Execution-Layer Governance for AI Agents: A Deterministic Control Plane Architecture for Secure AI Automation

This document contains a technical response submitted to the National Institute of Standards and Technology (NIST) Center for AI Standards and Innovation Request for Information regarding security considerations for artificial intelligence agents (NIST-2025-0035). The response examines security risks associated with AI agents that are capable of initiating operational actions within enterprise systems and critical infrastructure environments. While much current research focuses on model-layer safety concerns such as prompt injection, adversarial inputs, and hallucination, this submission emphasizes risks that arise at the execution layer of AI-enabled systems, where probabilistic reasoning outputs may trigger operational actions. The document proposes an architectural approach for securing AI-enabled automation by separating probabilistic reasoning systems from deterministic execution authority. The approach combines a multi-domain governance architecture referred to as the Practitioner’s Blueprint for Secure AI (PBSAI) with a deterministic execution mediation layer described as the AI Governance Control Plane (AGCP). Within this model, AI agents generate proposed actions that must pass through deterministic governance evaluation before operational execution is authorized. The response discusses governance mechanisms including structured decision artifacts, evidence-centric governance, cross-domain policy validation, and deterministic authorization controls. It also outlines potential evaluation approaches that may assist standards bodies and practitioners in assessing governance architectures for AI agent ecosystems. The submission is intended to contribute architectural perspectives and practical considerations that may inform future guidance related to the secure deployment of AI agents in enterprise and critical infrastructure environments. This document represents a public technical submission to the NIST RFI and is provided here for archival and reference purposes.