--- title: "AI Security Framework Enterprise: 6-Plane Architecture" description: AI Security Framework Enterprise with 6-plane architecture for robust protection. Comprehensive security strategies for enterprise AI systems. image: https://rqlamurdcjeeoogoiurt.supabase.co/storage/v1/object/public/article-images/covers/ai-security-framework-enterprise-6-plane-archite-mv0iw2og.jpg --- [Skip to content](https://blog.odingard.com/ai-security-framework-enterprise-6-plane-architecture#main-content) Odingard Security Get started Get started ![](https://rqlamurdcjeeoogoiurt.supabase.co/storage/v1/object/public/article-images/covers/ai-security-framework-enterprise-6-plane-archite-mv0iw2og.jpg) # AI Security Framework Enterprise: 6-Plane Architecture ![Andre Byrd](https://7528315.fs1.hubspotusercontent-na1.net/hub/7528315/hubfs/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/avatar-placeholder.jpg?width=48&height=48&name=avatar-placeholder.jpg) Andre Byrd January 1, 1970 Traditional security controls were designed for predictable workloads and human-operated systems. AI systems break those assumptions. Models make non-deterministic decisions, agents act autonomously across multiple tools, and the attack surface spans training data, inference endpoints, and every API call in between. When 92% of organizations that experienced an AI-related security incident were missing basic access controls on those systems, the gap between legacy security and AI reality becomes clear. Enterprise AI security demands a dedicated framework because scale changes which controls actually work. A startup running three models can manually review every prompt. An enterprise deploying hundreds of agents across regulated operations cannot. Shared ownership complicates accountability: data scientists build models, platform teams deploy them, business units consume them, and security teams inherit the risk. Without a structured framework, no single team owns the full lifecycle, and gaps emerge at every handoff. Regulatory exposure amplifies the stakes. The EU AI Act classifies systems by risk and imposes binding obligations on high-risk applications. [AI compliance](https://www.odingard.com/ai-compliance) requirements now span NIST AI RMF 1.0, ISO/IEC 42001:2023, and sector-specific mandates in finance and healthcare. Voluntary frameworks are treated as de facto mandatory by U.S. federal agencies and their contractors. Enterprises operating across jurisdictions must assemble a compliance architecture that satisfies multiple overlapping regimes. Legacy integration presents another forcing function. AI systems do not replace existing infrastructure; they extend it. Models query databases, agents call internal APIs, and inference pipelines touch the same networks that serve traditional applications. A dedicated ai security framework enterprise must bridge AI-specific threats like prompt injection and model poisoning with conventional controls for network segmentation, identity management, and data loss prevention. Frameworks like [NIST AI RMF](https://medium.com/@kanerika/ai-security-framework-how-enterprises-can-protect-their-ai-systems-00a7d90f7b6f) provide the operational risk process that connects these domains. Non-human identity volume changes the game. Agents are not static service accounts. They spawn dynamically, make context-dependent decisions, and terminate after completing tasks. An enterprise might manage thousands of ephemeral agent identities, each requiring real-time authorization, audit trails, and policy enforcement. Traditional identity and access management systems built for predictable human and workload identities fall short when agents exhibit non-deterministic behavior. ## The Six-Plane Architecture: Building Defensible AI Infrastructure A defensible enterprise AI security infrastructure separates concerns across six distinct planes, each addressing a specific layer of the attack surface. The **data plane** holds sources, pipelines, and vector stores. Every model depends on training data, retrieval-augmented generation systems query knowledge bases, and agents pull context from internal repositories. Security at this layer enforces data governance policies, validates provenance, and prevents unauthorized access to sensitive datasets. Encryption, access logging, and data lineage tracking are foundational controls, but the data plane must also detect poisoning attempts where adversaries inject malicious samples to corrupt model behavior. The **model plane** manages registries, versioning, and provenance. Enterprises deploy dozens or hundreds of models, each with distinct training lineages, performance characteristics, and risk profiles. A model registry provides a single source of truth for what is running in production, who trained it, and which datasets it consumed. Provenance tracking ensures that every model can be traced back to its origin, enabling rapid response when a vulnerability is discovered in a base model or training dataset. The **runtime plane** is where an AI gateway terminates prompts and tool calls. Unlike traditional API gateways that route requests to static endpoints, AI gateways must inspect prompt content, evaluate agent intent, and enforce dynamic policies based on context. Runtime defense mechanisms detect adversarial inputs like jailbreak attempts, monitor for excessive tool usage that might indicate compromised agents, and enforce rate limits to prevent abuse. The **identity plane** covers human and non-human actors. Humans submit prompts, agents execute tasks, and service accounts integrate AI systems with enterprise workflows. Each identity requires authentication, authorization, and audit trails. For agents, identity management must handle dynamic creation, context-aware permissions, and automated credential rotation. The **policy enforcement plane** translates governance requirements into executable rules. Policies define