IDENTITY-FIRST ENFORCEMENT ARCHITECTURE

Zero-trust control plane for Agentic AI: policy decided centrally, enforced at every hop, updated continuously. The flow-and-enforcement companion to the Reference Architecture stack view: that poster says what sits where; this one says how a request is policed end to end.
Identity & Policy Control Plane enterprise-wide, not AI-specific: agents are first-class non-human identities in the same directory, same governance
Identity Provider
Workforce + NHI AuthN. OIDC/SAML, MFA, device trust, continuous access evaluation.
e.g. Entra ID
NHI / ICAM: Agent Identity
Every agent: unique ID, named owner, least privilege, instant revocation. No shared service accounts.
e.g. Entra Agent ID · Agent 365
Token Service (OBO)
On-behalf-of exchange; short-lived, scoped tokens. The agent never outranks its principal.
PIP: Policy Information
Decision context: data classification, device posture, risk signals, session state.
PAP: Policy Administration
Where guardrail and authorization policy is authored: purple-loop findings land here.
PDP: Policy Decision
Central decision point: the non-LLM reference monitor. ABAC/PBAC with obligations; deterministic, auditable.
Continuous-Update Pipeline
Purple loop finds an evasion → PAP updates policy → PDP decides → hot-push to every PEP. No application redeploys. This is the deployment shape of the Gödel mandate (NIST, Jun 2026): no finite guardrail set is universally robust, so the architecture must assume guardrails change continuously, central authoring, distributed enforcement (CSA gateway prescription).
Consumption · hops 1, 11
1
User / App / Client
Every prompt is untrusted input. AuthN against the IdP; identity rides the whole flow.
11
Response Delivered
Only after output enforcement clears it.
Request enters → right; returns ← left.
Edge & Gateway · hops 2 - 3, 10
2
Edge Screen
WAF, rate limits, bot screening, coarse RBAC at the API gateway.
3
AI Firewall / LLM Gateway: Input Guardrail
Prompt-injection and jailbreak screening, schema and allow-list checks, before the model sees anything.
PEP
10
Output Guardrail
Grounding check, PII redaction, response filtering, before the user sees anything.
PEP
Input and output enforcement: two distinct points, both hot-updateable.
Orchestration · hops 4 - 5
4
Orchestrator / Agent
Planning and tool selection; system-prompt vault; runs under the agent's own NHI.
Agent Memory
Session-scoped, tenant-isolated, encrypted. The agent acts only under its delegated scope.
5
HITL Gate: High-Risk Acts
Human sign-off where impact warrants it. Human in command: a checkpoint, not a bystander.
PEP
Execution: Agent Enclave · hops 6 - 8
6
Model + Runtime Guardrail
Inference with I/O inspection wrapped around it. The model is capability, never authority.
PEP
7
RAG: Retriever + Vector DB
Sanitize, re-rank, provenance-check retrieved context; tenant-partitioned, integrity-verified store.
PEP
8
MCP Gateway → Tool Calling
Signed tool allow-list, call validation, output checks; sandboxed execution. External reach exits via egress only.
PEP
Deterministic environment boundary: the layer that holds when the model layer provably cannot (Gödel, Jun 2026). Steps 6 - 8 iterate: the agent loop runs inside the walls.
Data & Egress · hop 9
Data Sources: Classified
Docs, DBs, APIs under FGAC row/field filters delivered as PDP obligations.
PEP
Encryption & Tokenization
At rest and in transit; key-scoped access.
9
Egress Filtering / DLP
Exfiltration prevention. The only door out: every external call walks through it.
PEP
The Lethal Trifecta: every flow must break at least one leg
Leg 1: Private Data
Broken at the data plane: classification + FGAC obligations decide what the agent can even see.
Leg 2: Untrusted Content
Broken at the gateway and RAG: input guardrail screening + retrieval provenance before context enters the loop.
Leg 3: External Comms
Broken at the boundary: MCP signed allow-list + egress filtering, no unlisted destination, ever.
Federal Overlay
The agent enclave maps to your impact-level boundary (IL4/IL5: GCC-High / DoD regions; air-gapped where mission demands). The observability band below feeds cATO evidence taps: continuous monitoring is the authorization, not the binder, the same discovery-to-update cadence the Gödel result mandates.
Platform Security: cross-cutting
Secrets & KMS · Supply-chain provenance (SBOM/AIBOM, signed models & tools) · Network segmentation · mTLS service-to-service: every hop authenticated both ways.
Observability, Detection & Response
Structured logging incl. prompt-level capture (no prompt logs = blind spot) · Distributed tracing: prompt → tool → data lineage · SIEM / SOC (e.g. Sentinel) · Immutable audit trail · AuthN/AuthZ + CAE events · → cATO evidence tap
PEP= enforcement point querying the central PDP per request
1-9request path
10-11return path
continuous policy-update pipeline