Skip to content

2026 04 26 agentic ai foundational conditions dependency ordering

Jump to bottom
github-actions[bot] edited this page Apr 30, 2026 · 2 revisions

Dependency ordering of foundational conditions for safe agentic Artificial Intelligence (AI) deployment: the prerequisite graph and the regulatory consequence of deploying at any layer before the layer below it is satisfied

Research Question

The foundational conditions for safe agentic AI deployment in a regulated financial institution are not independent, they form a dependency graph in which policy coherence is a prerequisite for information architecture, which is a prerequisite for access control, which is a prerequisite for safe agent credential scoping, which is a prerequisite for safe Retrieval-Augmented Generation (RAG) deployment over organisational knowledge, which is a prerequisite for safe deployment of the deployment pipeline gate itself. What is the correct characterisation of this dependency ordering? What is the consequence of deploying at any layer before the layer below it is satisfied, is the consequence merely increased risk, or does it constitute a control failure under any applicable regulatory framework? And does any existing framework, zero trust, operational resilience, or AI governance, explicitly encode this dependency ordering, or must it be constructed as a novel contribution?

Scope

In scope:

  • Characterising the dependency ordering of the following five foundational conditions: (1) policy coherence, (2) information architecture and access control, (3) agent credential scoping and least privilege, (4) permission-safe RAG deployment, (5) deployment pipeline governance gate
  • Whether each dependency relationship is logically necessary (lower layer must be satisfied for upper layer to be technically achievable) or merely strongly recommended (lower layer increases risk if unsatisfied but upper layer remains technically deployable)
  • The regulatory consequence of deploying at each layer before the layer below it is satisfied: is the consequence characterised by applicable frameworks, Australian Prudential Regulation Authority (APRA) CPS 230, Digital Operational Resilience Act (DORA), National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207, and International Organization for Standardization (ISO) 31000, as increased risk, governance gap, or current control failure?
  • Whether any existing framework explicitly encodes the dependency ordering, or whether the ordering must be constructed as a novel synthesis from first principles and the companion research items
  • Cross-reference and synthesis of findings from the five companion research items: permission-safe RAG and information architecture; access control amplification under agentic operations; implicit rate-limiting controls removed by agentic AI; policy coherence as machine-checkable prerequisite; deployment pipeline as governed control gate
  • The relationship between the dependency ordering and the systems capability debt causal chain established in prior completed research

Out of scope:

  • Detailed investigation of any individual layer (each is covered by a companion research item)
  • AI model selection, deployment architecture, or technical implementation of individual controls
  • Research methodology or data collection for the companion items, this is a synthesis item
  • Jurisdiction-specific legal analysis beyond what is needed to characterise the regulatory consequence finding

Constraints:

  • This item should not be started until the five companion items (permission-safe RAG, access control amplification, implicit rate-limiting controls, policy coherence, deployment pipeline) are completed, as it synthesises their findings
  • The dependency graph characterisation must distinguish logical necessity from empirical regularity, a relationship that has always been observed to hold is not the same as a relationship that is logically required
  • The regulatory consequence characterisation must be grounded in the findings of the completed regulatory preconditions item and the companion items, not asserted independently

Context

  • Companion items to synthesize:

    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] Policy coherence as a machine-checkable prerequisite
    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Permission-safe Retrieval-Augmented Generation (RAG) in enterprise information architectures
    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Access control amplification under agentic operations
    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] Implicit rate-limiting controls removed by agentic AI
    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Deployment pipeline as the only enforceable control gate

  • Foundational completed context:

    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] Systems capability debt and agentic AI operational risk: the causal chain and the AI-for-risk-reduction sequencing argument
    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-citizen-development-empirical-evidence.html] Systems capability debt as the root cause of citizen development: empirical evidence and effective governance architectures
    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] Regulatory and standards preconditions for deployment of agentic AI systems
    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-24-ai-agent-regulation-global-financial-services.html] Global artificial intelligence agent regulation in financial services
    • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-24-business-led-low-code-agent-governance.html] Business-led low-code agent governance: conditions for durable value versus fragmentation in regulated environments

