Usage Modes and the Platform: What Each Mode Demands

A platform team that is told "we use AI" learns almost nothing about what it must build. A browser chat service and an agent that changes claims records overnight may call the same model, yet one needs an egress rule and a sign-on policy, the other the whole reference architecture plus an identity, a budget and a stop path. This chapter organises that work by the six usage modes of large language models and sets out what each mode requires of five platform capabilities. The full taxonomy is in AI Governance, Chapter 2 (73, Nordqvist, 2026), with identical names and numbering.

The six usage modes in a column, from Mode 0 Ambient AI to Mode 5 Autonomous production agents

Figure 2.1: The six usage modes ordered by how deeply the model is integrated into the organisation's data and systems and how much autonomy its output is given. The further down a mode sits, the more of the platform it needs.

The drift paths along which a use case changes mode are these.

From To Trigger
Mode 0 Ambient AI Mode 2 Embedded workplace assistants Feature adopted deliberately
Mode 1 Conversational assistants Mode 3 Agentic work tools A prompt becomes a shared skill
Mode 2 Embedded workplace assistants Mode 5 Autonomous production agents A tenant agent gains triggers
Mode 3 Agentic work tools Mode 4 Built AI applications A skill becomes a product
Mode 4 Built AI applications Mode 5 Autonomous production agents The approval step is removed

The six modes in brief

Each mode is an architectural pattern, not a product category. The AWS scoping matrix grades generative AI by the share of the stack the organisation owns (196, AWS, n.d.); for platform and security work, however, two further axes matter more: how far the model reaches into the organisation's data and systems, and how far its output travels before a person checks it.

Mode 0 – Ambient AI

Model output that reaches staff unasked, such as a generated answer above search results or a feature a supplier switches on through an update. The platform has no runtime in the path; it can only detect such features, record those that touch personal or confidential data, and reopen the data-flow assessment when they change.

Mode 1 – Conversational assistants

A general-purpose chat interface such as ChatGPT, Microsoft Copilot Chat, Claude, Gemini or Le Chat; nothing takes effect until a person acts. The organisation controls who may sign in and which endpoints staff can reach. The decisive variable is the tier, because one brand is sold both on consumer terms and on commercial terms backed by a data processing agreement.

Mode 2 – Embedded workplace assistants

An assistant built into the office suite, such as Microsoft 365 Copilot, Gemini in Google Workspace or Claude within Office applications, which fetches mail, documents, calendars and chats itself and acts on them with the user's permissions. The control point moves into the tenant: permissions, sensitivity labels, grounding scopes and audit settings.

Mode 3 – Agentic work tools

An agent that iterates with tools, changing files, executing commands and proposing pull requests for a person to review; coding agents such as Claude Code, OpenAI Codex, GitHub Copilot's agent and Cursor are the familiar case. Because single tool calls may run without approval, the control point is the managed permission policy and the environment the agent executes in.

Mode 4 – Built AI applications

A system the organisation builds around a model, such as a retrieval assistant or a correspondence classifier. The organisation owns model choice, prompts, corpus, evaluation and operation, and is usually the provider, since the AI Act, Regulation (EU) 2024/1689, defines the provider in Article 3 as whoever develops a system and puts it into service under its own name (1, European Union, 2024). The control point is the whole reference architecture of Chapter 4.

Mode 5 – Autonomous production agents

An agent that changes business systems with no per-step approval, triggered by events; people define its mandate and stop conditions and supervise outcomes. The control point is the agent's definition and identity, enforced by the platform: a permission manifest, scoped credentials, budgets, approval thresholds and a tested stop path.

The usage modes compared

Table 2.1 compares the modes along the dimensions a platform team needs.

Dimension Mode 0 – Ambient AI Mode 1 – Conversational assistants Mode 2 – Embedded workplace assistants Mode 3 – Agentic work tools Mode 4 – Built AI applications Mode 5 – Autonomous production agents
Who operates the runtime The supplier The vendor The vendor, inside the tenant Vendor tool, local or in a sandbox The organisation The organisation, often on an agent platform
Context reaching the model None selected Pasted or uploaded material Whatever the user can open Code, files, a shell and connectors Curated corpus and fields Production systems and events
Identity it acts with The supplier's service The user's account The user's delegated permissions The user's credentials or a sandbox token Service identity plus end-user identity A dedicated agent identity
Usual AI Act role Rarely any; Article 4 literacy Deployer Deployer Deployer Usually provider; Article 50 Provider or deployer
Platform control point Inventory and supplier change control Identity provider and egress proxy Tenant configuration Managed policy and sandbox AI gateway and reference architecture Agent manifest, identity and stop path

Table 2.1: The six usage modes compared from the platform's point of view.

Whether a system is high-risk depends on its use under Article 6 and Annex III, never on its mode (1, European Union, 2024); ranking job applicants with a chat tool is still high-risk, and the platform duties follow the use: automatic logging under Article 12 and retention of those logs by the deployer for at least six months under Article 26(6).

What the platform must provide, capability by capability

Five capabilities change with the mode; higher modes inherit the needs of lower ones.

Gateway and routing

In Modes 4 and 5 every model call goes through the AI gateway of Chapter 4, which authenticates the caller, applies the route's policy and records the exchange. In Modes 0 to 2, by contrast, no organisational gateway sees the call, so the egress proxy, allowing approved enterprise endpoints and blocking consumer ones, and the identity provider, admitting only organisational accounts, are the only enforcement available.

