I design decision-safe architectures and adversarial evaluation systems so enterprises can scale autonomous agents without losing control.
Across 30 years of enterprise architecture — production integration across Oil & Gas, Energy/Utilities, and CPG since 1996 — I have worked at the boundary between delegated authority, integration, governance, and operational evidence. My current work defines the architecture, implements decision governance, and tests whether the resulting controls actually hold.
| Workstream | What it proves | Start here |
|---|---|---|
| Architect | Autonomous agents require an enterprise-architecture domain built around delegated authority | Enterprise Agent Architecture |
| Evaluate | Security and governance claims can be tested adversarially, over the wire | Agent Security Harness |
| Govern | Authorized actions can be evaluated before commitment — and across sessions | constitutional-agent |
One body of work: I define the architecture, implement the governance mechanism, and build the evaluation system that tests whether it works.
Three inspectable proofs, one per workstream:
- Read the argument — the Enterprise Agent Architecture series, the case for a fifth architecture domain: cognitivethoughtengine.com/eaa (Parts 0–4, complete).
- Run the evaluation — send adversarial protocol traffic at an agent endpoint and grade what breaks:
pip install agent-security-harness agent-security test mcp --url http://your-server - Inspect the governance — the runtime WHY-layer, including cross-session risk composition:
pip install constitutional-agent. Live gate states, agent activity, and audit evidence: cognitivethoughtengine.com/eaa.
Enterprise architecture has four domains for what the enterprise builds and runs — Business, Information, Application, Technology — with Security across them all. None describe a non-human actor that holds delegated authority, acts autonomously, and composes tools it was never explicitly granted. Agents are not a new application tier. They are a new class of actor: a workforce. They need a fifth domain. That gap is the work.
The series — the fifth domain, one layer at a time. All four layers now published:
| Part | Layer | Status |
|---|---|---|
| Part 0 — The Case for a Fifth Architecture Domain | Position paper | Published — DOI 10.5281/zenodo.21105314 |
| Part 1 — No Box for a Non-Human Workforce | Agent / Workforce | Published |
| Part 2 — What an Agent Can Reach ≠ What It May Touch | Capability / Tool | Published |
| Part 3 — A Rule the Runtime Doesn't Enforce Is Theater | Control Plane | Published |
| Part 4 — When the Agent Acts, the Enterprise Answers | Governance | Published |
Practitioner artifacts: Agent Governance Maturity Model · Standards Landscape · Board Questions · TOGAF / ArchiMate extension · The Governance Layer OpenClaw Skipped
I do not just write about the agent workforce. I build the tools that prove how it fails and the research that measures it. The architecture rests on this, not on opinion.
Dated claims and evidence boundaries: PubPoint Facts & Evidence — what the counts below mean, how they're measured, and what they don't prove.
constitutional-agent on PyPI (v0.8.0) — the WHY-layer policy enforced at agent runtime, extracted from the reference implementation. pip install constitutional-agent
It evaluates authorized actions before commitment, and it composes risk across sessions: individually acceptable actions can accumulate into an unacceptable risk trajectory, so an agent that passes every per-call gate but crosses a cumulative threshold is still caught.
A July 2026 review of selected public product documentation did not identify an equivalent cross-session aggregate-risk decision mechanism. This is a dated documentation review, not a source audit.
An open-source framework that sends real adversarial payloads over the wire and observes what breaks — covering all four layers of the agentic-payments stack: comms (MCP, A2A), merchant journey (UCP, ACP), authorization (AP2 mandate + Visa TAP / Mastercard Agentic Tokens), and settlement (x402, L402).
red-team-blue-team-agent-fabric — adversarial agent-security test harness with AIUC-1 test mappings and JSON audit reports.
- Current release: v4.15.0 — 603 tests across 43 test-bearing modules.
- GitHub Action:
uses: msaleme/red-team-blue-team-agent-fabric@v4.15.0 - MCP server mode: any AI agent can invoke the tests directly.
- AIUC-1 crosswalk: maps to the testable certification requirements — see the mapping.
- Independently exercised by a community user against live infrastructure (AutoGen discussion).
How it differs. Unlike configuration scanners, the harness sends adversarial protocol traffic and evaluates the resulting behavior. It complements static scanning and does not replace a scoped penetration test. Complementary to Invariant MCP-Scan (static), Cisco MCP Scanner (YARA), Snyk Agent Scan (config), NVIDIA Garak (model-layer). Distinct in full-stack agentic-payments coverage, AIUC-1 mapping, MCP server mode, and research backing.
I study the gap between who an agent is and how it behaves — the WHO vs. HOW problem. Identity and authorization don't prevent an authorized agent from being manipulated into unsafe decisions. These are public preprints on Zenodo (not peer-reviewed); several are directly implemented as harness test modules.
| Paper | DOI | Focus |
|---|---|---|
| Enterprise Agent Architecture (position paper) | 10.5281/zenodo.21105314 | The case for a fifth architecture domain: agents are a workforce, not an application tier. |
| Authorized but Refused (telemetry) | 10.5281/zenodo.21263262 | Six months, 451,163 events from a live autonomous enterprise: the governance layer refused its own authenticated, authorized agents 30,496 times — the measured base rate behind the WHO vs. HOW gap. |
| Authorized but Composed (composition) | 10.5281/zenodo.21400261 | Cross-session composition addresses a blind spot in per-call governance: individually acceptable actions can accumulate into an unacceptable risk trajectory. |
| Present vs. Provable (methodology) | 10.5281/zenodo.21208547 | A testable conformance methodology for delegated payment authority — can a verifier prove the executed payment is the one authorized? |
| Claim-Level Negative Testing (evidence) | 10.5281/zenodo.21418701 | Negative testing at the claim level: does a governance receipt actually prove what it asserts, or merely that a check was present? |
| Signing Is Not Authorization (receipts) | 10.5281/zenodo.21535452 | A cryptographic signature proves origin, not permission — signed agent actions still require an authorization decision. |
| Constitutional Self-Governance (CSG) | 10.5281/zenodo.19162104 | The WHO vs. HOW governance gap — 77 days production data, 56 agents. |
| Beyond Identity Governance | 10.5281/zenodo.19343034 | Empirical evidence that gateways miss protocol-layer attacks — the gap, formalized. |
| Decision Load Index (DLI) | 10.5281/zenodo.18217577 | DLI examines decision load in AI-augmented work — and how to measure it. |
Standards engagement: 3 NIST submissions — CAISI RFI (Mar 1), NIST-CONCEPT-1 (Mar 12), NCCoE follow-up (Mar 21, 2026). x402 conformance-vector contribution to the Linux Foundation x402 Foundation (x402-foundation/x402#2776).
The four-layer model is not a whitepaper waiting for a reference implementation. The reference implementation came first; the architecture is the account of what it took to make it work.
HRAO-E is a live governed reference environment for constitutionally governed autonomous operations — a workforce of 50+ agents under a written constitution, with six-gate enforcement, per-agent delegated authority, and audit trails. It publishes operational status, agent activity, gate states, and audit evidence, and is a working instance of all four EAA layers: Agent / Workforce · Capability / Tool · Control Plane · Governance. Canonical home and live proof: cognitivethoughtengine.com/eaa.
- LinkedIn: linkedin.com/in/mikesaleme
- X: x.com/mikesaleme
- PyPI: agent-security-harness · constitutional-agent
- Community: A2A runtime attestation · AutoGen security testing
- Correspondence: contact@pubpoint.com — research, speaking, and professional correspondence.
This repository is provided for informational purposes. See individual project repositories for specific licenses.