The Headless Enterprise Stack
Six layers, and the one most architectures leave out
The Headless Enterprise Stack
Most reference architectures for agentic AI stack the same layers: assistants at the top, an orchestration runtime, protocols, the vendors' tools and APIs, a data layer, identity, and observability. They're right about all of those. They leave out the layer that tells AI what the data means for the business.
Here's the stack as we see it.
| Layer | What it does | Examples |
|---|---|---|
| 1. Surfaces | Where people and AI meet the work | General assistants, chat tools, coding assistants, apps and review screens |
| 2. Protocols | How AI reaches systems and other agents | MCP for tools and context, A2A for agent-to-agent |
| 3. Agents and skills | The AI that does the work, and the written-down methods it follows | Platform agents, your own agents, packaged skills |
| 4. The operating model | What the work means: why it exists, what it's funded with, what it runs on, what rules apply, what was decided | Strategy, money, portfolio, architecture, controls, decisions |
| 5. Systems of record | Where the facts are kept | ERP, CRM, HR, work management, cloud billing, CMDB |
| 6. Governance | Who may do what, on whose authority, at what cost, with what evidence | Identity, permissions, approvals, spend, audit, AI policy |
Why layer 4 matters
Without an operating model, every agent rebuilds its own picture of the business from whatever systems it can reach, every time it runs. Each picture is partial and each is slightly different. That's why the same question gets a different answer in each AI tool.
With an operating model, every agent — yours, your vendors', your employees' assistants — reads the same connected picture:
- Strategy: the bets, beliefs and objectives, and what each is meant to move.
- Money: budgets, forecasts, actuals and allocations, tied to the work they fund.
- Portfolio: the initiatives, products and value streams, and how they depend on each other.
- Architecture: the applications and capabilities the work runs on, and what depends on them.
- Controls: the standards, policies and obligations, and the systems they cover.
- Decisions: what was decided, by whom, on what evidence, and what changed because of it.
Two properties the operating model must have
It has to be connected. The value is in the relationships — from a key result to the initiatives behind it, to the budget that funds them, to the systems they run on, to the controls those systems must meet. A pile of documents, however well indexed, can't answer "what does cutting this budget put at risk?"
It has to be governed. The model carries the organization's permissions, so any AI reading it sees only what the person behind it may see. It records who changed what. And it holds the AI policies themselves, so the same model that runs the business also governs the AI working in it.
Two tracks, not one
For the foreseeable future most enterprises will run two tracks at once: systems of record kept as the governed source of facts, and an agentic layer above them where more and more work gets prepared and done. The operating model is what lets the two tracks agree.