The Concerns-by-Layers Matrix

As of August 2026. Phase 4 synthesis, rolled up from the mandatory cross-cutting concerns section in all 14 research tracks.

What this page is for

Every track answered the same ten concerns for its own layer. Read down a column and you get one layer's control set. Read across a row and you get something the per-track chapters cannot show: where a concern is actually owned, where it is enforced, and where it is merely inherited. Most architecture failures at this level come from confusing those three.

The distinction used throughout:

Owned means the layer defines the requirement and holds the accountability. Usually one or two layers per concern.
Enforced means the layer is where a violation is actually stopped. Frequently a different layer from the owner.
Inherited means the layer must carry the property through without weakening it. This is where most defects live, because inheritance is silent when it fails.

Row view: who owns, who enforces

#	Concern	Owned at	Enforced at	The failure that follows from getting it wrong
C1	Identity and access	R10 security and identity	R03 gateway (tool calls), R04 record systems (entitlement), R01 (workload identity)	Identity is asserted but never checked at the point of action, so audit shows an agent name against actions no policy ever authorised
C2	Observability	R12 observability and FinOps	Emitted by every layer, aggregated at R12	Coverage looks complete because the platform emits, while the licensed estate (R08) and the record systems (R04) emit into their own consoles
C3	Traceability and audit	R11 governance	R12 (collection), R14 (provenance at parse time)	Evidence is reconstructed after an incident rather than produced as a byproduct, which is the difference between an audit answer and an argument
C4	Grounding in reality	R02 data platform and R14 data engineering	R09 (hardest external bar), R05 (digital-twin validation before display)	The model answers over weak evidence instead of refusing, and the failure is invisible until it is external
C5	Impersonation and authenticity	R10	R03 (server identity), R08 and R09 (disclosure in shared and public surfaces)	Agent-to-human trust exploitation, which the threat taxonomies now list explicitly and which no technical control at the model layer addresses
C6	Sovereignty and residency	R11	R01 (serving location), R02 and R14 (index and derived-artifact locality), R03 (classification routing)	Residency is satisfied for the source system and quietly broken by an embedding, a trace, or a session artifact
C7	Data privacy	R11	R14 (erasure cascade), R02 (index scope), R12 (redaction in traces)	Deletion succeeds in the system of record and fails in the vectors, memories, logs, and telemetry derived from it
C8	Safety and human oversight	R13 operating model	R03 (gateway kill switch), R07 (harness caps and stop conditions), R01 (runtime), R05 (operator decision authority)	Oversight exists on the org chart and not in the workload, so the human is accountable for a decision they had no practical capacity to make
C9	Cost accountability	R12	R07 (per-run budgets in the harness), R03 (rate limits as budget controls)	Spend is attributed to a platform rather than a sponsor, and the supervision labour never appears in the business case at all
C10	Resilience and continuity	R01 infrastructure	Every layer's degraded mode; R12 (budget-exhaustion behaviour)	Failure modes compose: the fallback path is designed per layer and never tested end to end

#: C1
Concern: Identity and access
Owned at: R10 security and identity
Enforced at: R03 gateway (tool calls), R04 record systems (entitlement), R01 (workload identity)
The failure that follows from getting it wrong: Identity is asserted but never checked at the point of action, so audit shows an agent name against actions no policy ever authorised

#: C2
Concern: Observability
Owned at: R12 observability and FinOps
Enforced at: Emitted by every layer, aggregated at R12
The failure that follows from getting it wrong: Coverage looks complete because the platform emits, while the licensed estate (R08) and the record systems (R04) emit into their own consoles

#: C3
Concern: Traceability and audit
Owned at: R11 governance
Enforced at: R12 (collection), R14 (provenance at parse time)
The failure that follows from getting it wrong: Evidence is reconstructed after an incident rather than produced as a byproduct, which is the difference between an audit answer and an argument

#: C4
Concern: Grounding in reality
Owned at: R02 data platform and R14 data engineering
Enforced at: R09 (hardest external bar), R05 (digital-twin validation before display)
The failure that follows from getting it wrong: The model answers over weak evidence instead of refusing, and the failure is invisible until it is external

#: C5
Concern: Impersonation and authenticity
Owned at: R10
Enforced at: R03 (server identity), R08 and R09 (disclosure in shared and public surfaces)
The failure that follows from getting it wrong: Agent-to-human trust exploitation, which the threat taxonomies now list explicitly and which no technical control at the model layer addresses

#: C6
Concern: Sovereignty and residency
Owned at: R11
Enforced at: R01 (serving location), R02 and R14 (index and derived-artifact locality), R03 (classification routing)
The failure that follows from getting it wrong: Residency is satisfied for the source system and quietly broken by an embedding, a trace, or a session artifact