Approach

  1. Dependency graph construction: Draw on the findings of all five companion items to construct the dependency graph of foundational conditions. For each dependency relationship, assess whether it is logically necessary or empirically observed. Produce a directed acyclic graph (DAG) of the relationships with a written justification for each edge.
  2. Layer-violation consequence analysis: For each layer in the dependency ordering, assess what the regulatory consequence is of deploying at that layer before the layer below it is satisfied, drawing on the regulatory preconditions completed item and the companion items for the specific control-failure evidence.
  3. Framework encoding survey: Survey the zero trust literature (NIST SP 800-207), operational resilience frameworks (APRA CPS 230, DORA, Basel Committee on Banking Supervision (Basel)), and AI governance frameworks (NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0, International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) 42001) for any explicit encoding of a deployment-prerequisites dependency ordering or any guidance that resembles the dependency graph constructed here.
  4. Novelty assessment: Assess whether the dependency graph is a novel contribution, i.e., whether no existing framework encodes the full ordering, or whether it can be derived from one or more existing frameworks without additional synthesis.
  5. Decision framework: Produce a decision framework characterising what each layer requires, what the minimum bar for "satisfying" each layer is, and what the test a board risk committee or risk function should apply to determine whether it is safe to proceed to the next layer.
  6. Synthesis: Integrate all findings into an executive summary, key findings, and a visual representation of the dependency graph suitable for use in a board risk committee presentation.

Sources

Related

Research Skill Output

(Full output from running the research skill - retained verbatim in the completed item. Sections 0-5 are the investigation; Section 6 seeds the Findings section below.)

§0 Initialise

  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Research question restated: what is the correct dependency ordering between policy coherence, information architecture and access representation, agent credential scoping, permission-safe Retrieval-Augmented Generation (RAG), and the deployment pipeline gate, and when an upper layer is deployed early does that create only incremental risk or a current control failure?
  • [fact; source: https://handbook.apra.gov.au/standard/cps-230; https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554; https://csrc.nist.gov/pubs/sp/800/207/final; https://www.iso.org/standard/65694.html] Scope confirmed: the synthesis tests the five named foundational conditions against operational-risk, zero-trust, and AI-governance frameworks, and distinguishes logical necessity from stronger-but-contingent recommendation.
  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html] Constraint confirmed: the framework survey must not overclaim explicit sequencing because the reviewed AI-governance and management-system sources are iterative and outcome-based rather than hard-coded as one linear checklist.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] Prior work cross-reference: the five companion items and the prior regulatory and systems-capability-debt synthesis items already establish each layer separately, so this item tests whether the combined ordering is explicit in any one framework or only visible as a cross-item synthesis.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Output format confirmed: knowledge, specifically a dependency graph, a consequence model, and a board-level progression test for each layer.

§1 Question Decomposition

  • Root question: does safe agentic deployment require a staged dependency chain, and if so which edges are logically necessary rather than merely prudent?
  • A. Lower-layer control objects
    • A1. What does the policy-coherence item establish about machine-checkable policy as a prerequisite for automated enforcement?
    • A2. What does the permission-safe RAG item establish about information architecture and permission representation as technical blockers?
    • A3. What does the access-amplification and machine-identity work establish about agent-specific least privilege and delegation?
  • B. Upper-layer deployment effects
    • B1. Under what conditions can permission-safe RAG be called safe rather than merely security-trimmed?
    • B2. Under what conditions is the deployment pipeline a meaningful control gate rather than an approval ritual?
  • C. Consequence of violating the order
    • C1. When does deploying an upper layer early remain a governance gap?
    • C2. When does it become a current or foreseeable control failure under prudential and zero-trust frameworks?
  • D. Framework encoding survey
    • D1. Does NIST SP 800-207 explicitly encode the lower-layer dependencies?
    • D2. Do NIST Artificial Intelligence Risk Management Framework (AI RMF) 1.0, ISO/IEC 42001, APRA CPS 230, or DORA present the full ordering as an explicit ladder?
    • D3. Does a staged maturity model such as the Capability Maturity Model (CMM) provide only an analogy or an actual match?
  • E. Novelty and decision rule
    • E1. If no single framework contains the full chain, what part is genuinely novel?
    • E2. What minimum bar should a board risk committee require before approving movement to the next layer?

§2 Investigation

Source access and framing notes

  • [fact; source: https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora; https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554] Access note: the EUR-Lex reader path was unreliable in this runtime, so the official regulation URL and the official European Securities and Markets Authority (ESMA) overview were used as the DORA source anchors.
  • [fact; source: https://www.iso.org/standard/81230.html; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html] Access note: the full ISO/IEC 42001 text remains paywalled, so claims are limited to what the official standard page and official ISO explanatory page expose directly.

