Forward-deployed architecture, governance and assurance

Don’t take my word for it. Make the policy refuse something.

Your AI agents will be reviewed. I make sure you can account for what they did.

Every enterprise AI program eventually meets one question: which agent did that, on whose authority, and can you prove it? Below is a working evaluator answering it — not a recording, not a mock-up.

Book a conversation Assess your own stack

Vikram Jha · independent AI architect

One person, no bench, no reseller margin. Gulf · India · UK & Europe · United States.

Running in this browserDeterministic

Change any field. The decision, the rule that carried it, the evidence record and its digest all change with it.

The agent attempts to

Acting as

A human checkpoint is configured for this action class

DENYR2 · attributable authority

The grant covers the action, but it is a shared account — so no reviewer could later say which person authorized this. Consequential actions require an authority that resolves to someone.

Evidence record · what a reviewer finds months later

action         adjust_limit
requires       write:limits
principal      svc:shared
attributable   no — shared account
checkpoint     n/a
rule           R2 · attributable authority
decision       DENY

digest bdac8aa1 · changes with any field above.

What this shows: changing the context changes the decision, and the record changes with it. What it does not show: no business system is connected, and the checksum is not a signature. A real evidence system needs trusted retention, provenance and independent verification.

Both instruments compute locally. No request leaves this page.

Forward-deployed engineering

Need native AI in production, owned by your team?

I work as your forward-deployed engineer: inside your team, across the whole stack, with the first evaluated slice in three to four weeks of data access.

See how I work Book 30 minutes

01 · The claim

Refusal is the easy half.

Any gateway can block a call. What almost no stack produces is the record that makes a refusal — or a permission — defensible to someone asking about it eleven months later.

That is the difference between a control and evidence of a control. It is also the difference a reviewer is trained to find, because the control is what you tell them and the evidence is what they can test.

Most programs arrive at this backward: the policy engine goes in first, the log is whatever the platform happened to emit, and the reconstruction problem is discovered during the first examination — when the answer has to already exist.

Six questions a reviewer asks

Which agentan identity — not the platform

Whose authorityresolves to a person, not a role

What it toucheddata, tools, downstream systems

What stopped itthe rule, by name

Whenordered, immutable, hash-linked

Who reviewedthe checkpoint — or the absence of one

Instrument I answers all six for one action. Instrument II answers them for a sequence, and shows what happens when the sequence is edited.

02 · The method

Four layers, in dependency order.

Each layer depends on the one above it, which is why the order is not a matter of taste. The evaluator works because the first two are in place. The third is what makes it survivable afterward. The fourth is what makes it defensible to someone whose job is to disbelieve you.

Entitlements

An agent can only act inside an authority someone actually granted it.

authority granted, scoped, recorded

Policy enforcement

At the point of action — not in a document nobody reads.

a gate at the point of action

Attestation & audit

Months later, reconstruct what happened and why it was permitted.

the record that reconstructs the action

Model risk governance

That satisfies a reviewer, not just a dashboard.

validated against what it may do

03 · The stack

Five surfaces. Four layers. Twenty cells, one question.

The five surfaces are where the work happens. The four layers are how any one of them is governed once it exists. Breadth here reads as a system rather than a list because every cell resolves to the same question: which agent did that, on whose authority — and can you prove it?

Layer ↓ / Surface →	Agent protocols & orchestration	Context graphs & permission-aware retrieval	Security of the agentic stack	Sovereign & open-weight AI	Model risk & validation for agents
Entitlementsauthority granted, scoped, recorded	Agent-to-agent delegation contracts: who may invoke whom, and on whose authority	Retrieval scoped to the caller's own entitlements, not the index's	Non-human identity issued at machine rate; least agency by default	Who may load which weights, in which jurisdiction	Model inventory keyed to the actions each model may authorize
Policy enforcementa gate at the point of action	Control plane and data plane separated; idempotency and compensation	Purpose limitation and minimum necessary enforced at query time	Trust boundaries and egress control; content is not instruction	Residency gates on cross-border inference	Action-class limits derived from the validation outcome
Attestation & auditthe record that reconstructs the action	The call graph is not the authority graph — record both	Permission receipts for every document an agent was shown	An incident record that survives the credential being rotated	Evidence held inside the boundary it attests to	Decision records a validator can score, not a dashboard
Model risk governancevalidated against what it may do	Effective challenge of the orchestration, not only the model	Retrieval drift monitored as a model risk, because it is one	Adversarial pressure inside the validation plan	Open-weight parity measured on your workflow, not a leaderboard	Fed SR 26-2 and OCC 2026-13 applied to systems that act

Where a capability is bought rather than assembled, that is an engagement. Where the regime decides what evidence you owe, that is a sector.

04 · Evidence, not testimonials

No client names. So the work has to speak.

There are no logos on this site and there never will be. What exists instead is a research program anyone can inspect — and, where the sample is too small to mean anything, a published refusal to quantify it.

Not yet publishable

A sector median is published at twelve runs, and not before.

Below that the number says more about who happened to take the assessment than about the sector, and publishing it would be exactly the kind of unsupported quantification this practice exists to challenge.

Currently held back — Banking (3) · Other regulated industry (2) · Healthcare & life sciences (1)

Run the diagnostic The method in full

How the rubric reads — 0–100 per layer

Critical gap0–29

Weak30–54

Developing55–79

Defensible80–100

Only runs at 60% completeness or better are counted. Rows carry no organization, no email and no IP address, so nothing here can be traced to a respondent — including by me. The rubric is fixed and deterministic: the same answers always produce the same score, which is what makes comparison meaningful at all.

01 · Method available · collecting evidence

Agent governance readiness benchmark

What organizations actually score across entitlements, enforcement, attestation and model risk.

02 · Method available · collecting evidence

Open-weight parity evaluation

Whether a model you control can match a hosted one on the specific workflow, measured rather than argued.

03 · Method available · collecting evidence

Agentic incident patterns

What actually went wrong in public agent incidents, reduced to the failure that carried it.

04 · Open question · no findings yet

Open problems in agent governance

The questions this practice does not have good answers to, published deliberately.

05 · The obligation

Your score is only useful next to the obligation.

Every obligation lives in a different document, written by a different body, in a different decade. None of them mention agents. All of them apply. This is the map the work is built against — not a compliance product, a reading of what evidence each regime asks you to produce.

Jurisdiction	Instrument	What it actually asks you to evidence	Layer
US banking	Model Risk Management: Revised Guidance (OCC Bulletin 2026-13 / Fed SR 26-2)	Effective challenge by someone independent, ongoing monitoring, and a validation record covering what the system may do — not only what it predicts.	03 · 04
US health	HIPAA Security Rule — audit controls and minimum necessary	Minimum necessary as a decision you can show, and audit controls over every access — including the ones an agent made on a clinician's behalf.	01 · 03
India	DPDP Act — significant data fiduciary audit obligation	Purpose limitation enforced at retrieval time, and erasure that reaches the copies an agent made downstream. It reads as a privacy law and specifies an architecture.	01 · 02
India	FREE-AI committee framework	Accountability that resolves to a person inside the regulated entity, and fairness testing that survives the model being swapped.	01 · 04
Gulf	Guidance on the use of artificial intelligence	Supervisory expectations on outsourcing, residency and board-level oversight of automated decisioning.	03 · 04
Europe	EU AI Act	Logging, human oversight and post-market monitoring for high-risk use. A delay in the timetable is not a reprieve from the architecture.	02 · 03