The runtime layer after the model

Govern intelligence while it runs.

Machine Intelligence Runtime is the execution control plane between applications and model inference. It coordinates agents, tools, memory, policy, approvals, recovery, and evidence so probabilistic models can perform controlled, reviewable work.

Explore the architecture Read the research

Model-agnostic
Policy-enforced
Local-first
Evidence-producing

Illustrative execution flow. All stages remain understandable without animation.

Category definition

A distinct execution layer

Machine Intelligence Runtime is an emerging architectural category. It composes existing systems rather than renaming them.

Model runtime

Generates model outputs

Loads weights, schedules inference, manages caches, and decodes tokens.

Agent framework

Structures agent logic

Provides prompts, loops, planning patterns, and tool declarations.

Machine Intelligence Runtime

Governs execution

Controls state, authority, tools, memory, recovery, approvals, and evidence while work happens.

What MIR is not: a synonym for an inference server, a claim that one framework solves every runtime concern, or a settled industry standard.

Four runtime responsibilities

Observe. Constrain. Recover. Prove.

state.objectivePrepare dependency updaterisk: reversible-change

Observe

Maintain visibility into state, context, tools, uncertainty, budgets, and pending consequences.

policy.decisionrequire-approvalaction: deploy.production

Constrain

Enforce schemas, permissions, data rules, budgets, egress, and approval gates before side effects.

checkpoint.restorerecoveredattempt: 2 · version adjusted

Recover

Retry safely, checkpoint, roll back, compensate, reroute, pause, or escalate.

artifact.patchsha256:8c2…sources · tests · approval

Prove

Preserve sources, actions, artifacts, decisions, errors, and unresolved uncertainty.

Interactive reference architecture

Seven layers, explicit contracts

Select any layer to inspect its responsibilities, inputs, outputs, failure modes, and what must remain outside the prompt.

1Application

Captures user intent and presents reviewable outcomes.

Inputs: Objective, identity, user interaction
Outputs: Run request, review, approval
Failure mode: Ambiguous objective or hidden consequence
Keep outside the prompt: Final user authorization and product policy

2Runtime orchestration

Maintains state, schedules steps, budgets work, and selects recovery paths.

Inputs: Run contract and observations
Outputs: State transitions and work dispatch
Failure mode: Loops, stale workers, or unbounded budgets
Keep outside the prompt: Lifecycle authority cannot live only in a prompt

3Policy and permissions

Evaluates identity, risk, data, tools, and required approvals.

Inputs: Subject, action, resource, context
Outputs: Allow, deny, transform, approve, escalate
Failure mode: Ambient authority or policy bypass
Keep outside the prompt: Credentials, policies, and decisions remain typed

4Memory and context

Selects scoped, attributable, current information for the run.

Inputs: Sources, memory scopes, retention rules
Outputs: Context projection and provenance
Failure mode: Stale, poisoned, excessive, or prohibited memory
Keep outside the prompt: Consent, deletion, and source authority

5Tools and connectors

Executes typed actions through bounded adapters.

Inputs: Validated arguments and scoped credentials
Outputs: Structured result, side effect, artifact
Failure mode: Partial writes, exfiltration, timeouts, injection
Keep outside the prompt: Permission and side-effect class

6Model adapters

Normalizes model capabilities, streaming, tools, budgets, and errors.

Inputs: Context, prompt contract, model route
Outputs: Candidates, plans, embeddings, scores
Failure mode: Invalid output, provider failure, capability mismatch
Keep outside the prompt: Model selection and provider policy

7Evidence and telemetry

Preserves operational traces and user-facing execution evidence.

Inputs: Events from every layer
Outputs: Timeline, artifacts, metrics, incident record
Failure mode: Missing correlation, sensitive overcollection, silent effects
Keep outside the prompt: Retention, access, and evidence semantics

Read the full reference architecture

Controlled execution demo

The difference appears in the event sequence

This fictional repository update teaches the architecture. It does not simulate a live product.

Opaque dependency-update flow

01
Repository content enters one prompt
Scope and provenance are implicit.
02
Model proposes and applies a patch
The tool receives broad write authority.
03
A generic log records success or failure
No checkpoint, approval state, or evidence package.

Governed dependency-update flow

01
Intent captured
Objective and reversible-change risk class recorded.
02
Allowed context selected
Manifest, lockfile, policy, and relevant source files only.
03
Model proposes a patch
No write occurs yet.
04
Tool schema and policy validated
Draft-only authority and dependency allowlist enforced.
05
Tests run in isolation
Checkpoint created; network egress constrained.
06
Deployment is blocked
External effect requires approval.
07
Evidence package generated
Diff, tests, sources, policy decision, and uncertainty.

Managed runtime pattern

Control plane and runtime plane

Control plane

Govern the fleet

Identity and tenancy
Policy and configuration
Provisioning and routing
Lifecycle and observability

Cross-cutting evidencepolicy decisions · runtime events · approvals · artifacts

Runtime plane

Execute the session

Isolated workspace
Tools and credentials
Memory projection
Model adapters and artifacts

created
provisioning
running
awaiting approval
recovering
completed
failed
terminated

Allowed paths include completion, failure, or termination; approval and recovery are explicit states.

Examine the managed runtime pattern

Continuity and accountability

Memory remembers. Evidence explains.

