AI Operating Layer Reference Architecture

Model providers

Companies that train and serve foundation models, such as Anthropic, OpenAI, Mistral or Google, plus self-hosted open-weight models. The layer treats each provider as a replaceable supplier behind one governance.

The enterprise as deployer

The regulated organization that uses AI under its own authority. Under the EU AI Act it carries deployer duties, so it must own the policy, the evidence and the stop path.

Agents

Software actors that call models and tools to act inside a workflow. Each agent is a governed identity with a declared tool scope, a budget and an execution trace.

Human verifiers

Named people who approve, reject or override an agent decision where consequence carries. Their identity and their decision are part of the record, not a comment beside it.

The operator

The team that runs the layer day to day: on call, incident response, model changes, kill switch drills. During an engagement it may be Hikari Blue; after ownership transfer it is the client team.

Out of scope

Model training, model evaluation research, end-user application design and legal qualification of a given use case. The layer produces the evidence a lawyer needs; it does not replace the lawyer.

C1 · Multi-model by architecture

Property. Several foundation models run under one governance, and model choice is a routing decision per task, reversible at any time.

Failure prevented. Captivity to one provider's roadmap, pricing or jurisdiction, and a production outage when that provider changes or withdraws a model.

Test. Remove the primary provider for one production task class and route the task to the declared fallback. Measure elapsed time, code changes required and whether the audit trail records the switch.

Pass condition. The switch is a configuration change, not a code rewrite, and the trail shows the switch with its author and timestamp.

Regulatory hook. DORA treats ICT third‑party concentration as a risk to manage, and NIS2 requires supply chain security measures. A single-provider dependency is that concentration.

C2 · Audit by architecture

Property. Every action is recorded at the moment it happens, append-only, with the context a regulator needs to reconstruct the decision.

Failure prevented. An audit trail rebuilt from scattered logs in the week before an inspection, which is documentation, not audit.

Test. Pick one past decision at random and export its record. Measure whether it names the actor, model and version, policy, human verifier and timestamp without manual assembly.

Pass condition. The record is complete, exported from the trail itself, and any edit to it is detectable.

Regulatory hook. EU AI Act Article 12 requires high‑risk systems to record events automatically over their lifetime. Article 19 requires those logs to be kept, and Article 26 obliges deployers to keep the logs under their control.

C3 · Sovereign by construction

Property. Data residency, model jurisdiction and key custody are decided by the enterprise and enforced by the layer per workload, with zero cleartext data server‑side where the architecture demands it.

Failure prevented. A sovereignty promise that lives in a policy memo while prompts and outputs cross borders at runtime.

Test. Send a tagged workload through the layer and trace where compute, storage, inference and keys sit. Attempt to route it to a model outside its declared corridor.

Pass condition. Every hop stays in the declared corridor, keys stay in client custody, and the out-of-corridor attempt is denied and logged.

Regulatory hook. GDPR Article 35 requires a data protection impact assessment for high‑risk processing. The residency trace is the factual input that assessment needs.

C4 · Agent control by architecture

Property. Every agent runs under its own identity, with a declared tool scope, a budget and a stop path designed to act in seconds, timed in the engagement.

Failure prevented. Agents that act under a shared service account, cannot be attributed, and cannot be halted without shutting down the whole workflow.

Test. Ask an agent to call a tool outside its scope, then trigger the kill switch on that agent. Measure time from trigger to halt and confirm its tool permissions are revoked.

Pass condition. The out-of-scope call is denied and logged, the halt lands in seconds, and other agents in the workflow keep running.

Regulatory hook. EU AI Act Article 14 requires high‑risk systems to be designed for effective human oversight, including the ability to stop them. Article 26 assigns that oversight to competent people at the deployer.

The board report

A periodic summary built from the trail: workflows in production, agents by identity, model mix by provider, policy denials, human overrides, kill switch drills and incidents. Every figure links back to the records it aggregates, so a director can ask for the underlying evidence.

The regulator export

A scoped extract of raw records for one system and one period, with the policy versions and the agent register in force. It ships with the chain hashes so the recipient verifies integrity independently of the sender.

Ownership transfer

Custom code, custom models, fine-tunes, prompt libraries, runbooks and operating documentation belong to the client at exit. Reusable components we retain are listed exhaustively in the MSA, so nothing arrives as a surprise licence.

The evidence and control layer, optional

It is the layer we run our own engagements on, and the one we engineer and run for clients. A client may keep it after exit under its own control, or replace it with any component that passes the 4 controls.

Named accountability

One of 5 partners, Engineering, Strategy, Talent or Run, signs every engagement from week one to exit. The decision log carries the name of the operator who signed each line.

The wrapper

A thin interface around one model API. Removing the provider breaks the system, so it fails C1 and the provider switch test.

The retrofitted audit

Logs collected from several systems and stitched together before an inspection. The record is assembled by hand and cannot prove it was not edited, so it fails C2.

Policy memo sovereignty

Residency written in a contract clause while the runtime routes freely. Nothing denies an out-of-corridor call, so it fails C3 and the residency proof.

Shared-identity agents

Several agents acting under one service account. No action is attributable and no single agent can be halted alone, so it fails C4.

The dashboard without a stop path

A governance dashboard that shows activity but cannot halt it. Activity is not accountability; without a wired kill switch it fails C4 and the timing test.

Preferred citation

Hikari Blue, "AI Operating Layer Reference Architecture v1.0", 25 September 2026, https://hikariblue.com/reference-architecture

Section anchors are stable: #scope, #reference-model, #controls, #evidence, #operating-model, #due-diligence, #anti-patterns, #cite.

Changelog

v1.0 · 25 September 2026. First public version: scope and actors, 4 planes, 4 controls C1 to C4, 9-field evidence record, operating model by phase, 6-test due diligence protocol, 5 anti-patterns.

Editorial correction · 25 October 2026: license sentence aligned, scope and reservations stated.

License. Published under CC BY 4.0: free to cite, quote and reuse with attribution to Hikari Blue and a link to this page. The license covers Hikari Blue’s text, tables and diagrams on this page; it does not cover third-party data, quotations or legal texts, which keep their own terms, nor the Hikari Blue name and logo, trademarks of UNITED4 LLC.