Reference Architecture for Enterprise AI Harness on Kubernetes: Four Layers for Secure Agent Deployment in Production

The article presents a reference architecture for building a self-hosted Enterprise AI Harness on Kubernetes, structured into four layers: Input, Agent Loop, Execution, and Identity, Policy & Audit. The Input layer separates user, agent, and event traffic using tools like Traefik and n8n webhooks. The Agent Loop (ReAct) layer manages stateful agent sessions with memory, delegation, and human-in-the-loop (HITL) using components like kagent and LangGraph. The Execution layer controls access to external resources (MCP tools, workflows, LLMs) via FastMCP, n8n, and LiteLLM. The Identity, Policy & Audit layer provides cross-cutting authentication, authorization, and auditing through Keycloak, agentgateway, Vault/OpenBao, and OTEL/Grafana. The architecture emphasizes security boundaries, multi-tenancy (via RLS, namespaces, network policies), and deployment context (Kubernetes, Helm, NetworkPolicy). Skills are implemented as pod-local capability injections (OCI images with SKILL.md), while tools are network-accessible. The article illustrates the workflow with an engineering task example, showing how identity flows from input through agentgateway to execution, with audit trails throughout. The author notes that this is a working reference model, not a product, and invites discussion on essential layers.