The Agentic Readiness Stack
By Bennett M. Reddin, Co-Founder & CTO, Aderit
Vibe coding is how you get a working demo. It's also how you get an agent with root access, no audit log, dirty data, and hardcoded secrets — running in production by Thursday because it impressed someone in a standup.
What you actually need is an Agentic Readiness Stack. It opens at Layer 0, because you cannot govern an agent you have not found. From there, eight layers of infrastructure most enterprise architects already recognize. Then ten more that you only discover you need after you've put agents in production and watched them fail in ways that are subtle, slow, and expensive.
Most organizations have pieces of four. Almost none have all nineteen.
The stack isn't new. The urgency is.
Layer 0 — Discovery
Before the two halves. The precondition for both.
Discovery
Before you can govern an agent, you have to find it. The agents you provisioned are not the agents you have. The ones living in notebooks, CI scripts, and someone's browser extension never applied for the job.
Every layer that follows assumes you already know what you're governing. Identity assumes an agent registered. Authorization assumes a policy was attached to something. Kill switches assume there's a switch wired to the thing you need to stop. An undiscovered agent inherits none of it.
You cannot train a worker you never hired. You cannot stop one either.
Layer 0 came from outside this stack. It is the capability Asanka Abeysinghe's trusted-AI-governance model has and our original eighteen did not. This stack was drawn from a platform builder's chair, where every agent is provisioned and discovery is free. From the enterprise chair, discovery comes first.
Part One — Foundational Infrastructure (Layers 1–8)
The layers any competent enterprise architect should recognize. Necessary. Not sufficient.
| # | Layer | Stakes |
|---|---|---|
| 1 | Identity | No attribution, no agentic enterprise |
| 2 | Authorization & Policy | Misconfigured policy = breach |
| 3 | API Management | Without it, agents DDoS your own infrastructure |
| 4 | Observability & Audit | Minimum viable trust layer |
| 5 | Data Quality & Canonical Models | The substrate — no model, no trustworthy output |
| 6 | Data Privacy & Compliance | Gateway enforcement and data lineage |
| 7 | Secrets Management | Existential in multi-tenant contexts |
| 8 | Integration Architecture | Not a prerequisite — it is the agent in practice |
Part Two — The Agentic Control Plane (Layers 9–18)
The layers that only become visible after agents are running. Each one earned by watching production agentic systems fail.
| # | Layer | Stakes |
|---|---|---|
| 9 | Agent Memory Governance | Memory is belief; beliefs need governance |
| 10 | Success & Failure Pattern Learning | No outcome loop, just confident repetition |
| 11 | Staged Autonomy | Trust is earned, not granted |
| 12 | Closure Rules | "Finished" ≠ "done correctly" |
| 13 | Reversibility Taxonomy | Match approval rigor to blast radius |
| 14 | Kill Switches | Named ≠ executable |
| 15 | Structural Coherence & Drift Detection | Catch the iceberg, not the shipwreck |
| 16 | Evidence Provenance | The "why did the agent conclude this" audit trail |
| 17 | Idempotency | Boring plumbing until it isn't |
| 18 | Communication Scope Enforcement | Authorization to speak, not just to act |
What SOC 2 covers, and where it stops
SOC 2 was built for systems whose behavior is specified in advance. An auditor tests whether a control operated effectively against that specification, across a period. The practice is sound. Agentic systems break the premise it rests on: there is no fixed output to specify, so effectiveness has to be established after the action rather than approved before it.
Much of the foundational half is SOC 2 in different clothing. The common criteria for Security cover layers 1, 2, 3, and 7. Confidentiality covers 6 and 18. Privacy covers 6 and touches 9. Processing Integrity is the richest overlap of all — its requirement that processing be complete, valid, accurate, timely, and authorized maps almost directly onto layers 5, 10, 12, and 17. An organization holding a clean report has genuine coverage of roughly seven layers, and should get credit for it.
Then there is the problem the framework was never designed to see. A Type II report tests controls across an observation window. An agent that learns changes its behavior inside that window. The control tested in month one is not the control operating in month six, and no code was deployed in between. The report is accurate. The system it describes no longer exists.
Five layers have no Trust Services equivalent at all.
| # | Layer | Why no criterion reaches it |
|---|---|---|
| 9 | Agent Memory Governance | No criterion anticipates a system that revises its own beliefs between audits |
| 11 | Staged Autonomy | No criterion describes a control whose scope is earned through measured performance |
| 13 | Reversibility Taxonomy | Change management governs deployments, not the reversibility of runtime actions |
| 15 | Structural Coherence & Drift Detection | Drift in outputs is addressed; drift in reasoning topology is not |
| 16 | Evidence Provenance | Audit logging establishes what happened, never why a conclusion was reached |
A clean SOC 2 report tells you the controls worked. It does not tell you the agent still behaves the way it did when they were tested. Those used to be the same statement.
Who owns the gap
A criterion with no owner is a criterion nobody builds. The five uncovered layers each need a named accountable party, and in most organizations they have none — which is the practical reason they go unbuilt long after someone has agreed they matter.
Platform engineering is Responsible for building all five. But for four of them, the Accountable party sits somewhere else entirely, because the judgment each layer encodes isn't an engineering judgment. Only the business owner knows which actions are genuinely costly to undo. Only compliance knows what evidence will eventually be demanded. That split is the structural reason these layers stall: the party who can build them isn't accountable, and the party who is accountable can't build them.
| Layer | Platform Engineering |
Security | Data Governance |
Compliance | Business Owner |
|---|---|---|---|---|---|
| 9 · Agent Memory Governance | R | C | A | C | I |
| 11 · Staged Autonomy | R | C | I | C | A |
| 13 · Reversibility Taxonomy | R | I | C | C | A |
| 15 · Structural Coherence | A / R | I | C | I | I |
| 16 · Evidence Provenance | R | C | C | A | I |
R Responsible, does the work · A Accountable, answers for the outcome · C Consulted · I Informed. A starting allocation, not a prescription; the useful exercise is filling it in with real names and finding the cells nobody will claim.
None of this is an argument against SOC 2. It is an argument that certification and readiness stopped being the same question, and that the gap between them is where agentic risk now lives.
Why this matters
Most of what's being sold as "enterprise AI" addresses layers 1 and 2 and calls it done. The organizations that will actually operate agentic systems in production are the ones who build all nineteen — sometimes from scratch, sometimes by recognizing that infrastructure they already have maps to this stack.
The most catastrophic layer is #5. Without a canonical data model, none of the others can be relied on — they're governing data that isn't trustworthy in the first place. The persistent canonical layer is what makes the rest tractable. That's what we built Aderit Record to be.
Layer 0 has a fair claim to the "most catastrophic" title. An agent nobody found is governed by nothing at all, #5 included, and that failure is total rather than partial. We still rank #5 first, for a narrower reason: undiscovered agents are a known unknown, and organizations that go looking will find them. Dirty canonical data fails silently, at scale, while every dashboard reports green. One problem announces itself the moment you ask the question. The other never does.
The full framework — implementation patterns for each layer, autonomy tier graduation criteria, kill switch operational design, evidence provenance certificate structures, and the architectural detail of how Aderit's products address layers 5, 8, 9–11, 13–16, and 18 — is available under NDA.