Memory

What future work may use

Working and task state
Project decisions and constraints
User preferences with consent
Episodic memory with promotion rules
Prohibited memory and deletion controls

Evidence

What reviewers can inspect

Request and interpreted objective
Context, sources, and exclusions
Tools, policy, and approvals
Changed state and artifacts
Errors, recovery, and uncertainty

Inspect this run

09:41:02.118Z
context.selectedverified
4 repository sources admitted; credentials and unrelated files excluded.
09:41:03.402Z
policy.decidedallowed
Draft-only write permitted. Deployment denied without approval.
09:41:08.771Z
tool.completedcompleted
Dependency manifest updated in isolated branch; idempotency key recorded.
09:41:17.029Z
test.failedrecovered
Initial test failed; runtime restored checkpoint and selected compatible version.
09:41:30.500Z
approval.requestedpending
Publish action paused. Diff, tests, and rollback path attached.
09:41:30.881Z
artifact.producedverified
Reviewable patch and decision summary sealed into evidence package.

Security and governance

Map threats to runtime controls

Agentic security requires defense in depth across content, identity, tools, memory, execution, and evidence.

Threat	Failure path	Controls	Status
Indirect prompt injection	Retrieved content manipulates the agent	Treat external content as untrusted data; isolate instructions; constrain tools; require approval for high-impact actions	Production practice + active research
Overprivileged tools	Agent can act beyond the current objective	Default deny, scoped credentials, permission classes, resource-level authorization	Production practice
Credential leakage	Secrets enter prompts, logs, or tool output	Vault-issued short-lived credentials; redaction; secret-free evidence	Production practice
Data exfiltration	Tool or connector sends sensitive content outward	Egress allowlists, DLP, data minimization, destination binding	Production practice
Runaway loops	Agent consumes unbounded time or resources	Step, token, cost, time, and tool budgets; circuit breaker; stop authority	Production practice
Poisoned memory	Stale or adversarial memory affects future runs	Provenance, scopes, confidence, review, correction, expiration	Production pattern
Silent side effects	External state changes without reviewable trace	Typed actions, checkpoints, approval gates, evidence events	Production practice
Cross-agent trust failure	Peer agent is treated as inherently trusted	Mutual identity, bounded delegation, schema validation, independent policy	Evolving practice

Production controls and research proposals are labeled separately. See the complete runtime threat model.

Runtime intelligence and performance

Optimize the completed workflow, not only the token stream

Task-level performance includes success, recovery, approval delay, tool reliability, context efficiency, cost, energy, evidence completeness, and policy outcomes.

Time to successful outcomeFirst-attempt successRecovery rateApproval latencyTool failure rateContext efficiencyCost per workflowEvidence completeness

Context assemblyPolicy evaluationModel inferenceTool I/OSandbox startupOrchestrationEvidence capture

Context assemblySources, memory, filtering
Policy evaluationIdentity, data, action
Model inferencePlanning or generation
Tool I/ONetwork and external system
Sandbox startupWorkspace and isolation
OrchestrationState and scheduling
Evidence captureEvents and artifacts

Illustrative proportions only. Measure each production workload directly.

Runtime intelligence Performance and hardware

Protocols and ecosystem

MIR composes the surrounding stack

Applications and users

Machine Intelligence Runtimestate · authority · tools · memory · recovery · evidence

MCPtools, resources, prompts

A2Aagent interoperability

AI gatewaysmodel traffic and routing

Workflow enginesdurable transitions

Identity and vaultsauthentication and credentials

Observabilitytraces, metrics, logs

Memory storesvector, graph, relational, events

Sandboxesprocess, filesystem, egress

Model servers and inference runtimes → hardware

Neutral conceptual map. Categories overlap in products, but their responsibilities remain distinct.

Understand MCP, A2A, gateways, model servers, and observability

Use cases

Apply MIR where state and authority justify it

Software engineering

Stage, test, and review reversible changes

Checkpoints, isolated tools, diffs, approvals, and evidence.

Regulated work

Prepare cases without replacing accountable decisions

Data boundaries, policy gates, provenance, and qualified review.

Local assistants

Keep policy and project state close to the user

Local tools, hybrid model routing, and exportable evidence.

AI platforms

Provide a shared governed execution service

Runtime profiles, registries, identity, observability, and tenant isolation.

Explore all use cases

Developer preview

Make intent, authority, execution, and evidence explicit

The reference contracts are conceptual. They provide stable shapes for implementations built with existing model servers, policy engines, workflow systems, and observability stacks.

Runtime contract Tool contracts Evidence schema Implementation checklist

{
  "contractVersion": "1.0",
  "intent": {
    "objective": "Prepare a dependency update",
    "riskClass": "reversible-change",
    "successCriteria": ["tests-pass", "reviewable-diff"]
  },
  "context": {
    "sources": [],
    "memoryScopes": [],
    "prohibitedDataClasses": []
  },
  "authority": {
    "allowedTools": [],
    "writePolicy": "draft-only",
    "requiredApprovals": ["merge", "deploy"]
  },
  "execution": {
    "state": "running",
    "checkpointPolicy": "before-side-effect",
    "budgets": { "steps": 24, "elapsedSeconds": 900 }
  },
  "evidence": {
    "events": [],
    "artifacts": [],
    "unresolvedUncertainty": []
  }
}

Research hub

Evidence before category claims

The research hub separates primary sources, vendor implementations, research prototypes, editorial synthesis, and forecasts.

Editorial synthesis

Future scenarios

Separate what exists from what may emerge

Current
Governed tool-using agents
Typed tools, scoped credentials, isolated execution, approvals, telemetry, and evidence.
Near term
Portable runtime contracts
More common schemas for tools, evidence, lifecycle, and deployment profiles are plausible.
Open research
Adaptive and reflective control
Systems allocate test-time compute and diagnose recurring failure under independent validation.
Long-range scenario
Federated verifiable runtimes
Independent runtimes exchange bounded work and evidence across trust domains.

Read assumptions and uncertainty

Help define the runtime layer after the model

Turn probabilistic models into dependable software behavior.

MiRuntime documents the architectures, controls, and evidence systems required to govern intelligence while it runs.

Discuss an architecture Read the reports