five capabilities: Capture, Comprehend, Choose, Coordinate and Control, with Control limiting execution to acts authorized under R-AUT.Chapter 2 maps the capabilities to layers L1–L7, and Chapter 3 derives ten hypotheses from them.Source: §1.3.1 · pp. 22–23

1.3.2. A2A and MCP: the two interaction protocols

  • A2A carries agent cooperation and negotiation [Google A2A 2025], while MCP supplies reasoning context [Anthropic 2024]; R-AUT governs what agents may do.The model assigns negotiation, conflict resolution and consensus-seeking to A2A use, though the specification does not define those processes; signed policies carried through MCP are a model requirement, not an MCP specification requirement [MCP 2026].Source: §1.3.2 · p. 23

1.4. Why now? The emergence of neuro-symbolic AI

  • The neuro-symbolic approach assigns proposing to probabilistic L4 and policy-based deciding to L6, so an intention cannot become an act without a governance decision.The guarantee is limited by policy expressiveness and input attestation; the expected reduction in L4 hallucination with richer MCP context remains unconfirmed experimentally.Source: §1.4 · p. 23

1.5. Taxonomy of autonomy levels: positioning the AAM/5C model

  • The five-level autonomy scale positions governed autonomous IS at Level 4, with a target MTTR under one minute (H1), but does not claim that level is attainable in every scenario.The remediation times are illustrative orders of magnitude; reaching Level 4 is a future validation agenda. The chapter concludes that agents must comprehend, choose and coordinate without acting outside verifiable authorization.Source: §1.5 · p. 24, §1.6 · p. 24

Chapter 2. The AAM/5C Model · Five Capabilities, Seven Layers, One Authorization Rule

The AAM/5C model treats an information system as a team of agents with five capabilities across seven layers, governed by R-AUT. It separates horizontal coordination from vertical authorization under signed policy, while keeping human oversight through the Agentic Operating Model.

IN BRIEF

  • AAM/5C organizes information systems as agent teams with five capabilities across seven layers, while R-AUT separates proposal, decision, token issuance, and verification.The model assigns distinct components to authorization and leaves non-bypass of the Policy Enforcement Point as a refutable claim for measurement (H8b).Source: IN BRIEF · p. 25, §2.5 · p. 33

2.1. Scientific and theoretical foundations of agentic IS

  • The model builds on six complementary theoretical foundations, including multi-agent systems, distributed cognition, cybernetics, autonomic and neuro-symbolic computing, socio-technical systems, and resilience engineering.Together, these foundations frame autonomy as an architectural property rather than an added feature.Source: §2.1 · pp. 25–26

2.2.1. The five Capabilities and their instantiation

  • The five capabilities form a cycle from signal capture through controlled execution, with separation of concerns, contextual governance, and traceable, human-suited explanations.The chapter also identifies L4/L6 coupling [RH], requisite variety across agents and coordination [Ashby 1956], and policy review through a socio-technical learning loop [RH].Source: Five Capabilities, Seven Layers, One… · p. 25, §2.2.1 · p. 26

2.2.2. Two blocks, seven layers

  • Seven single-responsibility layers use standardized neighbor interfaces: L1–L3 perceive, qualify, and route without deciding acts, while L4–L7 handle cognition, governance, and execution.The stack runs from the IS boundary at L1 to infrastructure at L7, deliberately reversing OSI numbering; L4 proposes probabilistic plans, L6 makes deterministic policy decisions, and L7 materializes verified acts.Source: §2.2.2 · pp. 27–28

2.2.3. Normative rule R-AUT: who decides, who issues, who verifies

  • R-AUT assigns proposal to L4, signed-policy decision and a signed evaluation proof to L6, short-lived proof-bound token issuance to L5, and pre-execution verification to a deterministic PEP.The PEP rejects failed checks by default; the motivating governance question is who authorizes each act, proves it afterward, and can undo it.Source: In Practice · p. 25, §2.2.3 · pp. 29–30

2.3.1. Regulation mechanisms: the dual control loop

  • The architecture groups agents into Perception, Cognition, and Governance, and uses horizontal peer coordination alongside separate vertical policy authorization.Agents negotiate with direct dependencies and locally mediate resource conflicts; absent consensus, action is suspended, while agreements still require R-AUT authorization and policy-violating acts are refused.Source: §2.3 · p. 31, §2.3.1 · p. 31

2.3.2. Typology and distribution of agents across the AAM/5C stack

  • Table 3 maps agent types to their group, layer, and role, with specialized agents assigned to the group of their layer.This typology links the stack’s organization to the distribution of specialized agents described in the later layer chapters.Source: §2.3.2 · p. 31, Table 3 · p. 32

2.4.2. Illustration: detecting a zero-day vulnerability

  • The nominal call follows a 20-step request, authorization, and response sequence; a zero-day scenario illustrates isolation and degraded service proposed, negotiated, authorized, and executed without manual intervention.The nominal authorization-chain target is 500 ms at the 95th percentile, excluding L4 reasoning; the vulnerability scenario is evaluated against H1, H3, H7b, and H8b.Source: §2.4.1 · p. 32, §2.4.2 · p. 33

Chapter 3. Problem Statement, Hypotheses and Evaluation Framework · From Thesis to Validation Program

Chapter 3 turns the problem of enabling local autonomy without losing security, governance, or stability into ten hypotheses and a framework for testing them. The numerical values are design targets, not empirical results; the framework distinguishes guarantees by construction from claims that must be measured and sets out protocols and validity limits.

