The cost of producing code, tests, designs, and documentation is falling rapidly, while the cost of deciding whether that work is dependable enough to accept remains stubbornly high.
The Agentic Engineering Assurance Layer is the missing Assurance Plane between delegated intent and accountable engineering decisions.
Ten minimum obligations form a conformance entrance exam — each stated as a testable requirement and paired with a counterexample that would falsify conformance.
Producing agents can contribute work and evidence. They cannot confer acceptance on their own output.
The Agentic Engineering Assurance Layer is the Assurance Plane that governs how agentic engineering work is performed and evidenced, so that humans can trust and accept the resulting work. It sits above producing agents, alongside gateways and execution controls, and below retained human decision rights. It is in the decision path because work cannot enter a governed state without satisfying its rules or an explicit exception. It is out of the token path because it does not need to proxy every prompt, completion, or model call.
Declare. A human or authorized system establishes the intent, intended use, scope, owner, boundaries, and desired outcome.
Classify. The layer evaluates consequence and maps the work to applicable obligations, evidence depth, independence requirements, and decision authority.
Decompose. The work is divided into bounded units. Child units inherit relevant obligations, and their outputs remain traceable to the parent intent.
Produce. One or more agents and tools create artifacts under bounded identity, authority, and execution policy.
Evidence. Tests, reviews, scans, analyses, provenance, runtime observations, and human findings are captured as signed or otherwise attributable evidence tied to exact subjects and contexts.
Argue and evaluate. The layer assembles the assurance case, identifies missing or conflicting evidence, invokes specialist checks, and evaluates gate policy.
Decide and maintain. An authorized decision is recorded. Conditions and expiry are monitored. Material changes or new evidence trigger re-evaluation or revocation.
An agent upgrades an authentication dependency after a vulnerability disclosure. A successful build and a favorable review can still leave important questions unanswered: Did authorization semantics change? Did the test environment match production? Who is authorized to accept the residual risk of an authentication change? Under the proposed layer, the Assurance Work Package states the intent, authentication is classified as high impact, the coding agent's outputs enter the case as producer evidence, a separate test runner verifies the exact commit, a specialist security agent reviews privilege boundaries, the build platform issues provenance — and the gate cannot pass until the required claims are supported or an authorized exception records the unresolved risk, scope, and expiry.
O1. Bind delegation to explicit intent, scope, and intended use.
O2. Establish actor identity, delegated authority, and separation of roles.
O3. Classify consequence and establish obligations before execution.
O4. Maintain bidirectional traceability and validate continued alignment with intent.
O5. Generate and capture evidence at the point of work.
O6. Protect evidence integrity and make independence explicit.
O7. Construct a structured assurance case, including doubts and residual risk.
O8. Enforce gate policy with explicit acceptance semantics and named authority.
O9. Maintain freshness, change impact, and revocation.
O10. Preserve an append-only, reproducible, and transferable decision record.
Conformance does not mean that every Assurance Work Package receives the same ceremony. The obligations remain constant; their implementation strength varies with consequence.
Low — Formatting, comments, internal prototypes, reversible sandbox changes: Explicit delegation; automated tests; provenance; policy-owned automated acceptance; short validity window.
Significant — Business logic, shared APIs, data migrations, customer-facing configuration: Independent test execution; traceability to requirements; code-owner or product-owner authority; conditional deployment where appropriate.
High — Authentication, payments, sensitive data, safety functions, regulated evidence, critical infrastructure: Multiple independent evidence sources; explicit assurance case; specialist review; named human authority; restricted exceptions; continuous freshness and revocation.
The paper names eight disqualifying anti-patterns: the self-reviewing producer, the checklist bolted onto a coding agent, governance as logging, the permission perimeter mistaken for assurance, confidence theater, assurance as a snapshot, compliance documentation produced after the fact, and human-in-the-loop theater.