A. What the companion items establish about each layer

  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] The policy-coherence companion item concludes that policy coherence is a practical prerequisite for any policy domain delegated to automated enforcement because policy engines can only enforce, test, and partially verify policies that have been translated into a coherent formal representation.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] The same item also qualifies that bounded-scope deployments can succeed with local typed controls even when enterprise-wide policy-estate remediation is incomplete, so the minimum logical unit is coherent policy at the delegated domain, not necessarily whole-enterprise policy perfection.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The permission-safe RAG companion item concludes that an incoherent permission model is a technical blocker because reviewed enforcement paths assume permissions can be represented either as correct metadata attached to indexed documents or as a live identity passed to the source system.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] The access-amplification item concludes that NIST SP 800-207 and NIST SP 800-53 explicitly support agent-specific least privilege, account lifecycle control, and processes acting on behalf of users, but they do not explicitly name machine-speed permission amplification as a distinct risk class.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] The implicit-rate-limiting item concludes that current frameworks largely do not explicitly name removed human friction as a control category, so the speed-of-consequence argument is first-principles rather than framework-verbatim.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] The deployment-pipeline item concludes that the deployment pipeline is the strongest enforceable release control once maker access already exists, but its force depends on having machine-checkable artefacts such as owner identity, permission scope, data policy, and promotion constraints.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] The regulatory-preconditions item concludes that incomplete least privilege, unclassified data, and ungoverned citizen development are already a current or foreseeable control failure under APRA CPS 230, DORA, NIST SP 800-207, and ISO 31000.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] The systems-capability-debt synthesis concludes that the sequencing rule, remediate the estate before broad write-capable autonomy, is not already assembled as one named framework in the literature and therefore is a novel synthesis rather than a direct restatement.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] The machine-identity item concludes that Artificial Intelligence (AI) agents and low-code artefacts should be represented as separate machine identities, not as durable extensions of human accounts, and that delegation must preserve both actor and subject identity if downstream action is to remain attributable.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html] The later policy-synchronisation item strengthens the same control surface by showing that development and delivery gates only remain meaningful if the Policy Decision Point (PDP) evaluates the same policy artefact across phases.

B. Dependency-edge assessment

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Edge 1, policy coherence to information architecture and access representation: this edge is logically necessary at the delegated-domain level because a classification, sharing, or authorization model cannot be encoded coherently if the governing policy is contradictory or not formalized enough to decide what the classes and rules are.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Edge 2, information architecture and access representation to agent credential scoping: this edge is logically necessary because least-privilege machine identity cannot be computed if the estate cannot represent which resources exist, which boundaries matter, and which permissions belong to each task.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Edge 3, agent credential scoping to permission-safe RAG: this edge is logically necessary for autonomous or cached knowledge access because the retrieval path must know whether it is acting under a bounded machine identity, a preserved delegation chain, or an unsafe borrowed human session; purely interactive live retrieval can reduce the copied-state problem but does not remove the need for a coherent acting identity.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] Edge 4, lower layers to the deployment pipeline gate: a pipeline gate can exist technically before the lower layers are mature, but it becomes a meaningful control gate only when it can evaluate stable policy, identity, access, and knowledge-boundary artefacts; otherwise it is an approval ritual that cannot prove safety.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] The removal of human pacing is not a separate prerequisite layer in this item's five-layer graph, but it is a cross-cutting amplifier that makes every upper-layer violation more severe once automation is continuous.

