The deepest two layers are not a platform problem. They are an org design problem.

Authority is granted by an organization before it is enforced by a system.

If you came here from the depth model, you already have the argument: own your source, own your surface — and the surface has five layers, worked from the inside out.

This page is where the last two of them get built. Not the code that enforces them — the design decisions that have to exist before any platform can enforce anything: who may grant authority, what gets recorded, and who owns the record.

Five layers, numbered outside-in and worked inside-out.

The surface is not a perimeter. It is depth — from how the agentic world perceives you, down to the record it must never rewrite. Two of those layers are commodities you should address and not overpay for. Three are urgent.

Start at the deepest layer, where the value and the danger both concentrate, and move outward. That triage order is the whole reason this page exists at the bottom of the stack rather than the top.

The full argument, the figures behind it, and the two commodity layers are at Pegasus Source. This page assumes them.

Not a list of prohibitions — those encode an estimate of capability, and the estimate is always wrong. An envelope states the systems, operations, and authority granted, and closes everything else. Writing one is an act of delegation: it forces an organization to say out loud which decisions it is prepared to hand over, and to whom.

An access log records that something happened. A trace records why it was allowed to. When an optimization target becomes evidence — and it does, the moment anyone asks a court or a regulator to look — the defensible answer was specified in advance or it does not exist. Deciding what the organization traces is deciding what it can later prove.

If the trace of your own decisions lives in a vendor's tenancy, on their retention schedule, in their export format, then the account of how your organization behaved is theirs to produce. This is the quietest of the three failures and the hardest to reverse — it is settled in procurement, months before anyone reads a log.

Reached, never rewritten — as a rule about people, not only about data.

The sovereign core is the encoded judgment of the business: the record of truth that everything else defers to. The discipline that protects it is stated technically — every data object carries its own governance metadata, and the record is reached through a scoped, revocable, logged interface rather than copied out to be rewritten elsewhere.

The organizational half of that rule is less discussed and breaks more often. Every copy of the core is an unowned second version of the truth — and copies are almost never made by attackers. They are made by a team under deadline, given a spreadsheet extract because the governed path was slower than the quarter.

Which means the core is protected by the same thing that protects any standard: making the governed path the fastest one available, and giving someone the authority to say no when it isn't.