designing this is the right exercise. what the diagram hides until you build it and try to break it: authority leaves the runtime by pushing, not being pulled. the agent's host should have no inbound port to attack. it reports outward, and signs each report with a key bound at enrollment, so a neighbor process on the same box can't forge its history. the layer that holds authority should also hold the record. refusing the bad action and proving the good one happened, months later, to someone who wasn't in the room, are different jobs. most designs solve the first and forget the second. and the one nobody puts in the diagram: name what your architecture cannot stop. a root process on the agent's own machine can fabricate its own source. you don't defend that with more crypto. you disclose it. an honest boundary beats a pretty one. 6 months in production forces the architecture to adapt or die. the proper solution lies in one direction only.