Five layers, with a security control at each one
An AI agent in production is not one component but a chain: a message comes in, a model reads it, documents are retrieved, a tool may be called, and the whole thing has to be run and watched. Each link in the chain is a place where something can go wrong, so each one needs its own control. This is how the five layers of a NoorAI deployment are laid out, and what guards each of them.
Inside your environment
One identity carried through all five layers: your identity provider, through SAML or OIDC
Layer 1: Ingress
Requests arrive from WhatsApp, the web, email or voice. Before any of them reaches a model, the user is identified through your enterprise identity provider, SAML or OIDC. There are no anonymous sessions and no separate user directory to keep in sync. Who asked is known from the first byte, and that identity travels with the request through every later layer.
Layer 2: Model
Orchestra is served on your hardware, air-gapped when you need it. In front of it sits a safety classifier with policy rules your team can read, change and audit. A rule that cannot be inspected is not a control, so there are no hidden filters.
Layer 3: Retrieval
Answers are grounded in your documents through hybrid search over an index that respects access rights. A user only receives content from documents they are allowed to open, and every answer cites its sources, so a reviewer can check the claim against the page it came from.
Layer 4: Action
When an agent needs to do something rather than say something, look up a customer, open a ticket, it does so through the Model Context Protocol. Sensitive actions, a refund, a change to a record, are routed to a human for review before they run. The agent prepares; a person decides.
Layer 5: Operations
The whole stack runs on Kubernetes and Terraform on your infrastructure. Every component is versioned, regression tests run before a change ships, every request is traced end to end, and audit logs are immutable. If a regulator asks what happened on a given Tuesday at 09:14, the answer is a record, not a reconstruction.
Why five, not one
A single gateway in front of a model catches some problems and misses most. The dangerous failures happen between layers: a well-formed request from a verified user that retrieves a document they should not see, or a correct answer that triggers a tool call nobody reviewed. Controls at each layer, with the same identity carried through all of them, are what make an agent safe enough for a bank or a ministry.