3.1. The central problem: the cognitive complexity wall

  • The central problem is local autonomy without loss of security, governance, or stability, decomposed into six sub-problems spanning integration, coordination, governance, stability, cost, and reproducibility.Distributed coordination is designed to avoid a central orchestrator, while the authorization plane remains on the critical path except for acts covered by a capability envelope.Source: §3.1 · p. 35

3.2.1. Capture: H1 and H2

  • H1–H6 specify design targets for remediation, resilience, proactive management, cooperation, stability, and peer consensus.Targets: H1 MTTR below one minute under nominal load; H2 blast radius reduction greater than 70%; H3 proactive avoidance rate above 85%; H4 more than 95% of conflicts resolved without escalation; H5 oscillation amplitude below 5% of the setpoint; H6 consensus latency under 500 ms at the 95th percentile.Source: §3.2.1 · p. 35, §3.2.2 · p. 36, §3.2.3 · p. 36

3.2.4. Control: H7 and H8

  • H7 and H8 separate two guarantee-contract statements from refutable claims about log completeness and non-bypass of the enforcement point.H7a and H8a hold under the guarantee-contract assumptions; H7b is checked by cross-referencing resource-side act logs with sealed explainability logs, while H8b uses resource-side checks against PEP admission and L5–L6 authorization logs. The H8b instrument cannot detect acts executed under a script’s or human’s identity, and effective compliance depends on implementation rigor and policy coverage.Source: §3.2.4 · p. 36

3.2.5. Choose: H9 and H10

  • H9 targets a toil decrease greater than 75%, while H10 targets net savings exceeding 2.5 times the agentic layer’s total cost of ownership.H10’s cost includes inference, AOM roles, and the governance platform; H9 and H10 address economic viability, including human supervision.Source: §3.2.5 · pp. 36–37

3.3.1. Defensibility of the sub-problems

  • On the five-level defensibility scale, SP3 is partially verified, SP1, SP2, SP4, and SP6 are supported by analogy, and SP5 is plausible.SP3’s H7a and H8a hold by construction under the guarantee-contract assumptions; SP5 is supported only by the business model, whose parameters remain design targets.Source: §3.3.1 · p. 38

3.3.2. Multidimensional evaluation criteria

  • Evaluation covers operational performance, cognitive quality, stability and safety, and economic effectiveness, with statistical reproducibility for all results.Probabilistic components use 95% confidence intervals over at least 1,000 independent runs with distinct seeds and frozen policies; Wilson intervals apply to proportions and bootstrap to continuous quantities. Correctness and hallucination rates are assessed post hoc, while L6 rejections provide only a lower bound on hallucination rate.Source: From Thesis to Validation Program · p. 34, §3.3.2 · p. 38

3.3.3. Replicable experimental protocols

  • Four scenarios test the criteria: local incident, cascade, policy conflict, and simulated data exfiltration; the roadmap specifies six milestones, G0–G5.The program spans approximately 14 months from T0. A worked example has a doctoral student reproduce an event-chaining scenario on a 300-container Kubernetes test bench, recording seeds, policy versions, topology, and propagation times to measure H1, H2, and H6.Source: In Practice · p. 34, §3.3.3 · p. 39

3.3.4. Limitations and threats to validity

  • Validity is limited by modeling assumptions, smaller test settings, indirect metrics, L4 non-determinism, provider dependence, behavioral drift, and evaluation bias.The proposed mitigations include statistical reproducibility, multi-model abstraction, drift monitoring, pre-registered protocols, and third-party-validated test sets, whose implementation remains future work.Source: §3.3.4 · p. 39

Part II — Where and How · Chapter 4. Conceptual Model · Entities, Dependencies and Autonomy Loop

Chapter 4 defines AAM/5C’s component entities, dependency model, and autonomy loop, with L4 proposing and L6 deciding under R-AUT. It requires every autonomous act to be reversible within five minutes and separates deliberation from execution through validation.

4.2. Fundamental entities and abstractions

  • The model defines six entities and makes each functional component a deterministic execution engine paired with a probabilistic cognitive agent.The cognitive agent is a component capability, not an auxiliary process, and tests plans in a sandbox before proposing them; the six entities are the functional component, cognitive agent, dependency, policy, context, and primitive action.Source: §4.2 · p. 42, §4.2.1 · p. 42, §4.2.2 · p. 42

4.2.3. Multidimensional dependency

  • Dependencies are represented across functional, operational, and cognitive planes, with formal operators for composing dependencies and resolving policy conflicts.A signed, active policy can take precedence over functional coupling; the formalization leaves the ordering of operational dependency and dependencies across multiple paths unresolved.Source: §4.2.3 · pp. 42–44

4.2.4–4.2.6. The policy, context, and primitive action

  • Policies bound L4 proposals, contexts provide task-filtered working memory, and primitive actions are authorized acts executed only under R-AUT.Primitive actions are characterized by criticality, reversibility, and an explainability trace.Source: §4.2.4 · p. 44, §4.2.5 · p. 44, §4.2.6 · p. 44

4.3. Internal architecture: unifying decision and execution

  • Each component has five internal strata, which are distinct from the information system’s seven layers and the model’s five Capabilities.The strata address how decision and execution are unified within a component while preserving deterministic infrastructure control.Source: §4.3 · p. 44, Table 5 · p. 45

4.4. The DAL loop, or the five Capabilities in motion

  • The canonical DAL loop has five steps, and a distinct L6 validation separates deliberation from execution.Perception captures and filters signals; deliberation diagnoses and plans; validation applies signed policy; execution uses an L5 act token verified by the PEP; learning feeds results and traces into the agent and policy revision.Source: §4.4 · p. 45, Figure F.10 · p. 46

Entities, Dependencies and Autonomy Loop; 4.4. The DAL loop, or the five Capabilities in motion

  • DAL variants reinforce deliberation, validation, or learning review, while every autonomous act must be reversible in less than five minutes.The reversibility requirement calls for a designated reversal method and attested prior state; an act that cannot meet it is escalated to the AOM rather than executed autonomously.Source: Entities, Dependencies and Autonomy Loop · p. 41, §4.4 · p. 46

4.5. A2A and MCP: a cognitive backplane

  • A2A carries cognitive dependencies between peer agents, while MCP conveys signed policies that establish priority order.The chapter presents the protocols as a common integration approach for hybrid information systems and states that MCP reduces connector-building from N×M to N+M.Source: §4.5 · p. 46

4.6. Cross-cutting autonomy patterns

  • DAL variants instantiate autonomic-computing patterns, and the model adds pursuit of service objectives under policy constraints rather than fixed remediation scripts.The patterns include self-configuration and optimization, self-healing and protection, and self-explanation; the reversibility invariant applies to all of them.Source: §4.6 · p. 47

Chapter 5. Overview · Positioning, Autonomy Levels and Trajectory · Chapter 6. Implementation of Layers L1 to L3

Chapter 5 positions AAM/5C as a reference architecture, defines verifiable autonomy levels and a milestone-gated adoption path; Chapter 6 describes implementation of layers L1–L3. Governance must be in place before agents can act.

