Skip to content
EcoSec WorX
$5K Challenge

Reference architecture

Agentic Intelligence Fabric

Any Cloud. Any Model. Any Agent Framework. Any Console. One Agentic Intelligence Fabric.

A clean-sheet EcoSec WorX reference architecture that connects operational context, enterprise knowledge, coordinated agents, governed tools, decision intelligence and trust controls to your systems. It is a set of reusable patterns and software building blocks, implemented specifically for each customer, not a monolithic product.

Take the $5K ChallengeExplore the Components
Any console · chat · Slack · Teams · web · API

  1. Interaction

    • Theo

  2. Agent Fabric

    • Orchestrator Agent
    • Capability Agents

  3. Context & Knowledge

    • Context Resolver
    • Operational Context Model
    • Operational Knowledge Fabric

  4. Decision & Action

    • Decision Intelligence Layer
    • Action Playbooks

  5. Integration

    • Integration Fabric
    • Operational Event Stream

Trust Ledger · identity · policy · audit

Customer systems (authoritative)
Runtime Adapter
Deployment Adapter
Layered reference architecture. Consoles connect to Theo, the interaction layer. Beneath it are the Agent Fabric, Context and Knowledge, Decision and Action, and Integration layers, which connect to authoritative customer systems. A Trust Ledger for identity, policy and audit runs alongside every layer. Runtime and Deployment Adapters keep models, frameworks and clouds replaceable.

Conceptual components

What each part of the Fabric does.

Components are described as reference capabilities. Which ones a customer needs, and how they are built, is decided during the engagement.

Interaction

  • Theo

    The agentic orchestration and interaction layer within AIF. Theo is not the whole platform; it is how people and consoles talk to it.

Agent Fabric

  • Orchestrator Agent

    Plans the work, delegates to capability agents and assembles the result within policy.

  • Capability Agents

    Narrow, scoped agents with their own identities and tool allowlists, each doing one job well.

Context & Knowledge

  • Context Resolver

    Assembles bounded, relevant, authorized context for each request instead of flooding agents with raw data.

  • Operational Context Model

    A structured model of the environment: entities, relationships, state and ownership.

  • Operational Knowledge Fabric

    SOPs, documents and institutional knowledge, grounded and retrievable behind access boundaries.

Decision & Action

  • Decision Intelligence Layer

    Turns context into prioritized recommendations, with reasoning a human can review.

  • Action Playbooks

    Pre-defined, governed actions with risk classification, approvals, verification and rollback.

Integration

  • Integration Fabric

    Secure connectors to customer systems through APIs, files and existing integration mechanisms.

  • Operational Event Stream

    Filters and summarizes high-volume telemetry into meaningful events before it reaches reasoning.

Cross-cutting

  • Trust Ledger

    An auditable record of who asked, what context was used, which agent acted, what was approved and what changed.

  • Runtime Adapter

    Keeps models and agent frameworks replaceable behind a stable boundary.

  • Deployment Adapter

    Targets AWS, Azure, Google Cloud or private and hybrid environments.

Architectural philosophy

Trust is designed in, in order.

The Fabric enforces identity and authorization before an agent reasons, retrieves or acts. Your systems stay the source of truth.

  1. 1Authenticate before reasoning
  2. 2Authorize before retrieval
  3. 3Authorize before action
  4. 4Raw high-volume telemetry does not flow directly into agent reasoning
  5. 5Agents receive bounded, relevant context
  6. 6Actions are governed
  7. 7Customer systems remain authoritative
  8. 8Autonomy increases gradually
  9. 9Human policy determines where automation stops
  10. 10Cloud, model and runtime components stay replaceable where possible

Gradual autonomy

Start read-only. Your policy decides where automation stops.

  1. Read-only

    Answer questions from grounded knowledge and context.

  2. Recommend

    Propose actions with reasoning for a human to review.

  3. Approve

    Execute governed playbooks after explicit human approval.

  4. Act under policy

    Act autonomously only where your policy allows it.

Security by design

Security is not an Octopus arm. It surrounds every arm.

Every Factory engagement considers these concerns from the start.

  • Identity
  • Authentication
  • Authorization
  • Tenant / data isolation
  • Least privilege
  • Scoped agent identities
  • Tool allowlists
  • Secrets management
  • Retrieval boundaries
  • Prompt injection
  • Poisoned knowledge
  • Excessive agency
  • Human approval
  • Risk classification
  • Rollback
  • Verification
  • Auditability
  • Change management
  • Trust Ledger concepts

These are design considerations, not compliance certifications.

See what the Fabric looks like for your problem.

The $5K / 50-Day Challenge applies the Fabric to one well-defined business problem and ends with a decision-ready roadmap.

Take the $5K Challenge