Appendix CReference Architecture
The five layers from Chapter 18, drawn as one system, with the data flows and the trust boundaries that the body of the book argued for. The diagram is intentionally product-neutral: it is the shape a CIO should look for in any platform.
The layers and what crosses between them
| Layer | Components | What it holds | What crosses its boundary |
|---|---|---|---|
| Interface | Web app, browser side panel, desktop and mobile shells, embed widget, terminal skills | Nothing durable. Session tokens only, scoped to the person | User requests carrying the person's session token; rendered answers and action narration |
| Orchestration | The harness: loop, tool dispatch, budgets, approval modes, stop, run narration | Run state for the duration of a run | Model calls out through the model router; tool calls out through the broker; approval prompts up to the interface |
| Knowledge | MCP connectors, the broker, the ontology, the sandbox | Connector code; the broker's secret store, policy table and audit log; the ontology's mappings. No records | Calls into systems of record as the person or a scoped service identity; results back to the harness |
| Memory | Global, agent and shared memory stores; extraction jobs; the retrieval index | Memory rows in the institution's database; embeddings for retrieval | Relevant memories into the model context at each turn; extracted memories written back after a turn, subject to the three gates |
| Governance | Model router with classification policy; broker policy; sandbox network policy; approval settings; spend caps; audit | Policies and logs | Nothing. Governance is enforced where the other layers' calls pass, not as a separate flow |
The trust boundaries
Four boundaries matter, and each is a line a request crosses in only one direction.
Client to platform. The only thing a client sends is the person's session token and their request. The only thing it receives is answers, narration and approval prompts. No organization credential, no connector secret, no raw system-of-record access ever crosses to the client side.
Platform to model. Every model call leaves through the router. The router applies the classification policy, selects the provider or the local model, attaches the provider credential from the platform's own secret store, and records the decision. Restricted data reaches only models on the restricted list, which in most deployments means local inference on the institution's hardware.
Platform to systems of record. Every tool call leaves through the broker. The broker checks the policy table, deny by default, for the person's role, the agent and the tool; attaches the connector credential from its secret store; scopes the call to the person; forwards it; and writes the audit line. Connectors run inside the institution's perimeter.
Harness to sandbox. Code the agent writes runs in an isolated environment whose network policy is empty by default. Allowed routes are explicit and go through the broker under the same identity as any other tool call.
Deployment mapping
The same system maps onto the four deployment tiers from Chapter 3 by moving the boundary of "infrastructure the institution controls" inward, with no change to the components.
| Tier | Where the five layers run | Where the models run | Where the data path goes |
|---|---|---|---|
| Vendor's cloud | Vendor-operated, institution-owned code | Commercial providers via router; optional institution-hosted local models | Connectors reach institution systems from the vendor's environment through institution-approved routes |
| Institution's cloud account | Institution's AWS, Google Cloud or Azure tenancy, including government regions | Commercial providers via router plus local models on cloud GPUs | Entirely inside the institution's account |
| On-premise | Institution's data centre | Local models on institution GPUs; commercial providers optional | Entirely inside the institution's network |
| Air-gapped | Sealed network | Local models only; local embeddings | No outbound route exists; updates by signed bundle |
What the diagram proves if it is true
If a platform matches this shape, the four questions from Chapter 3 answer themselves. The code is readable because the institution deploys it. The data is in place because the knowledge layer stores no records. The model is a setting because every call goes through the router. The air-gapped tier is possible because no component depends on anything outside the layers shown. A CIO who can draw this diagram for their own estate, with real component names in each box, is at Level 3 or above in Appendix A.
Run the stack this book describes
ibl.ai is the agent operating system you run yourself: you own all the code and the data, in your cloud, on-premise or air-gapped, with any model, one identity across web, browser, desktop, mobile and terminal, and no per-seat pricing.