5.2. Positioning the AAM/5C model against existing agent orchestration frameworks

  • AAM/5C specifies the IS architecture, while orchestration frameworks supply implementation mechanisms; R-AUT is added whichever framework is chosen.The correspondence matrix distinguishes native, constructed and extended mechanisms; no concept is marked impossible, an argument for framework independence that reflects framework states in 2026.Source: §5.2 · pp. 48–49

5.3.1. Current state of the industry

  • About half of enterprise agentic AI projects remain at proof-of-concept or pilot stage, and 69% of agent decisions are human-verified, according to a Dynatrace survey.Gartner projects up to 40% of enterprise applications will integrate specialized agents by the end of 2026, from less than 5% in 2025, and more than 40% of agentic AI projects will be canceled by the end of 2027. These are projections, not reported outcomes; a controlled study found a comparable system reached Level 3 only partly overlapping with AAM/5C Level 3.Source: §5.3.1 · pp. 49–50

5.3.2. Eligibility criteria by level (E.C1)

  • The model assigns verifiable criteria to five autonomy levels, from passive systems to governed autonomy, with supervision, permitted acts and safeguards varying by level.At Level 2, humans decide whether to execute logged recommendations; Level 3 allows bounded low- or moderate-criticality acts with escalation; Level 4 extends to high-criticality acts within a bounded domain under R-AUT and reversibility.Source: Positioning, Autonomy Levels and… · p. 48, §5.3.2 · p. 50

5.3.3. Conditions for reaching Level 4

  • Level 4 remains a research frontier, conditional on secure MCP and A2A protocols, governance aligned with the EU AI Act, and economic viability at scale.Source: §5.3.3 · p. 50

5.4.1. Phase 0: the governance foundation, a non-negotiable prerequisite

  • Phase 0 makes governance a prerequisite to agent action, requiring signed-policy coverage, an all-path Policy Enforcement Point, reconciled logs, rehearsed key revocation, and staffed AOM roles.Closure requires 30 rolling days on the pilot scope with no unauthorized or unexplained acts, a successful epoch-revocation rehearsal, and expected admission or denial of test acts confirmed in reconciled logs; 30 days is a design target, and sparse activity may require a longer window.Source: §5.4.1 · pp. 50–51

5.4.2. Phases 1 to 4

  • After Phase 0, the indicative roadmap activates L1–L2 agents in Phase 1, adds L3 and multi-component L4 orchestration in Phase 2, extends controls toward Level 4 in Phase 3, and targets autonomous infrastructure in Phase 4.A practice example describes Phase 1 as six months moving two layers from Level 2 to Level 3, measured by intervention-free events, avoided toil and trace quality; the roadmap is not a guaranteed schedule.Source: In Practice · p. 48, §5.4 · p. 50, §5.4.2 · p. 51

5.4.3. Phase transition milestones (E.C2)

  • Phase transitions require a stable composite indicator, a compliance audit and, from Phase 1, measured ROI; failure of any criterion suspends transition and triggers AOM policy review.The indicators and ROI use a pre-set rolling 30-day design window, with a 12-month consolidation review; adoption milestones are distinct from Chapter 9's scientific-validation milestones.Source: Positioning, Autonomy Levels and… · p. 48, §5.4.3 · pp. 51–52

Chapter 6. Implementation of Layers L1 to L3

  • Chapter 6 presents L1 channels, L2 business logic and L3 integration, emphasizing intention-based expression, resilience to dependency failures and flow regulation by business importance.Source: IN BRIEF · pp. 48, 53

Channels, Digital Layer and Agentic Integration · Chapter 7. Implementation of Layers L4 to L7 · Orchestration, Security, Data and Infrastructure

This section presents the intent-driven upper layers and the lower-layer mechanisms that authorize, enforce, and support controlled, policy-governed autonomy across orchestration, security, data, infrastructure, and protocol defenses. It outlines guarantees under a defined contract alongside stated limits and validation needs for threat countermeasures and stability mechanisms.

6.1. Introduction: from execution to intent

  • Intent-Based IS makes business intent a shared human-agent grammar: L1 captures it, L2 translates it into commitments, L4 derives plans under R-AUT, and L6 checks whether it is met.The text presents reduced operator cognitive load as the expected effect.Source: §6.1 · pp. 53–54

6.2. Layer L1: communication channels and interface

  • L1 combines an agentic gateway, interface and IoT edge agents, and partner connectors; it forwards requests, signals bandwidth saturation, and shares perceived user intent with L2.These dependencies let L2 prioritize requests and adjust capacity.Source: §6.2 · p. 54

6.3. Layer L2: Digital and application

  • L2 micro-agents use local cognitive caches ordered by Lamport clocks to continue serving during data failures and reconcile writes in timestamp order after reconnection.Reconciliation requires a valid current-epoch signature and no quarantine; on either failed check or a tie, the reference source prevails, with a target convergence time under five minutes.Source: §6.3 · p. 55

6.4. Layer L3: integration and agentic service bus

  • L3 semantic flow regulation prioritizes messages by business importance during congestion, keeping critical intents served; its greedy heuristic’s roughly 1.5 approximation ratio remains unestablished, with no worst-case bound claimed.The model adds semantic importance to conventional queue and latency criteria.Source: §6.4 · p. 55

7.3. Layer L4: orchestration and processes

  • L4 limits controlled infrastructure adaptation by testing each plan in an isolated, policy-governed sandbox; detected invariant violations return the plan to planning, while passing tests do not prove invariants hold.Tests cover consistency, security, and compliance; policy conflicts or irreversible acts can be escalated.Source: §7.1 · p. 56, §7.3 · pp. 60–61

