生产级AI智能体面临的安全治理空白终于有了系统化的架构方案——做AI Agent部署、企业安全架构的团队可以直接参考这个五平面模型来设计自己的治理层，建议点开看看具体的中断原语和正确性证明。
企业安全传统上围绕数据边界构建，但生产级AI智能体打破了这一假设——它们代表企业读取上下文、调用工具、修改系统记录，风险从边界转移到了工作流内部。现有策略引擎无法处理这种状态化、复合主体的授权链场景。本文提出一个五平面参考架构：一个推理平面裁决意图，四个执行平面（网络、身份、端点、数据）实现决策，支持任意点中断、复合主体能力衰减和结构化审计。该架构定义了六种中断原语、四个正确性不变量，并在五个具体工作流中演示了七种生产威胁的防范。参考实现显示：裁决在个位数微秒内完成，审计底层的防篡改行为符合设计预期。
A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents
Enterprise security was built to govern data boundaries: the protected surface was data at rest and in transit, and the controls -- access control, data-loss prevention, perimeter inspection -- governed crossings of that boundary. Production AI agents dissolve this assumption. An agent reads context, calls tools, invokes connectors, and modifies systems of record on an enterprise's behalf, so risk moves inside the workflow, into sequences of individually-permitted actions that may transform a business process no one authorized. Existing policy engines do not extend to this regime: they evaluate request-time decisions against atomic principals, where agentic systems require stateful evaluation against composite principals whose authority attenuates through delegation chains. We present a reference architecture for the runtime governance of production agents, built from four composable primitives: a five-plane decomposition (a reasoning plane that adjudicates intent, and four enforcement planes -- network, identity, endpoint, data -- that realize the decision), stop-anywhere mediation, composite principals with capability attenuation, and audit as a structured evidence substrate. We define a taxonomy of six interruption primitives that generalize allow and deny, state and argue for four correctness invariants, and demonstrate the foreclosure of seven production-agent threats across five concrete workflows. A reference implementation of the policy-engine core supplies measured evidence: attenuation correctness and evidence reconstructability hold on every trial, adjudication runs in single-digit microseconds, and the audit substrate's tamper-evidence behaves exactly as designed. We are explicit about scope: the architecture governs delegated action, not model behavior, and a full-system evaluation against a live agent benchmark is the invited next step.