Agentic AI Reference Architecture

Safety & Security · Software component

Authorization Policy Decision Point

Software componentSafety & SecuritySafety, Security & Governancearc:AuthorizationPolicyDecisionPoint

A policy engine that evaluates fine-grained authorization rules for API requests and returns allow/deny decisions, separating policy decisions from gateway enforcement.

Responsibility. Decides whether a principal's request is authorized under declared policy.

Also known as: Policy engine, PDP, Knowledge base authorization, Role-based access control (RBAC), ABAC policy engine, Context-aware dynamic access control engine, Role-based clinician data access, Role-based access control, Compliance agent (handoff data-access verification)

routes to; controls access tocontrols access tocontrols access tocontrols access tois invoked bycontrols access tocontrols access tocontrols access tois invoked byis invoked bycontrols access tocontrols access tois audited byreadsis configured byis configured byreadsis configured byApproval Gateway: routes to; controls access toApproval GatewayLLM Inference Service: controls access toLLM Inference ServiceVector Index Store: controls access toVector Index StoreExternal Service API: controls access toExternal Service APIEscalation Handler: is invoked byEscalation HandlerStage Promotion Controller: controls access toStage Promotion ControllerPersonal Data Store: controls access toPersonal Data StoreDatabase Connector: controls access toDatabase ConnectorExecution Rail: is invoked byExecution RailPolicy Plugin Gateway: is invoked byPolicy Plugin GatewayAgent Service API: controls access toAgent Service APIModel and Agent Release Registry: controls access toModel and Agent Release …External Auditor: is audited byExternal AuditorLeast-Privilege Permission Set: readsLeast-Privilege Permissi…Data Classification Policy: is configured byData Classification PolicySeparation of Duties Policy: is configured bySeparation of Duties Pol…Time-Bound Permission Grant: readsTime-Bound Permission Gr…Attribute-Based Access Policy: is configured byAttribute-Based Access P…
Direct neighbourhood (hover for relationship types)

Relationships

is configured by structural

is invoked by dependency

reads dependency

routes to dynamic

controls access to control

is audited by assurance

Design guidance

Quantitative guidance

As stated by the sources; verify before use.

Classification

Patterns
Policy-as-codeDecision/enforcement separationAttribute-Based Access Control (ABAC)Role-Based Access Control (RBAC)OAuth 2.0 scope-based access controlPrinciple of least privilegeRuntime governanceRBACLeast privilegeCare-team-based accessThreshold-gated progressive disclosure
Technologies
Open Policy Agent
Quality attributes
Security (ISO/IEC 25010 | NIST AI RMF: secure and resilient)Maintainability (ISO/IEC 25010)Flexibility (ISO/IEC 25010)
Risks mitigated
Unauthorized access to agent servicesExcessive privilegesPermission abuseUnauthorized data access
Frameworks & regulations
GDPR Art. 32ISO 27001NIST AI RMF: MANAGE

Sources

  1. Ch4.1: T. Nguyen, "Introduction to AI Agent Deployment and Scaling," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 4.1. ISBN: 9798244538229.
  2. Ch6.5: T. Nguyen, "Production RAG Systems," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 6.5. ISBN: 9798244538229.
  3. Ch7.1B: T. Nguyen, "Nvidia NIM and Colang," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 7.1B. ISBN: 9798244538229.
  4. Ch9.2: T. Nguyen, "Action Constraints and Permission Models," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.2. ISBN: 9798244538229.
  5. Ch9.5: T. Nguyen, "Constitutional AI," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.5. ISBN: 9798244538229.
  6. Ch9.7: T. Nguyen, "GDPR and Data Protection Regulations," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.7. ISBN: 9798244538229.
  7. Ch9.8: T. Nguyen, "Standards and Frameworks for AI Governance," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.8. ISBN: 9798244538229.
  8. Ch10.4: T. Nguyen, "Human-in-the-Loop," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 10.4. ISBN: 9798244538229.
  9. Ch10.5: T. Nguyen, "Human-over-the-Loop," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 10.5. ISBN: 9798244538229.
  10. Ref7.04: NVIDIA, "NVIDIA NIM," NVIDIA Docs. Accessed: Sep. 27, 2026. [Online]. Available: https://docs.nvidia.com/nim/
  11. Ref7.17: "Scaling Agentic AI Systems: Patterns and Strategies," unpublished reference note (17-Scalability-Patterns.md), Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam supplementary materials, 2026. unpublished note
  12. Ref9.01: "AI Safety Frameworks for Agent Systems," unpublished reference note (01-AI-Safety-Frameworks.md), Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam supplementary materials, 2026. unpublished note
  13. Ref9.05: "Privacy and Data Protection for AI Systems," unpublished reference note (references/Chapter 9 - Safety, Ethics, and Compliance/05-Privacy-Data-Protection.md), Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam supplementary materials, 2026. unpublished note