7.2. The CoT-Validate-Sign-Execute pattern

  • Sensitive acts follow CoT-Validate-Sign-Execute: L4 proposes a plan, L6 validates it against signed policies and attested attributes, L5 issues a proof-bound short-lived token, and the PEP verifies it before monitored execution.Tokens are single-use and last 300–800 ms depending on the act; self-declared attributes may restrict authorization but cannot expand it.Source: §7.2 · pp. 58–59

7.4.1. Components

  • L5’s components are a Zero Trust agent for A2A exchanges, a compliance sentinel, a behavioral threat hunter, and a social agent for negotiation, conflict arbitration, and issuing tokens and capability envelopes.Source: §7.4.1 · p. 61

7.4.2. Action control and its latency budget

  • The action-control chain targets a 500 ms 95th-percentile budget from act request to PEP token verification, with requests beyond the budget denied by default.The allocation is about 80 ms for identity validation, 120 ms for policy evaluation, 150 ms for Zero Trust evaluation, 80 ms for token issuance, and 70 ms for PEP verification, network margin, and logging.Source: §7.4.2 · pp. 61–62

7.4.3. Enforcement point, capability envelope and key lifecycle

  • The deterministic PEP rejects an act if any of five checks fail, while pre-authorized envelopes allow local verification during control-plane outages without permitting local issuance.Envelopes are limited to low- or moderate-criticality acts; high-criticality acts remain synchronous, and irreversible acts require human validation. The model’s security remains bounded by key custody, which the book does not specify.Source: §7.4.3 · pp. 62–64
  • Under the guarantee contract, admitted acts are logged before transmission and linked to a favorable L6 decision, establishing H7a and H8a subject to the contract’s assumptions.The contract requires, among other things, fresh revocation state, atomic single-use consumption, intact keys, and correct PEP interposition on every act path; H8b tests that interposition assumption.Source: §7.4.3 · pp. 64–65

7.5. Layer L6: data, knowledge and governance

  • L6 provides need-to-know-filtered business context and uses a policy engine to reject L4 proposals that violate expressible policy invariants.Its components are a Semantic Data Fabric, an MCP context provider, and an integrity agent; the stated targets include context freshness below one second and hallucination below 1% given sufficiently rich context.Source: §7.5 · p. 65

7.6. Layer L7: infrastructure and physical

  • L7 dynamically provisions compute, memory, and network, places workloads according to energy availability and cost, and anticipates hardware failures, with acts checked by the control-plane PEP.A hysteresis rule limits contrary decisions; the energy-spike example preserves critical services, while the magnitude of savings is left to future sectorwide simulation.Source: §7.6 · p. 65

7.7. Threats to the MCP/A2A nervous system; 7.7.1. Nine threats, two of them without a strong countermeasure

  • MCP and A2A are trust channels whose compromise threatens governance; the chapter describes seven protocol threats and countermeasures, including poisoning, prompt injection, interception, replay, and confused-deputy attacks.Examples include a reported mcp-remote vulnerability scored 9.6 CVSS [CVE-2025-6514] and EchoLeak’s click-free disclosure path [Ravia 2025]. Two vectors lack a strong countermeasure: a co-signing insider and compromise of the model provider.Source: §7.7 · pp. 65–66, §7.7.1 · p. 66

7.7.2. Defense in depth

  • Defense in depth combines countermeasures, but action control bounds the radius of action only under the PEP-interposition assumption and does not prevent abuse within that bound.The reasoning trace can evidence error and unintentional drift, but not an adversary controlling the component that produces it; the threat matrix also sets the minimum scope for quarterly red-team exercises.Source: §7.7.2 · pp. 66–67

7.8. Stability: preventing resonance

  • The model designs minimal peer consensus for high-criticality acts and hysteresis to reduce agent oscillation, but their effect remains to be measured and hysteresis must be calibrated for reaction delays.For eight regimes, h = 10% yields an estimated average dwell time of about 12 s under stated assumptions; these values are orders of magnitude, not proof of stability.Source: §7.8 · pp. 67–69

Chapter 8. Governance and Ethics

Chapter 8 explains how the organization governs an autonomous system through EU AI Act alignment, separation of powers, and human policy oversight. It also presents steering indicators and a business model for testing H10, including a scenario in which it does not hold.

IN BRIEF

  • The chapter links the model to EU AI Act requirements and argues that separation of powers between layers makes collusion difficult.It explains how the organization keeps control of a system capable of acting on its own.Source: IN BRIEF · p. 70
  • It describes the human organization responsible for writing, auditing, and revising policies.Source: IN BRIEF · p. 70
  • It gives ten steering indicators and a business model for testing H10, including a scenario in which the hypothesis does not hold.Chapter 9 then takes stock of the model and its ten hypotheses.Source: IN BRIEF · p. 70

Accountability, Balance of Powers and Auditability

This section frames accountability, separated authorization powers, human roles, policy-change controls and auditable action-control measures as architectural governance, while examining the economics and testability of H10. It notes that the H10 target may fail under plausible illustrative parameters and that its assessment depends on scale, cashability and fixing adopter-scale projection size before measurement.

8.2. Alignment of the AAM/5C model with the EU AI Act

  • Governance by design translates regulatory constraints, including the EU AI Act and GDPR [GDPR 2016], into runtime invariants; its core alignment covers Articles 9, 13 and 14, not the full regulation.The mapping describes policy-based risk evaluation, explainability logs and human intervention; an article-by-article analysis of other requirements remains future work, and the model claims no ISO/IEC 42001 certification [ISO/IEC 42001:2023].Source: §8.1 · p. 70, §8.2 · p. 71

8.3. The tripartite model: separating powers

  • The tripartite rule assigns proposals to fallible L4 agents, policy decisions to L6 and act tokens to L5, with final verification by the PEP [Chang 2025].The non-collusion argument is heuristic and conditional on attested L6 inputs and intact components; compromising the L6 governor agent can suffice, and mechanized proof remains future work.Source: §8.3 · pp. 71–72

8.4. The Agentic Operating Model: roles and responsibilities

  • The AOM assigns six roles—five human and one L5 agent—and separates Policy Engineer and Policy Auditor duties; its RACI matrix covers 14 activities and 10 responsibility columns [IIA 2020].The roles are organized across three lines of defense, with internal audit periodically checking the first two.Source: §8.4.1 · p. 73, §8.4.2 · p. 73, §8.4.3 · pp. 73–74

