AI agent architecture diagram with operating responsibilities

Filled diagram assumptions

Illustrative worked example. Names, volumes, dates, and outcomes are fictional; replace them with approved evidence before use.

Sources: NIST AI Risk Management Framework · Supabase: securing data

Separate planning from execution

Show the user request, policy and identity check, planner, tool registry, approval gate, tool execution, durable state, and audit record as distinct units. A tool call should carry the scoped identity and an explicit permitted action; it should not inherit broad access simply because a user started a chat.

NIST’s AI RMF is a useful primary reference for risk governance. Apply it by making ownership, monitoring, and response paths visible rather than by adding an unsupported compliance label to the diagram.

Sources: NIST AI Risk Management Framework

Illustrative reference architecture

Illustrative worked example. Names, volumes, dates, and outcomes are fictional; replace them with approved evidence before use.

A procurement analyst asks the agent to assemble a comparison packet. The agent may search approved product sources and prepare a draft. Before it writes to a customer workspace or sends anything, an approval gate checks the user’s authority and the target scope. The tool executor records the input, source references, operation result, and any failure. A failed authorization returns a reviewable denial; it does not retry under a broader credential.

Sources: NIST AI Risk Management Framework · Supabase: securing data

Operating-responsibility table

Sources: NIST AI Risk Management Framework · Supabase: securing data