<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1240 560" role="img"
     aria-label="Architecture diagram. An untrusted model proposes an action that crosses a trust boundary into the execution layer, where five controls are enforced in sequence — scoped identity, tool allowlist, credential isolation, sandboxed execution, and an egress gate — before an allowed call reaches real systems. A sixth control, the audit log, records every stage.">
  <defs>
    <marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
      <path d="M0 0 L10 5 L0 10 z" fill="#002B56"/>
    </marker>
    <marker id="arrowTeal" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
      <path d="M0 0 L10 5 L0 10 z" fill="#1E6969"/>
    </marker>
  </defs>

  <style>
    .t { font-family: 'Helvetica Neue', Arial, sans-serif; fill: #002B56; }
    .d { font-family: 'Helvetica Neue', Arial, sans-serif; fill: rgba(0,43,86,0.6); }
    .m { font-family: 'IBM Plex Mono', ui-monospace, monospace; fill: rgba(0,43,86,0.5); }
    .badge { font-family: 'IBM Plex Mono', ui-monospace, monospace; fill: #F2ECDD; font-size: 13px; font-weight: 600; }
  </style>

  <rect x="0" y="0" width="1240" height="560" fill="#E9E1CE"/>
  <rect x="14" y="14" width="1212" height="532" fill="none" stroke="#002B56" stroke-width="1" opacity="0.28"/>

  <text x="40" y="50" class="m" font-size="12" letter-spacing="2.5">FIG.&#160;1 &#8212; ZERO&#160;TRUST&#160;ENFORCEMENT&#160;PER&#160;AGENT&#160;ACTION</text>
  <line x1="40" y1="64" x2="1200" y2="64" stroke="#002B56" stroke-width="0.75" opacity="0.3"/>

  <!-- Model -->
  <rect x="34" y="252" width="150" height="128" rx="6" fill="#F2ECDD" stroke="#002B56" stroke-width="1.4"/>
  <text x="109" y="308" text-anchor="middle" class="t" font-size="16" font-weight="600">MODEL</text>
  <text x="109" y="328" text-anchor="middle" class="t" font-size="16" font-weight="600">PLANNER</text>
  <text x="109" y="356" text-anchor="middle" class="d" font-size="11">holds no secrets</text>

  <!-- Trust boundary -->
  <line x1="212" y1="150" x2="212" y2="470" stroke="#3C5683" stroke-width="1.4" stroke-dasharray="3 3"/>
  <text x="212" y="140" text-anchor="middle" class="m" font-size="10.5" letter-spacing="2">TRUST&#160;BOUNDARY</text>

  <line x1="184" y1="316" x2="248" y2="316" stroke="#002B56" stroke-width="1.5" marker-end="url(#arrow)"/>
  <text x="216" y="306" text-anchor="middle" class="m" font-size="9.5">REQUEST</text>

  <!-- Execution layer -->
  <rect x="248" y="170" width="792" height="300" rx="8" fill="#EFE7D4" stroke="#002B56" stroke-width="1.6"/>
  <text x="270" y="202" class="t" font-size="14" font-weight="600" letter-spacing="1.5">EXECUTION&#160;LAYER</text>
  <text x="436" y="202" class="d" font-size="12">— the infrastructure, not the model, decides how each action runs</text>
  <line x1="270" y1="216" x2="1018" y2="216" stroke="#002B56" stroke-width="0.6" opacity="0.25"/>

