Agents will query your systems, act on behalf of customers, and execute without a human in the loop. Being ready is five layers of capability, built in order — on a platform that already enforces what the rest of the industry is scrambling to bolt on. This is the map. Three pages go deeper.
Each layer enables the next, and all of them wrap a core that never changes. Discovery without comprehension is a door to an empty room; action without governance is a liability. The sequence is the discipline.
An agent is only as safe as the system it acts on. The properties agent-safety demands aren't add-ons here — they were architectural decisions, made below the application, decades ago.
Object-level security answers who is this user. The agentic question is one layer up: who is this agent, acting for whom, and where does it have to stop? The core enforces integrity at the write — that's inherited. What's new is the agent itself and the layer that connects it: a fresh ingress, credentials in motion, and the decisions that can't be unwound. An agent proposes; a human commits — and on the actions that matter, the gate holds before the write lands.
The property that lets an agent act safely — a platform that can tell you what a change touches before it lands — is the same one that decides whether you can patch at all. In the human era, patching slowly was prudent; the exploit window was wide. That window has since gone negative — the average flaw is now weaponized before a fix ships — while remediation stretches past 250 days, because a system that can't tell you what a change will break is a system you're right to be afraid to touch. Object-level security, journaling, and commitment control make the core legible enough to change — which is why remediation is the first, most measurable payoff of the same work that makes the platform agent-ready. The argument in full: The Remediation Gap.
The intelligence was always there — the platform just had no presence an agent could navigate. In 2026, two tools closed that distance: one makes the source legible, the other makes it callable.
The platform is unusually ready and the field is unusually unprepared. The layers are known, the foundation is built, and the sequencing under governance is the work Pegasus4i does.
The five layers describe how an agent reaches and acts on your core. But a platform doesn't become agent-ready in isolation — an agent's presence touches the network it arrives through, the security surface it opens, and the load it wasn't built for. The Blueprint accounts for all of it: reachability, the new security boundary, performance under agentic patterns. It names the full scope of what has to be true — so nothing that would stall a pilot goes unseen.
The stack above is the theory. Here is the machine — the same architecture behind the live IBM i pilot. Light, interchangeable agents run outside, on untrusted Linux. The system of record stays inside, on IBM i, unchanged. Between them is one governed crossing. Agents reach in through it; they never live inside it.
The stack above is the theory. Here is the machine — the same architecture behind the live IBM i pilot. Light, interchangeable agents run outside, on untrusted Linux. The system of record stays inside, on IBM i, unchanged. Between them is one governed crossing. Agents reach in through it; they never live inside it.
Where the agents run. An interface the human sees, over an orchestration layer that walks the workflow one step at a time, over a tool surface that exposes the callable API. All of it disposable and swappable — nothing here is the system of record.
The record of truth. Db2 holds the data. RPG and SQL procedures hold the business logic — decades of it. Object security holds the line, as it has since 1988. The audit journal records every write. None of it was rewritten to make the agent work.
One door, checked on every crossing. Each agent carries its own IBM i user profile — the wrong authority bounces off the wall, not because the app refused it but because the platform did. Read-and-evaluate calls cross freely under that profile. State-changing calls — the approve, the decline, the money moving — stop at a human-in-the-loop gate and wait to be released. The crossing is the same place the security is: there is no second, ungoverned path in.
The crossing above governs the data. It says nothing yet about the reasoning. When an agent reaches in, something has to think over what it reads — and that inference has to run somewhere. "On-prem versus cloud" is the wrong way to ask it. The real question is the same one the seam already answers for data: where is the trust boundary drawn? Inference has a placement, and the placement is a spectrum — five stations, from silicon inside the box to a public API an ocean away.
Read left to right, the perimeter loosens by degrees. On the left, the model runs on the same silicon as the record — Power11's on-chip matrix-math engine, inside PowerVM, inside the i. Nothing leaves. On the right, the request leaves your walls entirely and reasons on hardware you'll never see. In between are three intermediate stations, each trading a little sovereignty for a little more capability. None is correct in the abstract. The right station is the one where the data class and the perimeter you owe your regulator line up.
On-chip · Power11 MMA. Inference on the same core as Db2 and the RPG. The record never moves.
The data can't leave the box — the decision itself is sovereign, and latency to the record must be near-zero.
On-box accelerator · Spyre. Dedicated inference silicon in the same frame, still inside the i's trust domain.
