Reference architecture (copyable mental model)
Researched: 2026-03-05
This guide is updated regularly. Sources are listed under “References & evidence.”
A useful enterprise model is three planes:
- Governance plane (policy + approvals + evidence)
- Execution plane (workflows running across people + systems)
- Integration surfaces (API / MCP tools / browser agents / RPA)
Why this matters
Most automation breaks at the boundaries:
- approvals happen outside the flow
- evidence is not produced during execution
- exceptions dominate and drift isn't owned
A reference implementation fixes this by design: gates + artifacts + drift loops are first‑class.
The three planes in detail
1) Governance plane
- Policy engine: data classes, tool allowlists, least privilege, thresholds
- Approval matrix: role × threshold × evidence required
- Evidence ledger: approval_record / exception_record / version_log
2) Execution plane
- Workflows model decision points and exception paths.
- HEIDI guides execution (voice + screen context) and captures evidence during the run.
- Drift signals route remediation to owners with SLAs.
3) Integration surfaces
- API: reliable, explicit contracts (best when available).
- MCP: standardized tool surfaces for models (pair with workflow gates).
- Browser agents: for internal apps without APIs (require tighter guardrails).
- RPA: task automation; treat as a surface, not the operating model.
Implementation checklist (what to build first)
Start with the minimum that makes automation provable:
- Define the decision points (what can go wrong, what needs approval).
- Define the evidence schema (what must be produced to prove outcomes).
- Build the approval matrix (thresholds + roles + dual control where needed).
- Add exception paths with owners + SLAs (no “email exceptions”).
- Add a drift loop: should vs is → remediation → closure evidence.
Scale rule
Only scale automation when evidence completeness and exception aging are stable. If those metrics drift, scaling multiplies risk.
References & evidence
Researched: 2026-03-05
- MCP specification: https://spec.modelcontextprotocol.io/specification/2025-03-26/
- Camunda (2026) agentic orchestration report: https://camunda.com/state-of-agentic-orchestration-and-automation/
- Deloitte Tech Trends 2026 (agentic AI strategy): https://www.deloitte.com/us/en/insights/topics/technology-management/tech-trends/2026/agentic-ai-strategy.html
Third‑party product names are used for identification only and may be trademarks of their respective owners.