C. Framework encoding survey

  • [fact; source: https://csrc.nist.gov/pubs/sp/800/207/final] NIST SP 800-207 states that zero trust assumes no implicit trust, that authentication and authorization are discrete functions before a session is established, and that access to individual enterprise resources is granted on a per-session basis with the least privileges needed to complete the task.
  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/] The NIST AI RMF Core says the four functions are govern, map, measure, and manage, that actions do not constitute a checklist and are not necessarily an ordered set of steps, and that govern is a cross-cutting function infused throughout the other three.
  • [fact; source: https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook] The NIST AI RMF Playbook states that organizations may borrow as many or as few suggestions as apply to their use case, which reinforces that the playbook is adaptive guidance rather than a hard-coded prerequisite ladder.
  • [fact; source: https://www.iso.org/standard/81230.html; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html] ISO/IEC 42001 publicly describes an Artificial Intelligence Management System (AIMS) as a set of policies, processes, and controls for responsible development, provision, and use of AI, including risk management, data governance, lifecycle controls, monitoring, and continual improvement through a management-system pattern rather than an explicit dependency graph.
  • [fact; source: https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora] APRA CPS 230 and the ESMA DORA overview define obligations for effective internal controls, monitoring, remediation, Information and Communication Technology (ICT) risk management, incident handling, resilience testing, and third-party oversight, but neither source encodes the specific five-step deployment order tested here.
  • [fact; source: https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/; https://sei.cmu.edu/library/key-practices-of-the-capability-maturity-model-version-11/] The Software Engineering Institute (SEI) Capability Maturity Model (CMM) sources describe maturity levels and key practices for each level, which makes them a strong analogue for lower capabilities supporting higher ones, but they are process-maturity sources rather than agentic-AI deployment frameworks.
  • [inference; source: https://csrc.nist.gov/pubs/sp/800/207/final; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora; https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/] No reviewed framework explicitly encodes the full chain from policy coherence through permission-safe RAG to deployment gating, so the full ordering is a novel synthesis assembled from compatible but partial control statements.

D. Regulatory consequence of violating the order

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] Deploying automated enforcement before policy coherence is stabilized is best described as a derived governance failure that quickly becomes a control failure once the institution asserts that machine-speed behavior is being governed by that incoherent policy layer.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] Deploying permission-safe RAG before the access model is representable is not merely extra risk, because the companion RAG item treats that condition as a technical blocker and the regulatory-preconditions item treats unresolved access and data-governance debt as an existing control failure.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://csrc.nist.gov/pubs/sp/800/207/final] Deploying autonomous agent credentials before least privilege is established is a current or foreseeable control failure under zero-trust and prudential logic because the acting machine identity is then allowed to amplify an already over-privileged estate.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html] Deploying the pipeline gate before lower-layer artefacts are machine-checkable does not create a safe gate with some residual risk, it creates a weak control whose approvals cannot be trusted because the gate cannot verify the very preconditions it claims to enforce.

§3 Reasoning

  • [fact; source: https://csrc.nist.gov/pubs/sp/800/207/final; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230] The reviewed frameworks are explicit about control objects such as least privilege, governance, monitoring, lifecycle management, and resilience, but they are mostly mechanism-neutral about how an institution should order remediation work across those control objects.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] The most defensible way to classify an edge as logically necessary is to ask whether the upper layer can compute, verify, or constrain its own behavior without an artefact produced by the lower layer.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] That test narrows the first edge from "whole-enterprise policy coherence" to "coherent policy in the delegated domain," which resolves the bounded-scope exception without weakening the core dependency argument.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] The consequence moves from increased risk to control failure when the organization knowingly deploys a machine-speed upper layer whose safety claim depends on a lower layer that is already known to be absent or not demonstrable.

§4 Consistency Check

  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The only apparent tension across the companion items is that policy coherence is described as a prerequisite while bounded local typed controls can still succeed before whole-enterprise policy remediation is complete.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The synthesis resolves that tension by defining the lower bound as coherent policy and access representation for the delegated domain rather than for the entire institution at once.
  • [fact; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora] No reviewed framework page contradicts the synthesis by presenting an alternative explicit five-layer ladder, because the reviewed sources remain iterative, management-system, or outcome-based.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] The novelty claim therefore remains bounded: the contribution is the assembled ordering and consequence model, not the discovery of any one underlying control principle.

§5 Depth and Breadth Expansion

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Technical lens: each layer supplies the artefacts the next layer consumes, policy defines classes and constraints, information architecture renders those classes as enforceable objects, machine identity binds actors to least privilege, and only then can retrieval and promotion gates evaluate concrete state.
  • [inference; source: https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/] Regulatory lens: supervisors mostly judge the demonstrability and continuity of controls rather than the novelty of the technology, so the ordering matters because each skipped layer removes evidence that the next layer is actually controlled.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] Economic lens: organizations under systems-capability debt are structurally tempted to skip lower layers because the demand signal is immediate, but skipping them compounds remediation cost because machine-speed deployment multiplies the volume of exceptions, incidents, and audit exposure.
  • [inference; source: https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/; https://sei.cmu.edu/library/key-practices-of-the-capability-maturity-model-version-11/] Historical lens: the closest established analogue is staged maturity thinking, where higher-order optimization depends on lower-order process discipline, but the present item applies that logic to governance and agent deployment rather than to software-process maturity alone.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Behavioral lens: human operators often tolerate contradictions and over-broad access because friction and working-hour limits mask the defect, but autonomous agents remove that masking effect and expose the lower-layer weakness as an operationally active fault.

