The CAE architecture, layer by layer

The seven layers

1. Experience and workflow

Where people meet the system, and where the work actually arrives.

A ticket, a chat, an inbox, an IDE, a line-of-business screen. This layer decides what a person sees before and after an agent acts, and it is where approval and escalation are felt. Design it badly and every other control becomes a rubber stamp.

Components. Assistant surfaces · Ticket and case queues · Approval screens · Escalation paths · Notifications

What CAE adds. CAE asks one question of this layer: when the agent needs a human, does that human see the proposal, the evidence and the policy in one screen, in time to decide?

2. Orchestration and agents

Plans the work, coordinates agents and tools, retries, and knows when to stop.

The loop: plan, act, observe, repeat, and the coordination of several agents over shared state. This is where runaway cost, endless loops and unclear ownership appear first.

Components. Agent runtime · Multi-agent coordination · Shared task state · Workflow engine · Loop budgets

What CAE adds. Loop engineering: a step and cost budget, a progress test and a stop condition checked on every pass, with partial work kept when it stops.

3. Reasoning core

The models, and how you choose between them.

Probabilistic by design, and the part everyone argues about. Model choice matters for quality and cost, but no model choice makes an action safe: that is decided two layers down.

Components. Model portfolio · Routing by task and cost · Prompt and skill libraries · Caching · Fine-tunes

What CAE adds. Treat the core as replaceable. Nothing in your control plane should assume a particular model, and swapping one should not require a governance review of everything else.

4. Context and knowledge

What the agent is allowed to know, assembled per request.

Retrieval, the semantic model, memory and freshness. The governance question here is disclosure: can the agent learn something the person it acts for is not entitled to see?

Components. Permission-aware retrieval · Vector and hybrid search · Enterprise semantic model · Memory · Freshness and provenance

What CAE adds. Context is assembled, not pasted. Retrieval carries the requester's entitlements, and every fact the agent relies on can be cited by reference later.

5. Action and tools

How the agent touches anything outside itself.

Tool definitions, protocol servers, adapters and the credentials they carry. The set of things an agent can do now grows with a line of configuration, which is exactly why it needs an inventory and a review.

Components. Tool protocol servers (MCP) · Typed action schemas · Integration adapters · Service credentials · Tool inventory

What CAE adds. Agents propose typed actions; they never call a system of record directly. Every path to a change crosses the commit boundary in the layer below.

6. Control plane

What the agent may do, decided by code that the model cannot argue with.

Workload identity, scoped and expiring authority, policy as code, the commit boundary, evaluation and the evidence record. Platforms give you strong pieces of this and leave the joins to you: the boundary that checks identity, authority, policy and evidence together, in one place, on every action, is the part you build.

Components. Workload identity · Authority grants · Policy engine · Commit boundary · Evaluation suites · Observability · Evidence records

What CAE adds. This is the layer the book is about. A deterministic shell around a probabilistic core: permit, deny or escalate, and write the evidence on every path.

7. Systems of record

Where the truth lives, and the only place a change is real.

ERP, CRM, identity, ITSM, payments, the data platform. These systems have their own controls, their own auditors and their own idea of who may change what, and none of them were designed with an agent in mind.

Components. ERP and finance · CRM and service · Identity and access · ITSM · Payments · Data platform

What CAE adds. Preserve transaction authority where it already lives. An agent's action should be indistinguishable, to the system of record, from a properly authorised one, because it is.

Scenarios

Service desk resets an MFA factor

An assistant that has summarised tickets for six months is asked to finish the job: reset factors and add people to groups. Its credential now reaches every identity you have.

Layers that carry the risk. Action and tools · Control plane · Systems of record

What the platforms give you. All four platforms give you a runtime, tool definitions and audit logs, and the cloud platforms give you an identity system for people and workloads.

What you still build. Authority scoped per action and per user class; call-back evidence required before a reset; a commit boundary that refuses an unevidenced request whatever the ticket says; an autonomy step per action type; automatic demotion after an incident.

CAE constructs. Commit boundary · Authority grants · Evidence record · Autonomy staircase

Invoice to payment, end to end

Read the invoice, match it to a purchase order, decide, and pay. Money moves, so the interesting part is what happens when the agent is wrong.

Layers that carry the risk. Orchestration and agents · Action and tools · Control plane · Systems of record

What the platforms give you. Durable workflow engines, retries and queues are mature on every cloud, and the finance system has its own approval rules.

What you still build. Value and counterparty limits expressed as policy, not prompt; a second human for bank detail changes; a compensating action rehearsed before go-live, because a payment cannot be rolled back; an evidence bundle captured with each action.

CAE constructs. Commit boundary · Policy as code · Compensation not rollback · Minimum action evidence bundle

Claims and underwriting triage

A model ranks and recommends, a person decides, and the customer is entitled to know why.

Layers that carry the risk. Reasoning core · Context and knowledge · Control plane

What the platforms give you. Retrieval, model choice, content filters and evaluation tooling are all available off the shelf.

What you still build. A named decider for every adverse outcome; decision records that keep the options, the evidence and the objections; drift and fairness monitoring on the model; an explanation a customer can read.

CAE constructs. Evidence-first decision records · Recommendation is not authority · Evaluation suites

Agents inside the developer platform

Agents that write code, open pull requests and touch pipelines. Cheap code, expensive consequences.

Layers that carry the risk. Orchestration and agents · Action and tools · Control plane

What the platforms give you. Repository and pipeline identity, environment protection rules and code scanning are standard.

What you still build. Tokens scoped to a repository and an action, not an organisation; blast-radius limits on what a pipeline agent may deploy; human review that is real rather than nominal; flow mining over agent runs to see the paths actually taken.

CAE constructs. Zero trust for agents · Agentic flow mining · Autonomy staircase

Customer-facing assistant

Anyone can type anything into it, including instructions meant for the agent rather than for you.

Layers that carry the risk. Experience and workflow · Context and knowledge · Control plane

What the platforms give you. Content filters, PII detection and moderation endpoints are available on every platform.

What you still build. Permission-aware retrieval so an answer can never exceed the asker's entitlement; data classification enforced at the retrieval layer; prompt injection treated as untrusted input rather than a model problem; a clear escalation path to a person.

CAE constructs. Context is not a prompt · Commit boundary · Escalation design