8.4.4. Managing policy changes

  • Permissive policy changes require advance proposal, dual signature and a new epoch, whereas restrictive changes may take effect immediately and are later consolidated through the ordinary process.Rollback republishes prior policy content under a new epoch and revokes tokens and envelopes from the faulty epoch; governance stability also requires permissive changes to respect the dwell-time threshold.Source: §8.4.4 · p. 74, §8.5 · p. 74

8.6. The ten steering indicators and the measurement of action control

  • Action control is measured by replay against labeled attacks, targeting authorization latency below 500 ms at the 95th percentile, TPR above 99% and FPR below 0.5%.Sector thresholds vary; three latency targets fall below the synchronous budget, so only locally verified, pre-authorized capability envelopes meet them, while high-criticality finance acts remain synchronous and under the 500 ms budget.Source: §8.6 · pp. 75–76

8.7. Business model of agentic autonomy: putting H10 to the test

  • In the illustrative 500-component model, annual operating cost is €4.98M without agents, while agentic operation yields €450,222 TCO, €1,689,038 gross savings and €1,249,888 net savings.These are locally calibratable design assumptions, not measurements of a real IS; construction costs are excluded, and H10’s event-based scope differs from H9’s toil measure.Source: §8.7.1 · pp. 76–77, §8.7 · p. 76, §8.7.2 · p. 77

8.7.4. Ratio and verdict by scenario

  • For the 500-component reference system, H10’s >2.5 efficiency target can fail under conservative parameters; central-case cash break-even requires p≈36%, and a 2.5 cash ratio requires p>90%.H10 measures efficiency rather than freed-up cash; in the conservative scenario, the system does not pay for itself in cash even at p = 1.Source: §8.7 · p. 76, §8.7.4 · p. 78

8.7.5. Minimum size to sustain H10

  • The H10 threshold is reached at about 260 components in the optimistic scenario, 450 in the central scenario and 1,950 in the conservative scenario.These thresholds rise if AOM or platform costs grow with the IS; the scale dependence is slated for testing at milestones G3 and G4.Source: §8.7.5 · p. 78
  • H10 is met in all three scenarios, so refutability assumes the projection size of the adopter’s IS is fixed before measurement.This is the G4 condition for testing H10.Source: §8.7.5 · p. 79

8.8. Key takeaways

  • Governance is built into the architecture: R-AUT separates powers, while six roles write, audit, and revise policies under explicit incompatibilities.The separation makes collusion difficult if L6 inputs are attested by intact components, though the argument remains heuristic; the model aligns with Articles 9, 13, and 14 of the EU AI Act.Source: §8.8 · p. 79
  • Ten indicators steer the system, action control is measured by latency and error rates, and the business model shows H10 can fail for large-scale IS.Chapter 9 takes stock of the model, its limits, and its validation program.Source: §8.8 · p. 79

Part III — Assessment and Outlook

Part III assesses the model against the ten hypotheses, distinguishing what is guaranteed from what remains to be measured. It also states adoption conditions for regulated environments and concludes the book.

Part III — Assessment and Outlook

  • Part III takes stock of the model against the ten hypotheses, identifies what is guaranteed and what remains to be measured, and states conditions for regulated-environment adoption.It follows Part II’s account of how the model is realized under the R-AUT rule, then concludes.Source: Part III — Assessment and Outlook · p. 80

Chapter 9. Assessment: Contributions, Limitations and Validation · What Is Guaranteed, What Remains to Be Measured

Chapter 9 summarizes AAM/5C’s contributions, the status of its ten hypotheses, its scope limits, and a validation roadmap with six milestones, each allowing a stop. It distinguishes two hypotheses guaranteed under stated assumptions from claims that remain to be measured.

What Is Guaranteed, What Remains to Be Measured

  • AAM/5C applies only to large-scale information systems and excludes four families of systems; its validation plan runs through milestones G0–G5, each with a possible stop.The chapter identifies these as acknowledged scope limits and a roadmap with quantified stopping criteria; Chapter 10 gives adoption conditions for regulated environments.Source: IN BRIEF · p. 80, What Is Guaranteed, What Remains to Be… · p. 80

IN BRIEF

In Practice

  • An executive committee is asked to decide whether to launch empirical validation on a test bench and then supervised banking and healthcare pilots.The proposed program is sequenced by quarters and includes three economic scenarios, one of which fails to meet H10; the committee’s decision does not itself validate the model.Source: In Practice · p. 80

9.1. Synthesis: what the model contributes

  • AAM/5C is a prescriptive reference model that combines known mechanisms under one authorization rule and adds three constructs that remain to be validated.The proposed constructs are the Validation step of the Distributed Autonomy Loop, the ephemeral authority surface, and the cognitive dependency plane.Source: §9.1 · p. 81
  • The model instantiates five capabilities across seven layers, with R-AUT separating proposal, decision, issuance, and verification within a human-governed architecture.The AOM writes, audits, and revises policies; sensitive acts follow the CoT-Validate-Sign-Execute pattern, bounded by the act token.Source: §9.1 · p. 81
  • H7a and H8a are guaranteed by construction under the guarantee contract’s assumptions; all other hypotheses are [DT], not [EM].H1–H6 are measured at G1, H9 first receives measurement there before a verdict after three quarters, H7b and H8b use independent-trace reconciliation, and H10 is decided at G4. H8b tests enforcement-point interposition.Source: §9.1 · p. 81
  • On a separate defensibility scale, SP3 is partially verified, SP5 is plausible, and the other four sub-problems are supported by analogy.These levels are distinct from the hypotheses’ epistemic-grid statuses.Source: §9.1 · p. 81

9.3. Validation agenda: six milestones G0 to G5

The section sets out a six-milestone validation program with quantified stopping criteria, including conditions for revising or abandoning the model. It summarizes AAM/5C as explicitly authorized, continuously audited, and reversible, with stated limits on its applicability.