You need real model throughput but won't surrender the perimeter — larger models, same walls.
Own / colo GPU. Your hardware on your network, one hop from the i.
The workload outgrows on-box silicon but the data still can't touch a shared tenant.
PowerVS + watsonx · Satellite. IBM's managed floor, pulled inside your control plane.
You want frontier capability and governed operations without owning the GPUs — and the perimeter can stretch to cover it.
Public API. Someone else's model, someone else's GPU, reached by egress.
The data was never sovereign to begin with — public content, non-regulated reasoning, or a step already outside the wall.
Anonymization is the arrow that moves a request left. Strip the request of what makes it sovereign — the identifiers, the account, the obligation — and a station that was closed to it opens up. That's the lever, not the platform. And it means the placement isn't fixed: the same workflow can run at different stations for different steps, each request landing where its data class and your perimeter agree it should.
Agent-ready in sequence is only half the method. The other half is where you start. You don't rebuild the platform and hope agents fit. You stand at the agentic end-state, draw the map backward to where you are today, then build it forward — one step at a time, starting with a twin, not a rebuild. The twin runs the reimagined workflow alongside the real one, changing nothing, until it has earned the right to.
It watches before it acts. The twin sees the same live inputs as the human process and produces its own answer — but the human's answer is the one that ships. Nothing it decides changes state. It learns from historical replay, from side-by-side comparison, and from every case a human overrides.
A falling override rate. If humans keep correcting the twin, it isn't ready — and you can see exactly that, in the numbers, before anything is at risk. The override rate falling toward zero is the evidence that the twin has closed the distance. Only then does it earn a crossing.
Governance is designed in before any agent acts, and never switches off. The authority matrix is written first — a decision on paper, not code. The seam and object authority go live, so the boundary is enforced by the platform, not hoped for. Then oversight is staged: alert-only, then escalation, then a kill-switch — monitoring agents earning authority in stages, never straight to autonomous. That order is the floor the rest of the build stands on.
A CISO does not want a framework you invented. They want to know how this maps to the ones they already answer to. The governance built into the crossing operationalizes three of them — it doesn't replace them. NIST names the risk functions, OWASP names the failure modes, CSA names the control objectives; the enforcement at the seam is the production reality all three describe in the abstract. When the security review asks "how does this handle prompt injection, or excessive agency?" the answer is a mapping, not a shrug.
NIST AI RMF (2023)
The default risk vocabulary for US federal agencies and enterprise risk committees. Its Govern / Measure / Manage functions map to oversight authority, continuous evaluation, and traceable recovery — the same three the crossing enforces.
OWASP Top 10 for LLM Apps
Names the failure modes the governance catches directly: prompt injection, sensitive-information disclosure, insecure output handling, and excessive agency. This is the bridge when the security team asks the pointed question.
CSA AI Controls Matrix (243 control objectives across 18 domains, 2025)
The controls superset auditors map straight to ISO 27001, SOC 2, and HIPAA inventories. The enforcement at the seam implements the relevant AICM objectives rather than restating them — evidence an auditor can trace, not a claim they have to take on faith.
The pillars operationalize; they do not replace. Trusted evals catch drift. Correlation-ID logs make every decision recoverable from the audit trail alone. Granular rollback reverts a single agent without taking the stack down. A human-review queue holds anything that touches money, legal text, or a customer of record. Each is the production primitive under a specific set of NIST controls, OWASP failure modes, and CSA objectives — and on IBM i, object security and the audit journal mean the platform already thinks in these terms. If the auditor wants a full NIST self-assessment or an AICM controls audit, that still gets done. This is the layer that makes passing it real.
Three pages, in order. The argument for why the platform is already agentic, the layer-by-layer reference, and the concrete test of what has to be true before an agent can act.
Governance runs through all three axes. Governance on this axis is the enforcement — proving what an agent did, and stopping what it shouldn't, at the write. Judgment and authority live on the other two. See how governance holds across all three →
The platform is one axis of three. A reachable platform still stalls if the organization can't govern at agentic speed and the people can't hold judgment over what the agents do. Readiness is the overlap — Human and Organization. And the overlap has a location: the seam. And the order the work moves in: the journey →
The readiness diagnostic maps your platform to the five layers — a practitioner placement, not a code scan. It takes about five minutes, requires no email, and the profile is yours to keep. If you want to know where your platform sits on the stack, start there.