Skip to content

Diagrams

Systems · Architecture · Agentic Patterns

Visual explainers for governed AI architecture: monitoring versus enforcement, non-repudiation, authority decay, the liability equation, and the systems patterns behind the doctrine.

Runtime governance, step by step. A request arrives; rich telemetry is collected in real time (source IP and ASN, host and path, user and token, TLS, geo and device, historical signals); runtime policies evaluate identity and access, posture and risk, context and behavior, and business rules in milliseconds; a decision is made to allow, challenge, restrict, or block; Traefik enforces it instantly via routes, middleware, and dynamic config; and outcomes are logged so policies adapt over time. Allow proceeds to the service, challenge requires step-up verification, restrict applies rate limits or read-only or masked scope, and block returns a 403, 429, or custom page. Decide at runtime, not at deploy time: least privilege always, verify explicitly, observe everything, secure by default. Under five milliseconds per decision, over one hundred thousand decisions per second, zero downtime.

Runtime Governance: How It Works

Diagram2026-06-29

Continuously evaluate, decide, and enforce at runtime, without slowing down your apps.

The two-plane architecture. A public ingress plane carries the world to your apps: the visitor's browser reaches the Cloudflare edge (DNS, TLS, WAF, CDN, DDoS, optional Access), then one path per hostname (a Cloudflare tunnel dialing outbound, or a published 443 with an origin cert) to a single Traefik reverse proxy that binds 80 and 443 and routes by host and path over a private Docker network to your app containers, reached by service name rather than localhost. A separate private admin plane carries the operator to everything else over a Tailscale mesh VPN: SSH, dashboards, metrics, databases, secrets stores, and internal tools. The two planes join only at a deliberate meet point where at most one service at a time is exposed via an IP allowlist, never by accident.

The Two-Plane Architecture

Diagram2026-06-29

One box, one reverse proxy, zero public inbound ports: a private mesh for everything else.

Agent-written pull requests routed through a deterministic parser and authority gate to merge-ready or halt, with an audit decision receipt; fail-closed by default.

Fail-Closed Merge Admission

Diagram2026-06-16

Fail-closed merge admission for agent-written code: the gate is the product.

Before and after comparison: implicit execution authority with leaky primitives versus structural isolation behind an authority gate and untrusted-compute enclave.

The Missing Execution Boundary

Diagram2026-04-24

The missing unit is not a policy; it is an execution boundary.

Two panels: a governance taxonomy compared with a physical execution-boundary wall; categorization is not enforcement.

The Map Is Not the Territory

Diagram2026-04-21

The map of controls is not the territory of enforcement.

Flowchart: model output, pre-execution intercept, decision gate, ambiguity denial, fail-closed default, mutation attestation, then permit or deny.

Translating Reasonable Care Into Code

Diagram2026-04-17

What reasonable care looks like as an execution path.

The enterprise AI market split between observing after mutation and constraining before mutation across timing, risk, and proof.

The Enterprise AI Market Divide

Diagram2026-04-14

The market is dividing along one axis: before versus after.

A pipeline showing dashboard monitoring as telemetry that fires alerts only after the state mutation and damage have already occurred.

The Fallacy of Monitoring

Diagram2026-04-10

The alert arrives after the harm: that's the fallacy.

Equation of liability: high-risk AI plus consequential decision plus post-hoc governance equals preventable harm under the Colorado AI Act.

The Equation of Liability

Diagram2026-04-07

The statute makes post-hoc governance a liability, not a defense.

Advisory enforcement with direct DNS, socket, and credential access compared with physical containment through removed execution primitives, RPC stubs, and a fail-closed isolated boundary.

Governance Is Not Hope

Diagram2026-04-03

Monitoring is hope; containment is the alternative.

Four-step isolation model: isolate untrusted compute, remove standing execution paths, build ephemeral transaction routing, and enforce deterministic boundary chokepoints.

The Physics of AI Isolation

Diagram2026-03-31

Real control is physics, not policy.

Static policy versus runtime proof: policies and monitoring compared with cryptographic runtime evidence and deterministic fail-closed architecture.

From Policy to Runtime Proof

Diagram2026-03-27

If governance isn't enforced at runtime, it isn't governance.

Architecture A records events after mutation; Architecture B evaluates intent before mutation so violating output never reaches the decision surface.

Monitoring vs Enforcement Architecture

Diagram2026-03-24

The architecture divide, stated plainly.

Three columns: efficiency measured by cost and cycle time, an enforcement funnel for violations and receipt failures, and risk reduced by gated-substrate interception.

Governance Converts Risk Into Economics

Diagram2026-03-20

Governance is not a cost center; it converts risk into economics.

Runtime governance control-plane architecture: human authority feeds validation, receipt, and enforcement services, with observability, drift guard, and isolated workers.

Runtime Governance Control Plane

Diagram2026-03-17

The reference architecture, one picture.

Gated execution pipeline: Plan, Execute, Review, Approve, with authority, attestation, and constraint gates plus a failure-semantics recovery table under a human operator plane.

The Gated Execution Pipeline

Diagram2026-03-13

The whole loop: where each gate sits and what each failure does.

Advisory governance (probabilistic, post-hoc error walls) versus deterministic governance (a physical pre-execution choke point that halts execution).

Advisory vs Deterministic Boundary

Diagram2026-03-10

A wall you can walk through is not a boundary.

Exploded substrate architecture: ephemeral memory enclaves, namespace and microVM boundaries, restricted network primitives, no DNS resolution.

The Substrate Walls

Diagram2026-03-06

Isolation built up from the hardware, not bolted on as policy.

The airlock: an agent passes structured intent through an internal RPC stub to a deterministic control plane, with no direct path to the outside world.

The RPC Stub Airlock

Diagram2026-03-03

Agents submit intent; they do not hold execution rights.

Before and after comparison: post-hoc monitoring alerts after the write versus a runtime constraint that suspends the thread before mutation.

Monitor After vs Constrain Before

Diagram2026-02-27

Monitoring tells you it happened; a constraint stops it from happening.

Chart of an agent's authority level decaying over a session: minus ten percent time elapsed, minus thirty percent token budget, full revocation on context shift, then mandatory re-authorization.

Authority Decay Over a Session

Diagram2026-02-24

Standing authority is the bug; authority should decay and force re-auth.

Exploded view of a receipt: agent payload, policy version, cryptographic signatures, timestamp, anchored to an append-only ledger.

Anatomy of Non-Repudiation

Diagram2026-02-20

Non-repudiation is structural, not promised: the receipt carries the proof.

Side-by-side comparison: audit logs (asynchronous, observational, decoupled from policy) vs immutable receipts (synchronous, cryptographically chained, bound to policy version).

Audit Logs vs Immutable Receipts

Diagram2026-02-17

Audit logs are written after the fact; an immutable receipt is written as a precondition of the act.