#: C7
Concern: Data privacy
Owned at: R11
Enforced at: R14 (erasure cascade), R02 (index scope), R12 (redaction in traces)
The failure that follows from getting it wrong: Deletion succeeds in the system of record and fails in the vectors, memories, logs, and telemetry derived from it

#: C8
Concern: Safety and human oversight
Owned at: R13 operating model
Enforced at: R03 (gateway kill switch), R07 (harness caps and stop conditions), R01 (runtime), R05 (operator decision authority)
The failure that follows from getting it wrong: Oversight exists on the org chart and not in the workload, so the human is accountable for a decision they had no practical capacity to make

#: C9
Concern: Cost accountability
Owned at: R12
Enforced at: R07 (per-run budgets in the harness), R03 (rate limits as budget controls)
The failure that follows from getting it wrong: Spend is attributed to a platform rather than a sponsor, and the supervision labour never appears in the business case at all

#: C10
Concern: Resilience and continuity
Owned at: R01 infrastructure
Enforced at: Every layer's degraded mode; R12 (budget-exhaustion behaviour)
The failure that follows from getting it wrong: Failure modes compose: the fallback path is designed per layer and never tested end to end

Seven invariants that hold at every layer

These emerged from the roll-up rather than being imposed on it. Each appears independently in three or more tracks, which is why they are stated as invariants rather than recommendations.

1. Derived artifacts inherit the strictest classification of their sources. Chunks, embeddings, topic models, session artifacts, traces, and fine-tuned weights are all derived artifacts. R02, R14, R12, R07, and R06 each reached this independently. The corollary is operationally hard: a derivation that mixes sources inherits the strictest of them, and no complete published solution exists for permissions on many-to-one derivations (see the open gaps).

2. Erasure cascades or it does not count. A deletion request must reach vectors, memories, traces, telemetry, eval datasets, and any fine-tuned artifact. Because embeddings are recoverable to their source text, they are personal data where their sources are. Named at R02, R14, R06, and R12.

3. Every layer degrades to a human queue. R01, R02, R03, R04, R05, R09, and R12 all specify this as the terminal fallback. The R09 form carries the sharpest edge: never manufacture containment through queue unavailability.

4. Telemetry is collected outside the agent's control. An agent cannot be trusted to report on itself, and self-assessment is treated as unreliable by default. R12 states it for traces, R07 for verification separated from generation, R13 for blind checks against self-report.

5. The kill switch is multi-point, and observability failure must not blind it. Cutting an agent off is available at the runtime (R01), the gateway (R03), the harness (R07), and the identity plane (R10) because each covers what the others cannot. R12 adds the constraint that an observability outage must not disable it.

6. Enforcement is deterministic and sits outside the model. The four irreversible zones are the strict form, but the general form recurs everywhere: approval rules may be held in the harness, they are enforced at the gateway; entitlement may be described in a prompt, it is decided in the record system.

7. Provenance travels inside the artifact, not alongside it. Provenance attached at parse time and carried through chunk, embedding, retrieval, and claim is the only form that survives. Provenance stored in a parallel system is provenance that will be out of sync at the moment it matters.

Column view: the ten concerns, by layer

The per-layer detail lives in each track's findings. This index is the navigation aid.

Layer	The concern this layer most distinctively carries
R01 Infrastructure and compute	C10 resilience: durable resumable sessions, snapshot and restore, and the runtime kill switch
R02 Data platform	C1 identity: ACLs crawled into index metadata with pre-filtered retrieval and fail-close on sync errors
R03 Integration fabric	C1 and C8 together: the gateway is where identity assertion and destructive-action gating both land
R04 Systems of record	C1 identity: agents act as the requesting user, entitlement never leaves the record system
R05 Line of business and OT	C8 safety: agent output is never an independent protection layer, and revert-to-manual is tested
R06 Intelligence and learning	C3 traceability: every promoted rule carries the counterexamples it survived and its eval deltas
R07 Agent platform	C9 cost: per-run budgets enforced in the harness, with the orchestration multiplier chosen deliberately
R08 Productivity and collaboration	C5 authenticity: agent output labelled in shared surfaces, no agent presenting as a colleague
R09 Experience and channels	C3 traceability: conversation records are legal evidence, because statements here bind externally
R10 Security and identity	C1 identity: registered first-class identities, JIT least privilege, deterministic decision on every consequential action
R11 Governance, risk and sovereignty	C3 and C6: retained evidence and the classification-routed deployment map
R12 Observability and FinOps	C9 cost: envelopes, caps, anomaly detection, and cost per outcome
R13 Operating model	C8 oversight: designed for prevention and legibility, with supervision cost in the business case
R14 Agent data engineering	C7 privacy: erasure cascades and the recoverability of embeddings

