Intent Architecture

The agent was configured correctly. Tested correctly. The security team reviewed it. Six months after deployment, it began routing renewal quotes to customers whose accounts had already been closed. The permissions were correct. The integration was working. The problem was that nobody had documented what the agent was actually authorized to accomplish, what data conditions it was allowed to act on, or who was accountable when its outputs caused harm.

When the question came, and the question always comes, the organization had no record showing that any human had formally decided this agent should exist, what it should do, and under what conditions it was appropriate. The configuration existed. The authorization did not.

That gap is the absence of Intent Architecture.

Intent Architecture is the organizational design work that must happen before any AI agent goes live. It covers three things: what the agent is authorized to do, expressed in plain language that a compliance officer can review; who made that authorization, recorded as a formal organizational decision; and what the boundaries are, including what the agent may not do, what data it may not reach, and what human review is required before it acts on certain conditions.

The word "architecture" is deliberate. Architecture is designed before construction begins. An organization that configures an agent and then decides what it should have been authorized to do is doing remediation under pressure, in the dark, after the fact.

Intent Architecture precedes technical controls. A well-configured agent operating without documented authorization, a named Consequence Owner, and a defined review process is still a governance gap. The configuration is correct. The organizational design layer is missing.

The Intent Architecture Stack is the operational framework that implements this concept across three organizational layers. Layer 1 documents the context, including the regulatory environment, the affected stakeholders, and the full scope of system integrations, before any intent is defined. Layer 2 records the intent, including the agent's authorized purpose, its permitted actions, its explicit prohibitions, and its expected outputs. Layer 3 establishes the governance structure, including the named Consequence Owner, the review cadence, and the escalation path.

Most organizations build Layer 1 informally, build Layer 2 partially, and skip Layer 3 entirely until something forces the question.

The Organizational Agent Controls framework operationalizes Layer 3 specifically, defining the five governance decisions every organization must make before any agent goes live, and distinguishing what the platform enforces from what the organization must design.

The Agent Substrate Readiness Model applies Intent Architecture to specific systems of record, Jira, Salesforce, ServiceNow, SAP, Workday, and the Microsoft stack, where agents are now reading and writing business-critical state. The question it answers is not whether the system can support agents technically. It is whether the organization has authorized agents to use those technical capabilities.

When Intent Architecture is missing, the Authorization Coverage Lifecycle begins accumulating Governance Debt from the moment the agent goes live. Each day the agent operates without a documented authorization record, a named owner, and a defined review process is another day of debt that must be addressed either deliberately or under external pressure.