acceptable use, data handling requirements, model approval workflows, and incident response procedures. This plane bridges the gap between high-level compliance mandates and low-level technical controls, ensuring that regulatory obligations like [ISO 42001](https://www.practical-devsecops.com/best-ai-security-frameworks-for-enterprises/) requirements are consistently applied across all six planes. The **observability plane** watches the other five. Continuous monitoring collects telemetry from data pipelines, model inference, runtime execution, identity events, and policy decisions. This plane detects anomalies, tracks performance drift, and provides the audit trails required for compliance reporting. When an agent begins making unusual API calls, the observability plane connects that behavior to identity context, policy violations, and data access patterns to determine whether intervention is required. ## Regulatory Compliance: NIST, ISO 42001, and EU AI Act Integration Global AI governance splits between binding law and voluntary frameworks. The EU AI Act imposes legal obligations on high-risk AI systems, including mandatory conformity assessments, transparency requirements, and human oversight. NIST AI RMF 1.0 provides a four-function operational risk process—Govern, Map, Measure, Manage—that is technically voluntary but increasingly treated as mandatory by U.S. federal agencies. ISO/IEC 42001:2023 introduces the first certifiable AI management system standard, providing auditable proof points for regulators, partners, and insurers across jurisdictions. An ai security framework enterprise must integrate these overlapping regimes into a unified compliance architecture. The EU AI Act classifies systems by risk level, with prohibited practices, high-risk applications, limited-risk systems, and minimal-risk AI each subject to different obligations. High-risk systems require conformity assessments, technical documentation, and post-market monitoring. NIST AI RMF 1.0 complements the EU AI Act by providing a process framework rather than a prescriptive standard. The Govern function establishes organizational accountability, policies, and risk tolerance. Map identifies business context, stakeholders, and potential impacts. Measure evaluates model performance, fairness, and security posture. Manage implements controls, monitors for drift, and responds to incidents. This lifecycle approach aligns naturally with the six-plane architecture, where each function touches multiple planes and requires coordinated enforcement. ISO/IEC 42001:2023 adds a third dimension as the first certifiable standard for AI management systems. Unlike NIST's voluntary guidance or the EU AI Act's legal mandates, ISO 42001 provides a structured management system that organizations can implement and audit against. Certification demonstrates to regulators, customers, and partners that an enterprise has established documented processes for AI governance, risk management, and continuous improvement. Integrating these frameworks requires a compliance mapping exercise that identifies overlapping requirements and gaps. The EU AI Act's transparency obligations align with NIST's Map function and ISO 42001's documentation requirements. High-risk system monitoring under the EU AI Act corresponds to NIST's Measure function and ISO 42001's performance evaluation clause. Continuous compliance monitoring automates the evidence collection required for audits and regulatory reporting. Rather than conducting periodic assessments, enterprises instrument their AI systems to generate real-time compliance telemetry. The observability plane collects evidence of policy enforcement, access controls, model performance, and incident response. Automated dashboards track compliance posture against NIST, ISO, and EU AI Act requirements, flagging deviations before they become violations. ## Runtime Defense for AI Agents: Beyond Traditional Security Controls Agents change the security problem because they do more than answer questions. They call tools, retrieve context, and act across multiple steps. Unlike traditional workloads with predictable behavior, agents make non-deterministic decisions that cannot be fully scripted in advance. Runtime defense provides dynamic security enforcement during agent execution, detecting threats and constraining behavior in real time. [AGENTWARD](https://arxiv.org/pdf/2604.24657) is a lifecycle-oriented runtime defense framework that adopts a layered defense-in-depth architecture. It combines stage-specific heterogeneous controls with cross-layer coordination, enabling threats to be continuously detected, constrained, and interrupted as they propagate through the agent lifecycle. The real risk is not just that an agent produces a bad answer. Agents have agency: they can exfiltrate data, modify records, and trigger cascading actions across interconnected systems. Prompt injection attacks exploit this agency by embedding malicious instructions in user input or retrieved context, causing agents to ignore their original directives and execute attacker-controlled tasks. Runtime identity security solutions built specifically for agents address this by evaluating intent, context, and access rights in real time. When an agent requests access to a sensitive API, the runtime defense layer examines not just the agent's credentials but also the prompt that triggered the request, the tools previously invoked, and the data accessed so far. If the sequence of actions deviates from expected patterns—such as an agent trained for customer support suddenly querying financial records—the system can block the request, quarantine the agent, or escalate to human review. Tool-use monitoring provides another layer of runtime defense. Agents interact with external systems through tool calls, and each tool represents a potential attack vector. A compromised agent might invoke tools excessively, attempting