Layer: R01 Infrastructure and compute
The concern this layer most distinctively carries: C10 resilience: durable resumable sessions, snapshot and restore, and the runtime kill switch

Layer: R02 Data platform
The concern this layer most distinctively carries: C1 identity: ACLs crawled into index metadata with pre-filtered retrieval and fail-close on sync errors

Layer: R03 Integration fabric
The concern this layer most distinctively carries: C1 and C8 together: the gateway is where identity assertion and destructive-action gating both land

Layer: R04 Systems of record
The concern this layer most distinctively carries: C1 identity: agents act as the requesting user, entitlement never leaves the record system

Layer: R05 Line of business and OT
The concern this layer most distinctively carries: C8 safety: agent output is never an independent protection layer, and revert-to-manual is tested

Layer: R06 Intelligence and learning
The concern this layer most distinctively carries: C3 traceability: every promoted rule carries the counterexamples it survived and its eval deltas

Layer: R07 Agent platform
The concern this layer most distinctively carries: C9 cost: per-run budgets enforced in the harness, with the orchestration multiplier chosen deliberately

Layer: R08 Productivity and collaboration
The concern this layer most distinctively carries: C5 authenticity: agent output labelled in shared surfaces, no agent presenting as a colleague

Layer: R09 Experience and channels
The concern this layer most distinctively carries: C3 traceability: conversation records are legal evidence, because statements here bind externally

Layer: R10 Security and identity
The concern this layer most distinctively carries: C1 identity: registered first-class identities, JIT least privilege, deterministic decision on every consequential action

Layer: R11 Governance, risk and sovereignty
The concern this layer most distinctively carries: C3 and C6: retained evidence and the classification-routed deployment map

Layer: R12 Observability and FinOps
The concern this layer most distinctively carries: C9 cost: envelopes, caps, anomaly detection, and cost per outcome

Layer: R13 Operating model
The concern this layer most distinctively carries: C8 oversight: designed for prevention and legibility, with supervision cost in the business case

Layer: R14 Agent data engineering
The concern this layer most distinctively carries: C7 privacy: erasure cascades and the recoverability of embeddings

Open gaps: concerns with no complete answer anywhere

Published honestly, because a matrix with no holes in it would be the least credible artifact in this guide.

Gap	Layer	Status as of August 2026
Permissions on many-to-one derived artifacts	R14, C1 and C6	No complete published solution. Intersection-stamping is the emerging practice. Track for standardisation
Behavioural baselining for agents in the SOC	R10, C2	Unsolved. Agent behaviour is legitimately variable, so the human and workload baselining methods both misfire. Re-check after RSAC 2027
Multi-agent incident reporting	R11, C3	No frame exists. When several agents contribute to one incident, no regulation or standard says who reports what
Error budgets for agent quality	R12, C2	No published enterprise analog. Presented as an open pattern rather than a practice
Human-to-agent supervision ratio	R13, C8	No credible published figure from any source. Anyone quoting one is extrapolating
Embedded versus external agent comparison	R04	No published head-to-head measurement on identical tasks, so platform choice arguments rest on architecture rather than outcome data

Gap: Permissions on many-to-one derived artifacts
Layer: R14, C1 and C6
Status as of August 2026: No complete published solution. Intersection-stamping is the emerging practice. Track for standardisation

Gap: Behavioural baselining for agents in the SOC
Layer: R10, C2
Status as of August 2026: Unsolved. Agent behaviour is legitimately variable, so the human and workload baselining methods both misfire. Re-check after RSAC 2027

Gap: Multi-agent incident reporting
Layer: R11, C3
Status as of August 2026: No frame exists. When several agents contribute to one incident, no regulation or standard says who reports what

Gap: Error budgets for agent quality
Layer: R12, C2
Status as of August 2026: No published enterprise analog. Presented as an open pattern rather than a practice

Gap: Human-to-agent supervision ratio
Layer: R13, C8
Status as of August 2026: No credible published figure from any source. Anyone quoting one is extrapolating

Gap: Embedded versus external agent comparison
Layer: R04
Status as of August 2026: No published head-to-head measurement on identical tasks, so platform choice arguments rest on architecture rather than outcome data

How this matrix is used

Phase 5's roadmap checklist keys its gates to these rows: a roadmap variant may not promote a workload past A3 with an unaddressed concern in the enforcement column. Phase 6's blueprints instantiate the columns per department and vertical. Phase 7's vendor question bank asks vendors to answer the rows, which is a more revealing question than asking what a product does.

Source: synthesis/concerns-by-layers-matrix.md in the evidence repository behind this site.