§6 Synthesis

(This section seeds the Findings below.)

Executive summary:

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] The best-supported dependency ordering for safe agentic deployment is coherent machine-checkable policy in the delegated domain, then representable information architecture and access boundaries, then scoped machine identity and delegation, then permission-safe Retrieval-Augmented Generation (RAG) or other knowledge access, and only then a deployment pipeline gate that can verify those artefacts.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] Violating the order at the first layer can begin as a governance defect, but once the institution deploys machine-speed automation that claims to enforce or rely on the incoherent lower layer, the consequence becomes a current or foreseeable control failure rather than a neutral risk increase.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://csrc.nist.gov/pubs/sp/800/207/final] Violating the order at the access, credential, or RAG layers is more clearly a control failure because the relevant companion items and zero-trust sources already treat weak permission representation and over-broad machine action as technically or architecturally unsafe.
  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora; https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/] No single reviewed framework explicitly encodes this full five-step ordering, so the contribution here is a novel synthesis built from zero-trust control objects, operational-resilience obligations, AI-governance functions, and staged-maturity analogy rather than a quotation from one governing text.

Key findings:

  1. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Safe agentic deployment is best modelled as a dependency chain in which coherent policy for the delegated domain must exist before access objects can be represented, access objects must be represented before least-privilege machine identity can be scoped, that identity model must exist before knowledge retrieval can be called permission-safe, and all four must exist before a deployment gate can validate anything meaningful.
  2. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html] The first layer is not whole-enterprise policy perfection but coherent policy at the delegated control domain, because bounded local typed controls can succeed before full policy-estate remediation, yet even those local controls fail if the governing rule set is contradictory or not synchronised across phases.
  3. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Information architecture and access representation are a hard technical prerequisite for agent credential scoping because a machine identity cannot be constrained to task-level least privilege unless the institution can state which resources exist, how they are classified, and which permissions belong to the job the agent is allowed to perform.
  4. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Agent credential scoping is logically necessary for autonomous or cached permission-safe RAG, while purely live user-delegated retrieval slightly qualifies the claim by reducing copied-state risk without eliminating the need for a coherent acting identity and access model.
  5. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] The deployment pipeline is the strongest enforceable enterprise chokepoint after maker access already exists, but it becomes a real control gate only when lower-layer artefacts such as policy bundles, identity declarations, access classifications, and retrieval boundaries are available for deterministic checking.
  6. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] Deploying an upper layer before the layer below it is satisfied is not merely an incremental risk increase once the missing lower layer is known, because machine-speed automation removes human pacing and turns missing prerequisites into active control failures or clear foreseeable-control-failure conditions.
  7. [inference; confidence: high; source: https://csrc.nist.gov/pubs/sp/800/207/final; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora] No reviewed zero-trust, prudential, operational-resilience, or AI-governance framework states the full five-layer ordering explicitly, because the frameworks define control objects and lifecycle duties but leave the exact remediation sequence to institutional design.
  8. [inference; confidence: medium; source: https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/; https://sei.cmu.edu/library/key-practices-of-the-capability-maturity-model-version-11/; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] The closest existing analogue is staged maturity thinking from the Capability Maturity Model, which supports the idea that higher-order capability depends on lower-order discipline, but the specific mapping from policy coherence to RAG and deployment gating remains a novel synthesis rather than a standard maturity model already accepted by regulators.

