The Layer That Doesn't Exist
Every autonomous AI system has the same architectural gap. It is not a missing feature. It is a missing layer.
The stack
However you decompose the architecture — model, tools, retrieval, memory, orchestration — the layers fall into two categories. Some generate intent: a model reasons, plans, and produces structured output. Others produce consequence: connectors, adapters, and protocol bridges translate that output into API calls, database writes, and external messages.
Each category has received significant engineering investment. Model providers optimise reasoning. Framework developers build sophisticated tool orchestration. Retrieval and memory architectures are active research areas.
But between intent and consequence — between the layer that decides what to do and the layer that does it — there is nothing. No evaluation. No policy check. No evidence. The model produces a tool call; the tool layer executes it. Constraints exist — rate limits, policies, approval steps — but they are embedded in the execution path, not separated as an independent evaluation plane. The pipeline is trusted by construction.
Trust by construction is not governance. It is the absence of governance.
The missing layer: In the current stack, model output flows directly to tool execution — trusted by construction, with no independent evaluation. The required stack inserts a governance plane between model and tool, rendering an explicit authority decision before consequence occurs.
Why it is absent
The gap is not accidental. It reflects how these systems were built.
Early tool-calling architectures were designed for demonstrations. The model was the operator. If the model produced a valid tool call, the system executed it — because a human was assumed to be watching. There was no need for an independent authority check because a human was in the loop.
As these systems moved into production, the human left the loop. But the architecture did not change. The pipeline still trusts the model’s output as implicitly authorised.
The human left the loop. The trust stayed.
The ecosystem has responded with safety mechanisms bolted onto the execution path — but none of them constitute an independent evaluation plane. They constrain behaviour. They do not evaluate authority.
The control plane
Networking architecture draws a well-understood distinction between the control plane and the data plane. The data plane moves packets. The control plane decides where packets should go. They are separate concerns with different failure modes and different operational requirements.
Autonomous AI systems need the same separation.
The execution path — model reasoning, tool invocation, API calls — is the data plane. It moves actions from intent to consequence. It is optimised for capability, latency, and throughput.
The governance layer is the control plane. It sits at the action boundary — the point between intent and consequence — and evaluates actions against policy before execution. It is optimised for correctness, determinism, and evidence integrity. It does not execute actions. It decides whether actions should execute.
The requirements follow from the separation: evaluate before execution, render an explicit decision, produce tamper-evident evidence, and keep the evaluation independent of the execution path. These are not properties you bolt onto a pipeline. They are properties of a distinct architectural layer — one that does not exist in the current stack.
When these planes are collapsed — when governance is embedded in the execution path, or when the execution path is trusted to govern itself — the system cannot distinguish between “this action executed” and “this action was authorised to execute”. The two become indistinguishable.
A system that cannot separate “it happened” from “it was authorised to happen” does not have governance. It has a pipeline.
The missing primitive
The action boundary is not a feature to add to existing frameworks. It is an architectural primitive — a layer that must exist between intent and consequence for governance to be possible at all.
Today, that layer is empty. Every action is implicitly authorised by the pipeline that executes it. Execution is its own justification.
A system where execution is its own justification is not governed. It is automation without authority.