  <!-- 1 -->
  <rect x="266" y="252" width="140" height="128" rx="6" fill="#F2ECDD" stroke="#002B56" stroke-width="1.4"/>
  <circle cx="290" cy="280" r="13" fill="#002B56"/><text x="290" y="285" text-anchor="middle" class="badge">1</text>
  <text x="318" y="274" class="t" font-size="13.5" font-weight="600">SCOPED</text>
  <text x="318" y="291" class="t" font-size="13.5" font-weight="600">IDENTITY</text>
  <text x="336" y="356" text-anchor="middle" class="d" font-size="11">per agent &amp; task</text>
  <!-- 2 -->
  <rect x="420" y="252" width="140" height="128" rx="6" fill="#F2ECDD" stroke="#002B56" stroke-width="1.4"/>
  <circle cx="444" cy="280" r="13" fill="#002B56"/><text x="444" y="285" text-anchor="middle" class="badge">2</text>
  <text x="472" y="274" class="t" font-size="13.5" font-weight="600">TOOL</text>
  <text x="472" y="291" class="t" font-size="13.5" font-weight="600">ALLOWLIST</text>
  <text x="490" y="356" text-anchor="middle" class="d" font-size="11">granted tools only</text>
  <!-- 3 -->
  <rect x="574" y="252" width="140" height="128" rx="6" fill="#F2ECDD" stroke="#002B56" stroke-width="1.4"/>
  <circle cx="598" cy="280" r="13" fill="#002B56"/><text x="598" y="285" text-anchor="middle" class="badge">3</text>
  <text x="626" y="274" class="t" font-size="13.5" font-weight="600">CREDENTIAL</text>
  <text x="626" y="291" class="t" font-size="13.5" font-weight="600">ISOLATION</text>
  <text x="644" y="356" text-anchor="middle" class="d" font-size="11">kept from the model</text>
  <!-- 4 -->
  <rect x="728" y="252" width="140" height="128" rx="6" fill="#F2ECDD" stroke="#002B56" stroke-width="1.4"/>
  <circle cx="752" cy="280" r="13" fill="#002B56"/><text x="752" y="285" text-anchor="middle" class="badge">4</text>
  <text x="780" y="274" class="t" font-size="13.5" font-weight="600">SANDBOXED</text>
  <text x="780" y="291" class="t" font-size="13.5" font-weight="600">EXECUTION</text>
  <text x="798" y="356" text-anchor="middle" class="d" font-size="11">isolated · no net/fs</text>
  <!-- 5 -->
  <rect x="882" y="252" width="140" height="128" rx="6" fill="#F2ECDD" stroke="#002B56" stroke-width="1.4"/>
  <circle cx="906" cy="280" r="13" fill="#002B56"/><text x="906" y="285" text-anchor="middle" class="badge">5</text>
  <text x="934" y="274" class="t" font-size="13.5" font-weight="600">EGRESS</text>
  <text x="934" y="291" class="t" font-size="13.5" font-weight="600">GATE</text>
  <text x="952" y="356" text-anchor="middle" class="d" font-size="11">outbound by host</text>

  <!-- chevrons -->
  <g stroke="#002B56" stroke-width="1.6" fill="none" stroke-linecap="round" stroke-linejoin="round">
    <path d="M409 310 l7 6 l-7 6"/><path d="M563 310 l7 6 l-7 6"/>
    <path d="M717 310 l7 6 l-7 6"/><path d="M871 310 l7 6 l-7 6"/>
  </g>

  <!-- allowed call out -->
  <line x1="1022" y1="316" x2="1086" y2="316" stroke="#1E6969" stroke-width="1.8" marker-end="url(#arrowTeal)"/>
  <text x="1054" y="306" text-anchor="middle" class="m" font-size="9.5" fill="#1E6969">ALLOWED</text>

  <!-- Systems -->
  <rect x="1088" y="252" width="112" height="128" rx="6" fill="#F2ECDD" stroke="#002B56" stroke-width="1.4"/>
  <text x="1144" y="304" text-anchor="middle" class="t" font-size="13" font-weight="600">SYSTEMS</text>
  <text x="1144" y="321" text-anchor="middle" class="t" font-size="13" font-weight="600">&amp; HOSTS</text>
  <text x="1144" y="352" text-anchor="middle" class="d" font-size="11">CRM · APIs · hosts</text>

  <!-- taps to audit -->
  <g stroke="#002B56" stroke-width="1" opacity="0.35" stroke-dasharray="2 4">
    <line x1="336" y1="380" x2="336" y2="500"/><line x1="644" y1="380" x2="644" y2="500"/>
    <line x1="952" y1="380" x2="952" y2="500"/><line x1="1144" y1="380" x2="1144" y2="500"/>
  </g>

  <!-- Audit log -->
  <rect x="34" y="500" width="1166" height="58" rx="6" fill="#F2ECDD" stroke="#002B56" stroke-width="1.5"/>
  <circle cx="70" cy="529" r="14" fill="#002B56"/><text x="70" y="534" text-anchor="middle" class="badge" font-size="14">6</text>
  <text x="98" y="524" class="t" font-size="14" font-weight="600" letter-spacing="0.5">AUDIT LOG</text>
  <text x="98" y="544" class="d" font-size="12">every action recorded — readable, replayable, exportable</text>
  <text x="1184" y="529" text-anchor="end" class="m" font-size="10" letter-spacing="1.5" fill="#1E6969">APPEND-ONLY</text>
</svg>
