For platform teams and regulated organizations — multi-tenant, governance, compliance, audit
When you swap GPT-4 for Claude or for a local Llama, your traceability has to survive. The shape of a model-agnostic trace, prompt-as-data, response-as-data, decision-as-data, model-as-attribution-only, and what happens to teams that couple their traces to a specific vendor's API.
The aspirational state for the compliance-aware-design series: compliance isn't something the platform team does, it's a property the platform has. Audit emerges as a side effect of the work, not a parallel job. The architectural choices that make it possible.
The autonomy ladder isn't a per-agent property. It's a per-product, per-context, per-tenant property. The same agent can be Tier 4 in one place and Tier 1 in another at the same time. Here's how to build a platform that hosts the same agent at multiple autonomy levels at once.
When the action behind a decision is 'ask an LLM,' the decision surface is what protects you from model drift. The five questions, the bounded scope, the audit trail, the ownership boundary, they all still apply. The DaC surface becomes the contract that makes AI agents safe to swap and govern.
RLS is a hugely useful pattern, and a trap when used as the only isolation layer, deployed without observability, or asked to compensate for tenant-blind app code. When RLS works, auxiliary, observable, well-tested, and when it doesn't.
Audit and version control share primitives, content-addressed history, signed authorship, parent pointers, the diff abstraction. What an audit system inspired by Git actually looks like, and why it's 10x more useful than the spreadsheet-shaped trail most teams ship.
Bolted-on compliance is a parallel system, separate audit pipeline, retention store, access reviews. Bolted-in compliance is a platform property: the same code path that does the work emits the audit, enforces retention, respects access. How to tell which you have, and the migration arc.
Promotions up the autonomy ladder get all the attention. The pattern that almost nobody designs for is the downgrade, the runtime move that drops an agent back to a tighter rung when something looks off. Without a real downgrade path, every promotion is a one-way bet.
You don't need a quarter to find the decisions buried inside a process, you need a week. Five days, five outputs, one working DaC surface at the end. Day-by-day agenda, the outputs, and the failure modes I've watched each day produce.
Most multi-tenant platforms over-build defense in depth. Network, namespace, RLS, tenant-id, per-tenant keys, the catalog feels safer than it is. The disciplined answer is fewer layers than instinct says, sized to the threat model, with the seams labeled.
If you design traceability for compliance, you almost never get the debugging case. If you design for debugging, the 3am 'where did this payment go' case, the audit trail falls out for free. The reframe, what each shape of trace looks like, and why one is strictly more powerful than the other.
When data leaves a regulated universe for an analytics one, what crosses isn't the data, it's a downgraded version of it. Plain downgrade rules, enforcement, audit trail, and a human approval step for first-of-pattern transfers.
