Ship AI agents that pass security review.
An engineering playbook plus a six-file toolkit: a fail-closed authorization map, a human-approval gate contract, an ephemeral sandbox profile, a state-graph template, a tamper-evident trajectory schema, and a deployment-gate checklist. Adapt them to your stack instead of deriving them from blog posts.
enterprise-ai-agent-blueprint/ ├─ 00-enterprise-ai-agent-blueprint.md the master playbook ├─ LICENSE-TERMS.md license + refund terms └─ toolkit/ ├─ authorization_map.yaml tool → autonomy → gate ├─ hitl_gate.yaml async human-approval contract ├─ sandbox.yaml ephemeral container, per-tool egress ├─ state_graph.yaml states, transitions, durable store ├─ trajectory.schema.json tamper-evident audit log └─ deployment-checklist.md production sign-off
Agents don't fail in demos. They fail in review.
Security and architecture reviewers ask the same three questions of every agent. Most agents can't answer any of them.
"What stops it from calling the wrong tool?"
A system prompt is not a control. Without consequence classification, one prompt injection is all that separates a read-only lookup from a production write or a payment.
authorization_map.yaml"Where does the code it runs actually run?"
Shell and code tools that share your process share your network, filesystem, and credentials. You cannot allowlist egress after the fact.
sandbox.yaml"Can you replay what it did?"
Print statements are not an audit trail. When a run goes wrong you need the full trajectory to inspect, and a checkpoint to resume from rather than a restart.
trajectory.schema.json · state_graph.yamlOne playbook and six configs you can drop into a repo.
Every item is a concrete artifact: a document or a config file. No video course, no slide deck.
The Master Playbook
The three failure modes, the reference architecture, the four non-negotiables, the consequence-classifier decision table, the human-in-the-loop gate contract, and the deployment gate checklist — the spine every config file hangs off.
Authorization Map + Gate Contract
Maps every tool to a consequence class, an autonomy level, and a gate policy. Unlisted tools fail closed to mandatory_approval — require_explicit_registration: true. Paired with hitl_gate.yaml: the async approve / reject / modify contract, never auto-approve on timeout.
Ephemeral Sandbox Profile
A minimal base image, network default none with a per-tool egress allowlist, CPU / memory / wall-clock / output caps on every run, read-only rootfs with no host mounts, read-only secret injection redacted from logs, and a container that is destroyed on return.
Resumable State Graph
Explicit states, transitions, and a fallback policy (max_retries_per_state, on_unexpected_state, per-state timeout), with a durable store — Postgres, or SQLite/file for single-node — so a crash resumes from the trajectory instead of restarting. State names line up with the trajectory schema's enum.
Trajectory Audit Schema
One event envelope per step — model prompt preview, tool input hash, exit code, consequence class, autonomy, gate decision, gate status, approver id — with a prev_event hash field for a tamper-evident chain. Enums match the authorization map and state graph.
Deployment Gate Checklist
24 checkboxes across sandboxing, authorization, the human gate, observability, resilience, and pre-launch testing — including a blocked "disaster run" — ending in a security, compliance, and engineering sign-off.
A real excerpt, not a screenshot.
The playbook's table of contents, and an excerpt from the authorization map.
- 0The thesis
- 1The three failure modes: the demo-vs-production cliff, the spaghetti loop, the missing gate
- 2The reference architecture and its four layers
- 3The four non-negotiables: sandboxing, authorization boundaries, trajectory observability, auditability & rollback
- 4The consequence-classifier decision table
- 5The human-in-the-loop gate contract
- 6The observability contract (schema)
- 7The deployment gate checklist
- 8Conclusion and the offer
# Authorization Map — Consequence Classifier # Version this file. It is the single source of truth # for agent autonomy. Every change goes through code # review BEFORE it reaches production. tools: - name: knowledge_base_query consequence: read_only autonomy: full gate: none - name: stage_env_deploy consequence: stage_mutation autonomy: conditional gate: reviewer - name: prod_env_deploy consequence: prod_mutation autonomy: none gate: mandatory_approval - name: billing_charge consequence: billing autonomy: none gate: mandatory_approval # Default policy for tools NOT listed above. default_autonomy: none default_gate: mandatory_approval require_explicit_registration: true
Is this for you?
Buy it if
- You're putting an LLM agent with tools into a company system, internal or customer-facing.
- You need to get it through a security, architecture, or compliance review, and you'd like to do that once.
- You'd rather adapt working configs than reconstruct them from scattered posts and framework docs.
- You work in LangGraph, LlamaIndex, CrewAI, AutoGen, or your own loop in Python, TypeScript, or Go.
Skip it if
- Your agent is a chat interface with no tools and no side effects.
- You want a no-code builder or a hosted platform. This is files and documentation.
- You're looking for a video course or a step-by-step tutorial for one specific framework.
- You want someone to build it with you. That's the Sprint tier below, not the Blueprint alone.
Written by someone who has to pass these reviews too.
Two ways to get it.
One-time payments. Instant download. Both include an internal commercial license for your engineering team.
Blueprint
All six files. You adapt them to your stack.
- The master playbook (Markdown)
- Authorization map, gate contract, sandbox profile, state graph, trajectory schema
- The 24-point deployment gate checklist
- Internal commercial license for your engineering org
- Every future version, free
Blueprint + Sprint
All six files, plus a 90-minute working session on your architecture with me.
- Everything in Blueprint
- 90-minute 1:1 architecture session
- Your tool inventory classified into the authorization map, together
- Sandbox and egress review of your actual stack
- Recording plus a written summary of decisions
- 30 days of email follow-up
If the files aren't what this page says they are, reply to your receipt within 14 days and you get a full refund. Full terms in the refund policy.
Take the checklist. It's free.
The Deployment Gate Checklist — 24 points ending in a security, compliance, and engineering sign-off — is the last file in the toolkit, and the one your reviewer will actually use. Get it now, decide about the rest later.