9.3. Validation agenda: six milestones G0 to G5

  • G0 establishes a reproducible test bench with an observability SLO of at least 99% and validated explainability tooling.The setup includes an isolated Kubernetes cluster, candidate L4 agents, labeled synthetic datasets, and statistically reproducible runs.Source: §9.3 · p. 83
  • G1 is a supervised banking-process pilot measuring H1–H6, H8b, and an initial H9 measurement over three quarters.Its stopping criteria include simulated-incident MTTR below 1 minute, A2A consensus latency below 500 ms at the 95th percentile, and zero PEP bypass established by trace reconciliation.Source: §9.3 · p. 83
  • G2 tests AAM/5C in a healthcare case, measuring H7b and H8b against EU AI Act risk-management and record-keeping requirements.Criteria include zero unlogged acts and PEP bypasses, explanation quality above 85% at the lower confidence bound, and reported authorization latency and action-control rates.Source: §9.3 · p. 83
  • G3 calibrates a sector-specific economic model and requires parameterization for at least three sectors, ±50% sensitivity analysis, and independent review.The model includes token consumption, the share of small and large language models, operational savings, and the minimum scale needed to sustain H10.Source: §9.3 · p. 83
  • The planned sequence is G0, G1 with G3 in parallel, G2, G4, then G5, and each milestone allows abandonment; an uncorrectable G1 failure triggers model revision.If the PEP is not bypassed, refuting both H9 and H10 would defeat the model’s claim to human and economic viability; refuting H7b or H8b under the guarantee contract would challenge the interposition assumption behind H7a and H8a.Source: §9.3 · p. 84

9.4. Key takeaways

  • AAM/5C defines autonomy as explicitly authorized, continuously audited, and reversible, with every PEP-admitted act carrying a verified token or capability envelope and producing a log entry.The section says acts must be undoable in under 5 minutes, excludes four system families, and limits H10’s business-model claim to large-scale information systems under its stated parameters.Source: §9.4 · p. 84

Chapter 10. Toward Adoption in a Regulated Environment: Conditions and Roadmap

Chapter 10 marks the boundary between the book’s proposed model and the conditions a heavily regulated organization would require for production adoption. It states these requirements but defers resolving them to future work.

IN BRIEF

  • The chapter frames production adoption in a heavily regulated organization as beyond the book’s proposed model, stating requirements rather than resolving them.It identifies compliance and model risk, human escalation thresholds, supply chain security, resilience, data sovereignty, architecture standards, and proof through a case study as topics for future work.Source: IN BRIEF · p. 85
  • Chapter 11 draws from this discussion to reflect more generally on governing AI by design.Source: IN BRIEF · p. 85

The Conditions of Adoption and the Proof

The chapter sets out adoption conditions for AAM/5C rather than changing the model: the conditions remain unresolved and require dedicated engineering, accreditation, and empirical work. It proposes building safeguards into Information Systems architecture rather than adding them after the fact.

10.2. Regulatory compliance and model risk governance

  • EU financial entities must address DORA requirements, use-case classification under the EU AI Act, BCBS 239 risk reporting, and language-model inventory, independent validation, monitoring, and revalidation.DORA [DORA 2022] covers IT and incident risk, resilience testing, and third-party provider risk; BCBS 239 [BCBS 239] informs risk data aggregation and reporting. Prudential frameworks apply to generative and agentic AI only by analogy, and SR 26-2 [SR 26-2] excludes them.Source: §10.2 · p. 86, Figure F.17 · p. 86

10.3. Governance of high-stakes decisions

  • Safeguards should scale with risk and amount, from autonomous execution of reversible low-stakes acts to supervision, prior human validation, or exclusion.Liability for losses also requires an enforceable decision chain, assigned responsibilities, and coordination with internal control and insurance; thresholds remain to be calibrated.Source: §10.3 · pp. 86–87, Figure F.18 · p. 87

10.4. Security and supply chain / 10.5. Operational resilience and continuity

  • Regulated operation requires supply-chain provenance and security controls, plus testable resilience, degraded-mode behavior, emergency stops, incident procedures, and reduced dependence on one model provider.The proposed measures include SBOMs and SLSA provenance for MCP servers and models, hardened secrets and machine identities, threat-framework alignment, red-teaming, RTO/RPO targets, and periodic emergency-stop tests.Source: §10.4 · p. 87, §10.5 · p. 87

10.6. Data governance and sovereignty

  • Agentic decisions must be traceable to source data and policy while meeting quality, GDPR, and sovereignty requirements.The chapter identifies an explicit trade-off between auditability and minimization; cloud-security standards do not themselves address sovereignty, which depends on applicable law and data location.Source: §10.6 · p. 87

10.7. Integration into enterprise architecture standards

  • Architecture-board acceptance requires expressing the model in established architecture, security, cyber-resilience, and enterprise-architecture reference languages.The named mappings include ISO/IEC/IEEE 42010, C4, SABSA, NIST CSF, TOGAF, and ArchiMate; the deployment topology remains to be specified.Source: §10.7 · pp. 87–88, Figure F.19 · p. 88

10.8. Proof, positioning and industrialization

  • Future credibility work calls for a comparative benchmark, at least one quantified banking case study, and an industrialization path.That path includes maturity, total-cost and build-or-buy analysis, change management, and core-banking integration; the case study is intended to move hypotheses from targets to measured results.Source: §10.8 · p. 88

10.1. Purpose and status of this chapter

  • AAM/5C is not ready for deployment in heavily regulated organizations; its adoption conditions remain open and are deferred to future work.The chapter’s figures sketch the structure of the required work but do not replace engineering or accreditation; the bank risk committee scenario ends with a plan beginning with a quantified case study.Source: §10.1 · p. 85, In Practice · p. 85, §10.9 · p. 88

10.9. Key takeaways

Chapter 11. General Conclusion

The conclusion presents the book as a consolidated architecture model whose proof remains to be provided. It argues that humans must remain involved in setting rules and deciding organizationally committing acts, and frames the work as open to criticism.