Evidence map:

Claim Source Confidence Notes
[inference] Safe agentic deployment follows the chain policy coherence -> information architecture and access representation -> agent credential scoping -> permission-safe RAG -> deployment pipeline gate. https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html medium Cross-item synthesis
[inference] Coherent policy is required at the delegated domain even if full-enterprise policy remediation remains incomplete. https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html medium Bounded-domain qualifier
[inference] Representable information architecture and access boundaries are a hard prerequisite for least-privilege agent scope. https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html medium Technical dependency
[inference] Scoped acting identity is logically necessary for autonomous or cached permission-safe RAG, though live user-delegated retrieval is a narrower exception. https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html medium Mode-specific qualifier
[inference] The deployment pipeline is only a meaningful control gate when lower-layer artefacts are machine-checkable. https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html medium Gate-quality condition
[inference] Deploying an upper layer early becomes a current or foreseeable control failure once the missing lower layer is known and automation removes human pacing. https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html medium Consequence model
[inference] No reviewed framework explicitly states the full five-layer ordering. https://csrc.nist.gov/pubs/sp/800/207/final; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora high Framework gap
[inference] Capability-maturity literature provides an analogy for ordered dependence, not a direct AI-governance encoding of this chain. https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/; https://sei.cmu.edu/library/key-practices-of-the-capability-maturity-model-version-11/; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html medium Analogy only

Assumptions:

  • None.

Analysis:

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Dependency graph: coherent delegated-domain policy -> representable information architecture and access boundaries -> scoped machine identity and delegation -> permission-safe RAG and tool access -> deployment pipeline approval gate.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] Layer 1, policy coherence: the minimum bar is one authoritative, current, testable policy artefact for the delegated domain. Board test: can the institution point to one machine-checkable source of truth that the agent or gate actually evaluates?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Layer 2, information architecture and access representation: the minimum bar is stable resource classification plus a permission model that can be rendered as metadata or live source authorization. Board test: can the institution compute a reliable allow-set for a given task without manual reconstruction?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Layer 3, agent credential scoping: the minimum bar is a separate machine identity or explicit delegation chain whose effective permissions are narrower than the estate maximum and attributable end to end. Board test: can every automated action be traced to an actor identity and justified as least privilege for that task?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Layer 4, permission-safe RAG: the minimum bar is retrieval behavior that stays inside the acting identity's boundary and updates correctly when permissions change. Board test: can the institution explain how retrieval, embeddings, and permission changes remain aligned for the chosen architecture?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html] Layer 5, deployment pipeline gate: the minimum bar is a gate that blocks promotion unless the lower-layer artefacts are present, current, and policy-consistent. Board test: would the gate fail closed if policy, identity, or access evidence is missing or stale?
  • [inference; source: https://csrc.nist.gov/pubs/sp/800/207/final; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora] Evidence was weighted toward sources that define control objects and obligations directly, then toward companion items that test the mechanism on the relevant control surface, and only then toward maturity-model analogy for the novelty assessment.

Risks, gaps, uncertainties:

  • [fact; source: https://www.iso.org/standard/81230.html; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html] ISO/IEC 42001 evidence is limited to public summaries because the normative text is paywalled.
  • [fact; source: https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora; https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554] DORA evidence is strongest on official control domains and weaker on article-level wording because the official reader path was unreliable in this runtime.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The edge from credential scoping to RAG is strongest for autonomous or cached retrieval architectures and slightly weaker for narrowly interactive live source retrieval.
  • [inference; source: https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/; https://sei.cmu.edu/library/key-practices-of-the-capability-maturity-model-version-11/] The Capability Maturity Model (CMM) analogy supports staged dependence conceptually, but it does not by itself validate the domain-specific order of the five layers.

Open questions:

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html] What is the smallest practical delegated-policy domain for which machine-checkable coherence can be certified before broader estate remediation?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Which live retrieval architectures can preserve user-bound permissions strongly enough to relax copied-index prerequisites without reintroducing hidden side channels?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] What proof artefact should a regulated institution require from a low-code platform before treating the native publish path as subordinate to the external deployment gate?

§7 Recursive Review

  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] The synthesis remains aligned with the five companion items and no key finding contradicts the source conclusions those items established on their own control surfaces.
  • [fact; source: https://csrc.nist.gov/pubs/sp/800/207/final; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora] Framework claims are limited to what official sources expose directly, and the full dependency ladder is labeled as synthesis rather than as explicit framework text.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] Adjacent completed items on machine identity, policy synchronisation, and systems-capability debt were re-scanned before final synthesis and incorporated where they sharpened the same governance surface.

Findings

(Populated from Section 6 Synthesis above.)