to brute-force credentials or exfiltrate data through repeated API calls. Runtime defense mechanisms enforce rate limits, detect anomalous tool-use patterns, and validate that tool invocations align with the agent's stated purpose. Context-aware authorization extends traditional role-based access control to account for the dynamic nature of agent behavior. Rather than granting static permissions, context-aware policies evaluate each request based on the agent's current state, the sensitivity of the requested resource, and the risk profile of the operation. ## Implementing Enterprise AI Security: A Phased Approach Deploying an ai security framework enterprise requires a phased approach that balances immediate risk reduction with long-term architectural goals. Attempting to implement all six planes simultaneously overwhelms teams and delays value delivery. **Phase 1: Foundation and Inventory** establishes the baseline. Begin by inventorying all AI systems, including models in production, agents under development, and shadow AI deployed by business units without central oversight. Assign ownership for each system, designating individuals responsible for security, compliance, and performance. Establish an AI governance committee with representation from security, legal, compliance, data science, and business units. This phase typically takes two to three months. **Phase 2: Identity and Access Control** secures the identity plane. Implement role-based access control for model registries, training environments, and production inference endpoints. Enforce multifactor authentication for all users with access to AI systems. Deploy automated credential rotation for service accounts and agents. This phase addresses the 92% of organizations missing basic access controls on AI systems and significantly reduces breach risk. **Phase 3: Runtime Defense and Monitoring** activates the runtime and observability planes. Deploy an AI gateway to terminate prompts and tool calls, enforcing policies at the point of execution. Implement runtime defense mechanisms that detect adversarial inputs, monitor tool usage, and enforce rate limits. Instrument the observability plane to collect telemetry from data pipelines, model inference, runtime execution, and identity events. This phase typically takes three to four months and delivers immediate value through threat detection and incident response. **Phase 4: Policy Automation and Compliance Integration** operationalizes the policy enforcement plane. Translate governance policies into executable rules enforced automatically across all six planes. Implement automated model approval workflows that require security and compliance sign-off before production deployment. Map enterprise policies to regulatory requirements from NIST, ISO 42001, and the EU AI Act, ensuring that technical controls satisfy compliance mandates. Throughout implementation, maintain focus on regulated industry requirements. Finance, healthcare, and government sectors face sector-specific mandates that extend beyond general AI security frameworks. [AI security](https://www.odingard.com/ai-security) in these environments requires additional controls for data residency, audit trails, and breach notification. Budget allocation should reflect the 0.5% to 1% of AI spending benchmark for governance. This budget covers tooling for the six planes, training for security and data science teams, and staffing for the AI governance committee. By treating governance as a first-class operational requirement rather than an afterthought, enterprises build defensible AI infrastructure that scales with their ambitions. ## Share this post [mailto:https%3A%2F%2Fblog.odingard.com%2Fai-security-framework-enterprise-6-plane-architecture](mailto:https%3A%2F%2Fblog.odingard.com%2Fai-security-framework-enterprise-6-plane-architecture) ## Keep reading ### [![Dependency graph: one poisoned write (red) spreads taint (gold) to downstream records while the rest of the shared state stays clean](https://blog.odingard.com/hs-fs/hubfs/blog/transitive-taint-propagation-cover.jpg?width=1600&height=900&name=transitive-taint-propagation-cover.jpg) Research AI Agent Security Transitive Taint Propagation: Containing Poisoned Writes in Shared Agent State](https://blog.odingard.com/transitive-taint-propagation-containing-poisoned-writes-in-shared-agent-state) ### [![Cyber security and AI: enterprise defense in 2026](https://blog.odingard.com/hs-fs/hubfs/blog/cyber-security-and-ai-enterprise-defense-2026.jpg?width=1376&height=768&name=cyber-security-and-ai-enterprise-defense-2026.jpg) Cyber Security and AI: Enterprise Defense in 2026](https://blog.odingard.com/ai-and-cybersecurity-stronger-defenses-safer-ai-systems) # Odingard Security --- Privacy Policy · Legal · © 2026 Odingard Security. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Andre Byrd", "url" : "https://blog.odingard.com/author/andre-byrd" }, "datePublished" : "1970-01-01T00:00:00.000Z", "headline" : "AI Security Framework Enterprise: 6-Plane Architecture", "image" : [ "https://rqlamurdcjeeoogoiurt.supabase.co/storage/v1/object/public/article-images/covers/ai-security-framework-enterprise-6-plane-archite-mv0iw2og.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.odingard.com/ai-security-framework-enterprise-6-plane-architecture", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject" }, "name" : "Odingard Security" } } ``` ```json { "@context" : "https://schema.org", "@type" : "Article", "datePublished" : "2026-10-09T09:00:12.358Z", "description" : "AI Security Framework Enterprise with 6-plane architecture for robust protection. Comprehensive security strategies for enterprise AI systems.", "headline" : "AI Security Framework Enterprise: 6-Plane Architecture", "image" : [ "https://rqlamurdcjeeoogoiurt.supabase.co/storage/v1/object/public/article-images/covers/ai-security-framework-enterprise-6-plane-archite-mv0iw2og.jpg" ] } ```