IN BRIEF

  • The book aims to bring scattered solutions together in a consolidated architecture model, while acknowledging that its proof remains to be provided.Source: IN BRIEF · p. 89
  • The conclusion requires keeping humans involved in setting rules and deciding acts that commit the organization.Source: IN BRIEF · p. 89
  • It argues that confining AI to advice or allowing it to act without a framework leads to an impasse, and reduces the book to five principles for Information Systems that let AI act.The work is presented as open to criticism.Source: IN BRIEF · p. 89

Taking a Step Back: Governing AI by Design

This section presents AI governance as an architectural property, outlining the model’s safeguards, authorization roles, and normative references. It also records the author’s responsibility and disclosures, including the absence of measurements or a dataset and the use of AI tools in editorial work and translation.

11.1. An ambition, a proof to be provided

  • The book proposes a prescriptive reference model that brings known mechanisms together under a single authorization rule, with experimentation needed to establish governed autonomy.It adds the Validation step of the Distributed Autonomy Loop, the ephemeral authority surface and the cognitive dependency plane, all of which remain to be validated.Source: §11.1 · p. 89, §11.5 · p. 90

11.2. Humans, where the rules are set

  • Humans supervise routine acts, write and co-sign policies, decide irreversible acts, and hold the emergency stop, while each act is tied to a responsible human.Accountability is built into the architecture, although the liability regime remains unsettled.Source: §11.2 · p. 89

11.3. Between two dead ends, governing by design

  • Advisory-only AI leaves humans as a bottleneck, while unguided action dilutes responsibility; the proposed alternative builds safeguards into the architecture so control remains on the act’s path.The book argues that after-the-fact safeguards can be bypassed or forgotten, whereas architectural governance is tested by H8b.Source: §11.3 · pp. 89–90

11.4. Five principles for an IS that lets AI act

  • Five principles separate proposing, deciding and executing; require signed policies and human accountability; ensure traceability and human review of irreversible acts; and extend autonomy only with evidence.The human role shifts toward rule-setting, deciding organizational commitments and auditing; the book argues architectural control enables AI to act more, faster and across a wider scope without losing organizational oversight [RH].Source: §11.4 · p. 90

11.5. An open contribution

  • The model articulates inherited mechanisms under one authorization rule and adds three constructs for validation; H7a and H8a are guaranteed by construction, while other hypotheses are design targets, not results.The book invites testing and revision; it reports no empirically measured values.Source: §11.5 · pp. 90–91, Definitions · p. 94

Definitions

  • The model instantiates Capture, Comprehend, Choose, Coordinate and Control across L1–L7, and its Distributed Autonomy Loop adds validation distinct from planning.The glossary defines the ephemeral authority surface as the time-and-scope window of authorized acts; it also identifies the cognitive complexity wall as the threshold beyond which a team cannot hold system complexity in mind.Source: Definitions · pp. 93–94
  • Governance by design places guardrails on the act path, while R-AUT and separation of powers assign proposal to L4, decision to L6, token issuance to L5, and final verification to the PEP.The governor records its verdict in a signed evaluation proof; L5 binds the act token to that proof, and the PEP verifies both before execution.Source: Definitions · pp. 95, 97
  • The PEP checks authorization conditions before execution, rejects the act at the first failure, and records admitted acts in the explainability log before forwarding them.The checks cover token and proof signatures, epochs, scope, expiry and single use, quarantine, and the capability envelope; a failed log write counts as rejection.Source: Definitions · p. 96
  • Only H7a and H8a are theoretically guaranteed under the guarantee contract; the L6 policy guarantee is limited to invariants expressible in its policies.Errors that remain within the policy framework are bounded only by token scope and act reversibility.Source: Definitions · pp. 96, 98

Reference Documents

  • Normative references are design references or adoption conditions, whereas informative references supply theory, context, or illustration; neither category establishes deployment conformity.Entries include citation keys, bibliographic details, stable identifiers, and publication status.Source: Reference Documents · p. 99

Normative References

  • The listed normative references include BCBS 239, DORA 2022, eIDAS 2014, and the EU AI Act 2024.The definitions identify the EU AI Act’s high-risk-system requirements, particularly Articles 9, 13, and 14, as a design reference.Source: Definitions · p. 95, Normative References · p. 99
  • Normative references include the EU AI Act, [GDPR 2016], [ISO/IEC 42001:2023], [ISO/IEC/IEEE 42010:2022], [NIST SP 800-207], and [RFC 8693].The listed materials cover regulation, standards, zero-trust architecture, and token exchange.Source: Normative References · p. 99

Informative References

  • The informative bibliography includes agent-protocol security analysis and specifications for MCP and A2A.It lists [Anbiaee et al. 2026], [Anthropic 2024], [Google A2A 2025], and [MCP 2026].Source: Informative References · pp. 99–101

Author and Affiliation

  • Laurent Goujon is identified as a Distinguished Engineer and Executive Architect, and CTO of IBM Consulting France.The passage also provides his ORCID.Source: Author and Affiliation · p. 104

Conflicts of Interest

  • The author says the model and book are his own responsibility, do not bind IBM, and are not a product recommendation or promotion.He reports no other conflict of interest.Source: Conflicts of Interest · p. 104

Funding

  • The book received time from IBM France for study and analysis of its themes.Source: Funding · p. 104

Availability of Data and Artifacts

  • The conceptual volume reports no measurements or dataset; future validation can use the specified protocols, with data, traces, and artifacts published alongside results.Its formal artifacts are a Rego authorization policy and a non-executable-as-is excerpt of a TLA+ peer-consensus specification.Source: Availability of Data and Artifacts · p. 104

Use of Assistance Tools

  • AI tools assisted editorial tasks and translation from the French original, and the author reviewed and validated the resulting proposals and English edition.The author assumes full responsibility for the book’s content and translation.Source: Use of Assistance Tools · p. 104

Appendix 1. Experimental Protocols · Appendix 2. Mathematical Formalization · Appendix 3. Supporting Material

The appendices specify a preregistered protocol for testing the model, formalize conditional stability and peer-consensus properties, and detail how threats, responsibilities, and H7/H8 are addressed. They also state limitations: the formalizations are not mechanized proofs, and measured absence of violations applies only within the tested scope.

