Systems of trust: A fourth layer of enterprise architecture

<h2><span class="h6">Separating the supply of intelligence from the authority to act.</span></h2>

<p>Enterprises are moving from AI that advises to AI that acts. Agents built on frontier models are being connected to sensitive data, production systems and operational workflows, where their outputs become transactions, disclosures and changes to systems of record.</p>
<p>This shift creates a new category of insider risk: Any capable actor inside the perimeter, human or AI, can cause harm without being malicious.</p>
<h3><span style="font-weight: normal;" class="h4">Frontier models as insider risk</span></h3>
<p>Microsoft Chairman and CEO Satya Nadella has argued that frontier models should be treated as insider risks. The architectural principle follows: Separate the supply of intelligence from the authority to act.</p>
<p>Insider-risk programs exist not because employees are presumed hostile, but because anyone with access and autonomy can cause harm. AI agents now meet the same three conditions:</p>
<ol>
<li><b>Access.</b> Agents are granted credentials and connections to enterprise data and systems.</li>
<li><b>Autonomy.</b> Agents plan and take multi-step actions with limited human involvement.</li>
<li><b>Capacity to err</b>. Agents can misinterpret instructions, act on incomplete context or be steered by malicious inputs.</li>
</ol>
<p>The question for enterprise leaders is no longer only “Is the model good enough?” but also “What is this model allowed to do, who verifies it and how quickly can we stop it?”</p>
<h3><span style="font-weight: normal;" class="h4">The evolution of the enterprise stack</span></h3>
<p>Enterprise software has developed through several broad layers, each adding autonomy and consequence: systems of record, systems of engagement and systems of intelligence.</p>
<p>Even as enterprise systems moved beyond deterministic behavior over the last 15 years, organizations could still inspect the software, trace its execution and identify the rules governing it.</p>
<p>Frontier models make that task more difficult. We cannot reliably attribute every output to a particular training example, model weight or intermediate reasoning step.</p>
<h3><span style="font-weight: normal;" class="h4">The fourth layer: Systems of trust</span></h3>
<p>A fourth layer is, therefore, becoming necessary. A system of trust solves for containment rather than internal model alignment. It establishes deterministic boundaries, provides real-time telemetry and cuts off execution when an agent breaches policy.</p>

<p>Systems of trust add an enterprise-owned control layer to the existing stack. They apply a longstanding information security principle: The program being governed must not be able to bypass or modify the mechanisms that enforce its permissions.</p>
<p>Containment—versus alignment—is a vital principle of this layer. Model alignment tries to make the model behave well from the inside. Containment assumes it sometimes will not, and ensures the consequences are bounded from the outside. The two are complementary, but only containment gives the enterprise controls it owns and can evidence.</p>
<h3><span style="font-weight: normal;" class="h4">Why audits alone are not enough</span></h3>
<p>Audits remain essential, but they work after the fact. A record of an unauthorized transfer helps an organization investigate the incident; it does not prevent it. Agentic systems require controls that operate before and during execution.</p>
<p>Six controls form the core of a system of trust:</p>
<ol>
<li><b>Pre-execution authorization</b>. Every consequential tool call is evaluated before it can change an external system. This stops unauthorized actions instead of recording them.<br>
<br>
</li>
<li><b>Least-privilege access</b>. Agents receive only the permissions required for the current task, for only as long as needed, limiting the blast radius of any error or compromise.<br>
<br>
</li>
<li><b>Runtime containment</b>. Agents operate within defined boundaries governing the data, tools, systems and actions available to them, even when instructions are ambiguous or manipulated.<br>
<br>
</li>
<li><b>Independent verification</b>. Important actions are checked by controls separate from the model proposing them, whether deterministic rules, additional models, human approval or a combination. The model does not mark its own homework.<br>
<br>
</li>
<li><b>Observable execution</b>. Inputs, tool calls, approvals, state changes and outcomes produce durable, human-readable evidence.<br>
<br>
</li>
<li><b>Circuit breakers</b>. Authorized operators can pause or terminate an agent’s work before further actions are taken. Not many companies have invested here yet, but this will be an important mechanism as the capability scales out.</li>
</ol>
<h3><span style="font-weight: normal;" class="h4">Where enterprise value accumulates</span></h3>
<p>Models will remain a source of differentiation, but model quality alone will not determine whether enterprises can deploy agents in consequential workflows. That also requires identity, authorization, policy enforcement, observability, verification, containment and incident response.</p>
<p>Intelligence changes. Trust must persist. Models will be replaced, but the trust architecture around them must carry across models, providers and applications. Investment in the trust layer is not overhead on AI adoption; it is the foundation for scaling agents into higher-consequence workflows with confidence.</p>
<p>The next enterprise platform will be defined not only by the intelligence it provides, but by the authority it can govern.</p>
<h3><span style="font-weight: normal;" class="h4">Getting started on building a system of trust</span></h3>
<p>Enterprises should build a system of trust in step with the autonomy they grant agents:</p>
<ol>
<li><b>Assess:</b> Inventory current and planned agents and the consequence of each action.</li>
<li><b>Define:</b> Set policies for what agents may do, under which identities and actions need verification or human approval.</li>
<li><b>Instrument:</b> Route agent tool calls through an external control plane with pre-execution checks and full telemetry.</li>
<li><b>Contain:</b> Add runtime boundaries, independent verification and circuit breakers, starting with the highest-consequence workflows.</li>
<li><b>Scale:</b> Extend the trust layer across models, providers and business units.</li>
</ol>
<h3><span style="font-weight: normal;" class="h4">Governing authority in the agentic era</span></h3>
<p>The enterprise stack has grown from recording information, to engaging with it, to reasoning over it. With agentic AI, software now acts on that reasoning. That step requires a layer whose purpose is to govern authority: deciding what may be done, verifying it independently, recording it durably and stopping it when necessary.</p>
<p>Organizations that build this layer will be able to adopt new models quickly and extend agents into high-value workflows. Those that do not will find their AI ambitions limited not by model capability, but by their ability to trust it.</p>
<p><i>Learn how <a rel="noopener noreferrer" target="_blank" href="https://www.cognizant.com/us/en/services/cognizant-platforms/neuro-generative-ai-adoption">Cognizant Neuro® AI Decisioning</a> helps enterprises put agentic AI to work with trust built in.</i></p>