Executive Summary

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] The best-supported dependency ordering for safe agentic deployment is coherent machine-checkable policy in the delegated domain, then representable information architecture and access boundaries, then scoped machine identity and delegation, then permission-safe Retrieval-Augmented Generation (RAG) or other knowledge access, and only then a deployment pipeline gate that can verify those artefacts.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html] Violating the order at the first layer can begin as a governance defect, but once the institution deploys machine-speed automation that claims to enforce or rely on the incoherent lower layer, the consequence becomes a current or foreseeable control failure rather than a neutral risk increase.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://csrc.nist.gov/pubs/sp/800/207/final] Violating the order at the access, credential, or RAG layers is more clearly a control failure because the relevant companion items and zero-trust sources already treat weak permission representation and over-broad machine action as technically or architecturally unsafe.
  • [inference; source: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora; https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/] No single reviewed framework explicitly encodes this full five-step ordering, so the contribution here is a novel synthesis built from zero-trust control objects, operational-resilience obligations, AI-governance functions, and staged-maturity analogy rather than a quotation from one governing text.

Key Findings

  1. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Safe agentic deployment is best modelled as a dependency chain in which coherent policy for the delegated domain must exist before access objects can be represented, access objects must be represented before least-privilege machine identity can be scoped, that identity model must exist before knowledge retrieval can be called permission-safe, and all four must exist before a deployment gate can validate anything meaningful.
  2. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html] The first layer is not whole-enterprise policy perfection but coherent policy at the delegated control domain, because bounded local typed controls can succeed before full policy-estate remediation, yet even those local controls fail if the governing rule set is contradictory or not synchronised across phases.
  3. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Information architecture and access representation are a hard technical prerequisite for agent credential scoping because a machine identity cannot be constrained to task-level least privilege unless the institution can state which resources exist, how they are classified, and which permissions belong to the job the agent is allowed to perform.
  4. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html] Agent credential scoping is logically necessary for autonomous or cached permission-safe RAG, while purely live user-delegated retrieval slightly qualifies the claim by reducing copied-state risk without eliminating the need for a coherent acting identity and access model.
  5. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] The deployment pipeline is the strongest enforceable enterprise chokepoint after maker access already exists, but it becomes a real control gate only when lower-layer artefacts such as policy bundles, identity declarations, access classifications, and retrieval boundaries are available for deterministic checking.
  6. [inference; confidence: medium; source: https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html] Deploying an upper layer before the layer below it is satisfied is not merely an incremental risk increase once the missing lower layer is known, because machine-speed automation removes human pacing and turns missing prerequisites into active control failures or clear foreseeable-control-failure conditions.
  7. [inference; confidence: high; source: https://csrc.nist.gov/pubs/sp/800/207/final; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora] No reviewed zero-trust, prudential, operational-resilience, or AI-governance framework states the full five-layer ordering explicitly, because the frameworks define control objects and lifecycle duties but leave the exact remediation sequence to institutional design.
  8. [inference; confidence: medium; source: https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/; https://sei.cmu.edu/library/key-practices-of-the-capability-maturity-model-version-11/; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html] The closest existing analogue is staged maturity thinking from the Capability Maturity Model, which supports the idea that higher-order capability depends on lower-order discipline, but the specific mapping from policy coherence to RAG and deployment gating remains a novel synthesis rather than a standard maturity model already accepted by regulators.

Evidence Map

Claim Source Confidence Notes
[inference] Safe agentic deployment follows the chain policy coherence -> information architecture and access representation -> agent credential scoping -> permission-safe RAG -> deployment pipeline gate. https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html medium Cross-item synthesis
[inference] Coherent policy is required at the delegated domain even if full-enterprise policy remediation remains incomplete. https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html medium Bounded-domain qualifier
[inference] Representable information architecture and access boundaries are a hard prerequisite for least-privilege agent scope. https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html medium Technical dependency
[inference] Scoped acting identity is logically necessary for autonomous or cached permission-safe RAG, though live user-delegated retrieval is a narrower exception. https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html medium Mode-specific qualifier
[inference] The deployment pipeline is only a meaningful control gate when lower-layer artefacts are machine-checkable. https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html; https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html medium Gate-quality condition
[inference] Deploying an upper layer early becomes a current or foreseeable control failure once the missing lower layer is known and automation removes human pacing. https://davidamitchell.github.io/Research/research/2026-04-26-agentic-ai-regulatory-preconditions-control-failure-assessment.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html; https://davidamitchell.github.io/Research/research/2026-04-26-implicit-rate-limiting-controls-agentic-ai-removal.html medium Consequence model
[inference] No reviewed framework explicitly states the full five-layer ordering. https://csrc.nist.gov/pubs/sp/800/207/final; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora high Framework gap
[inference] Capability-maturity literature provides an analogy for ordered dependence, not a direct AI-governance encoding of this chain. https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/; https://sei.cmu.edu/library/key-practices-of-the-capability-maturity-model-version-11/; https://davidamitchell.github.io/Research/research/2026-04-26-systems-capability-debt-agentic-ai-risk-synthesis.html medium Analogy only

Assumptions

  • None.