Appendix 1. Experimental Protocols

  • The protocol fixes each hypothesis’s metric, target, evaluation window, test bench, threshold, reference set, comparator, multiplicity correction, and sample size before measurement.Refutation requires the most favorable 95% confidence-interval bound to miss the target for three consecutive independent windows; for H7b and H8b, one observed violation refutes.Source: §1.1 · p. 105
  • The explainability test asks an uninvolved operator to reconstruct why an act occurred, which options were discarded, and which policy authorized it; the lower 95% Wilson bound must exceed 85%.Scenarios 1–4 test hypotheses, while H7a and H8a are analytical statements and H9 and H10 are assessed in the documented pilot, not isolated scenarios.Source: §1.3 · p. 106, §1.2 · p. 106, Table 12 · p. 106
  • The reproducibility package includes environment manifests, agent images or source, load scripts, signed versioned policies, model versions, seeds, raw logs, and analysis notebooks.H9’s quarterly measurement begins at G1 and is decided after three quarters in the G5 report; H10 is decided at G4.Source: §1.4 · pp. 106–107, §1.1 · p. 106

Appendix 2. Mathematical Formalization

  • A hysteresis threshold can produce an average dwell time, but the required threshold is estimated case by case and the formula’s assumptions do not establish stability for agents.For m = 8, λ = 5·10−4 s−1, and h = 0.10, the example gives τD ≈ 11.9 s; this is an order-of-magnitude sizing example, not a guarantee that τD ≥ τ*D.Source: §2.1.1 · p. 108
  • For γ > k, the modeled gap is damped if and only if (γ − k) · τ < π/2, giving critical delay τc = π / (2 (γ − k)).The hysteresis must both space out switches and keep reaction delay below τc; the linear single-delay model is an assumption, and stability on real traces remains to be studied.Source: §2.1.2 · p. 108
  • The TLA+ excerpt specifies consensus safety and conditional liveness, but is incomplete and unverified; safety assumes honest peers never accept incompatible acts, and liveness depends on partial synchrony.The specification has no mechanism for exiting asynchrony, so TLC verification would cover only executions admitted by the synchrony assumption, not real deployments.Source: §2.2 · p. 109, §2.2.4 · p. 111
  • The consensus tolerance target requires admissible peers and quorums satisfying 2q − n > f and q ≤ n − f, hence n ≥ 3f + 1; exceeding the bound degrades coordination but does not itself authorize an act.The adversary may control up to f peers and their messages, but not L5/L6 signing keys, the enforcement point, or the sealed log; applying the bound to median dependency scope is identified as an inference.Source: §2.2.1 · pp. 109–110, §2.2.2 · p. 110

Appendix 3. Supporting Material

  • H7b and H8b use independent trace reconciliation, including resource-side act logs, sealed explainability logs, PEP identity and admission, and L5–L6 authorization records; the collection’s coverage and limits must be reported.The appendices also provide a detailed MCP/A2A threat matrix and an AOM responsibility matrix assigning governance activities and control stakeholders.Source: §3.1 · p. 112, Table 13 · p. 113, §3.3 · p. 113

Appendix 4. Objections and Responses · Appendix 5. Personas · Index

Appendix 4 responds to objections by clarifying the model’s mechanisms, assumptions, and validation limits. Appendix 5 presents personas, and the Index directs readers to sections where key notions are treated.

Appendix 4. Objections and Responses

  • H9 measures toil through quarterly surveys and repeated-ticket analysis, while cognitive-load measures remain proposals and the refutable hypotheses have prespecified metrics and refutation conditions.The proposed cognitive-load composite combines an adapted NASA-TLX with an operational complexity index, whose convergent validity remains to be established; H7a and H8a are exceptions to the refutable statements.Source: Appendix 4. Objections and Responses · pp. 115, 117
  • L4’s probabilistic proposals are evaluated by L6 against signed policies; out-of-policy answers return to a human, while safety remains bounded by policy expressiveness.A hallucination that stays within policy is bounded by token scope and act reversibility.Source: Appendix 4. Objections and Responses · pp. 115, 117
  • The three-plane dependency model adds semantics absent from a generic directed acyclic graph, with C-Dep dedicated to policy dependencies.F-Dep, O-Dep, and C-Dep together compose the model’s dependency formalization.Source: Appendix 4. Objections and Responses · p. 115
  • The DAL’s claimed distinction is its separate Validation step, not a renamed OODA loop; its lineage is MAPE-K.Validation is entrusted to a layer distinct from the one that plans.Source: Appendix 4. Objections and Responses · pp. 115–116
  • Operational risks remain: prolonged outages can let degraded mode diverge; reconciliation after reconnection targets convergence in under 5 minutes, while the authorization plane remains on the critical path.Scaling is proposed as a design avenue to be sized and tested, via domain partitioning and capability envelopes; high-criticality acts remain synchronously authorized.Source: Appendix 4. Objections and Responses · p. 116
  • The threat matrix does not cover unknown vulnerabilities, and governance guarantees depend on key separation and lifecycle assumptions that the book does not specify fully.Defense in depth relies on behavioral detection, trace auditing, and tool signing; an administrator combining the policy-signing and log-sealing keys could nullify the property.Source: Appendix 4. Objections and Responses · p. 116

Appendix 5. Personas; Index

  • Role consolidation fits five human roles into 2 full-time equivalents at 500 components; the personas illustrate chapter vignettes, and the Index cross-references key notions to their main sections.Some incompatibilities remain: policy signatories, the Intent Architect, and the Policy Auditor are distinct, and the Policy Engineer does not authorize the policy they write; a mid-sized organization can pool the second line with internal control. The seven-persona gallery reports no results.Source: Appendix 4. Objections and Responses · pp. 116–117, Appendix 5. Personas · p. 118, Table 15 · p. 118

Appendix 4. Objections and Responses

  • AAM/5C’s claimed addition to NIST Zero Trust is a signed L6-proof/L5-token binding, a capability envelope without local issuance, and independent measurement of non-bypass.The model acknowledges that R-AUT partly resembles the separation of decision, credential issuance, and enforcement.Source: Appendix 4. Objections and Responses · p. 117
Loading 2610.30221v1…