Analysis

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] Dependency graph: coherent delegated-domain policy -> representable information architecture and access boundaries -> scoped machine identity and delegation -> permission-safe RAG and tool access -> deployment pipeline approval gate.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html] Layer 1, policy coherence: the minimum bar is one authoritative, current, testable policy artefact for the delegated domain. Board test: can the institution point to one machine-checkable source of truth that the agent or gate actually evaluates?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Layer 2, information architecture and access representation: the minimum bar is stable resource classification plus a permission model that can be rendered as metadata or live source authorization. Board test: can the institution compute a reliable allow-set for a given task without manual reconstruction?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-access-control-amplification-agentic-operations.html] Layer 3, agent credential scoping: the minimum bar is a separate machine identity or explicit delegation chain whose effective permissions are narrower than the estate maximum and attributable end to end. Board test: can every automated action be traced to an actor identity and justified as least privilege for that task?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Layer 4, permission-safe RAG: the minimum bar is retrieval behavior that stays inside the acting identity's boundary and updates correctly when permissions change. Board test: can the institution explain how retrieval, embeddings, and permission changes remain aligned for the chosen architecture?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html] Layer 5, deployment pipeline gate: the minimum bar is a gate that blocks promotion unless the lower-layer artefacts are present, current, and policy-consistent. Board test: would the gate fail closed if policy, identity, or access evidence is missing or stale?
  • [inference; source: https://csrc.nist.gov/pubs/sp/800/207/final; https://airc.nist.gov/airmf-resources/airmf/5-sec-core/; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html; https://handbook.apra.gov.au/standard/cps-230; https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora] Evidence was weighted toward sources that define control objects and obligations directly, then toward companion items that test the mechanism on the relevant control surface, and only then toward maturity-model analogy for the novelty assessment.

Risks, Gaps, and Uncertainties

  • [fact; source: https://www.iso.org/standard/81230.html; https://www.iso.org/home/insights-news/resources/iso-42001-explained-what-it-is.html] ISO/IEC 42001 evidence is limited to public summaries because the normative text is paywalled.
  • [fact; source: https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora; https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554] DORA evidence is strongest on official control domains and weaker on article-level wording because the official reader path was unreliable in this runtime.
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The edge from credential scoping to RAG is strongest for autonomous or cached retrieval architectures and slightly weaker for narrowly interactive live source retrieval.
  • [inference; source: https://www.sei.cmu.edu/library/capability-maturity-model-for-software-version-11/; https://sei.cmu.edu/library/key-practices-of-the-capability-maturity-model-version-11/] The Capability Maturity Model (CMM) analogy supports staged dependence conceptually, but it does not by itself validate the domain-specific order of the five layers.

Open Questions

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-policy-coherence-machine-checkable-prerequisite.html; https://davidamitchell.github.io/Research/research/2026-04-27-pdp-universal-policy-synchronisation-integrity.html] What is the smallest practical delegated-policy domain for which machine-checkable coherence can be certified before broader estate remediation?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Which live retrieval architectures can preserve user-bound permissions strongly enough to relax copied-index prerequisites without reintroducing hidden side channels?
  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-deployment-pipeline-citizen-development-governed-gate.html] What proof artefact should a regulated institution require from a low-code platform before treating the native publish path as subordinate to the external deployment gate?

Output

(Fill in when completing - what was produced as a result of this research?)

Navigation

Home

By Tag

bureaucracy

change-management

coase

constraint-analysis

control-model

decision-rights

delegation

delivery-risk

demand-segmentation

enterprise

exception-handling

execution

flow

flow-design

flow-metrics

governance

governance-patterns

incentives

instability

institutional-economics

leading-indicators

operating-model

organisation

organisational-design

queue-design

queueing

regulated-enterprise

routing

throughput

throughput-risk

transaction-costs

triage

williamson

Clone this wiki locally