Mode 3 is mixed, because some tools accept an organisation-chosen endpoint. OpenCode, an open-source coding agent, says it works with more than 75 providers and with local models, and that each agent or subagent can be given its own model (218, OpenCode, 2026). Such tools can then be routed through the gateway (Chapter 15); tools tied to their vendor's cloud leave only the egress proxy.

Identity and delegated authority

The identity the model uses defines how far a mistake or a manipulation can reach. In Mode 2 the assistant inherits the user's permissions, so old over-sharing becomes retrievable by question; access reviews and restricted grounding come before licences go out. In Mode 3 the agent holds the developer's credentials unless the platform issues narrower ones. GitHub describes such limits for its coding agent: one branch to push to, no approving or merging its own pull requests, and no workflow runs until a person approves them (216, GitHub, n.d.).

Mode 5 needs a dedicated, least-privilege workload identity per agent. Microsoft's Copilot Studio documentation shows the alternative: event triggers run only with the maker's credentials, and the documentation warns that users of a published agent may get it to act with them (217, Microsoft, 2026). Vendor control planes are moving towards agent registries, such as Microsoft's Agent 365, which can quarantine unsanctioned agents (149, Lamanna, 2025). Chapter 11 binds identity to mandate in a permission manifest.

Isolation and containment

Containment starts with Mode 3. In Claude Code, deny rules are checked before allow rules and managed settings override user and project settings, but the shell sandbox is off unless enabled and, by default, commands run without it if it fails to start (214, Anthropic, n.d.); Codex, according to OpenAI, starts with network access disabled (215, OpenAI, n.d.). Since any user can loosen such settings, the platform imposes a managed policy, a sandbox that fails closed, an egress allow-list and a curated catalogue of skills and connectors. The threat is too much permission meeting untrusted input, as when an injected instruction in a public issue caused an agent using the official GitHub MCP server to copy private repository content into a public pull request (163, Milanta & Beurer-Kellner, 2025).

In Mode 5 containment is the main control, and the OWASP list for agentic applications names goal hijacking, misuse of tools, abuse of identity and privilege, and cascading failures among the risks this layer must withstand (102, OWASP, 2025). Chapter 19 builds it.

Logging and evidence

The organisation can prove only what crosses infrastructure it runs: sign-in, proxy and tenant audit records in Modes 0 to 2, and centrally gathered transcripts and tool-call logs in Mode 3. In Mode 4 the gateway logs each exchange and each release is attested, and for high-risk systems these records meet the Article 12 logging duty (1, European Union, 2024). In Mode 5 each action must trace back to mandate, identity, trigger and approval (Chapter 21).

Data boundaries

In Mode 1 the contract tier sets the line. According to OpenAI, business, enterprise and API data is not used for training by default, whereas consumer plans contribute to training unless users opt out (210, OpenAI, 2026); Anthropic's consumer-terms update of August 2025 asked consumer-plan users to decide about training use and left its commercial offerings untouched (211, Anthropic, 2025). The platform's role is to leave only the commercial tier reachable.

In Mode 2 location must be verified feature by feature: Microsoft documents that Claude models from Anthropic used in Microsoft Copilot and Copilot Chat are currently excluded from its EU Data Boundary and, where applicable, in-country processing commitments (212, Microsoft, 2026). The boundary also leaks inwards through external mail. Prompt injection heads the OWASP list for LLM applications (27, OWASP, 2025), and EchoLeak (CVE-2025-32711) exfiltrated data from Microsoft 365 Copilot through one crafted email with no user action, until the vendor fixed it in the service (213, Reddy & Gujral, 2025). Customers cannot patch such flaws, only configure how external content is handled. In Modes 3 to 5 the platform sets the line itself through routing and declared residency (Chapters 14 and 15).

The minimum platform baseline

Table 2.2 is a floor, not a target: a system's risk class, assigned through the classification in AI Governance, Chapter 8 (73, Nordqvist, 2026), adds controls.

Mode Gateway and identity Containment Logging and evidence Data boundary Built in
Mode 0 – Ambient AI None in path; supplier's service None Supplier notices; inventory entry Contract terms; reassess when a feature is enabled Chapters 4 and 21
Mode 1 – Conversational assistants Egress proxy to enterprise endpoints; single sign-on None beyond the browser Sign-in and proxy logs Commercial tier with a data processing agreement Chapters 14 and 16
Mode 2 – Embedded workplace assistants Tenant configuration; delegated permissions after access review External content handling set in the tenant Tenant audit with retention set Labels enforced; restricted grounding; location per feature Chapters 14 and 16
Mode 3 – Agentic work tools Gateway where supported; task-scoped sandbox token Managed policy; fail-closed sandbox; egress allow-list; catalogue-only skills Central transcripts and tool calls Routing by information class Chapters 8, 15, 17 and 19
Mode 4 – Built AI applications Every call through the gateway; service plus end-user identity Application boundary and guardrails Gateway logs, evaluations, attestation; Article 12 where high-risk Corpus with entitlements; declared residency Chapters 4, 8, 12, 14, 16, 17 and 21
Mode 5 – Autonomous production agents Per-agent routes and budgets; dedicated agent identity Tool allow-list, limits, approval gates, tested stop path Per-action trace linked to mandate and approval As Mode 4, plus bounds on changeable data Chapters 11, 12, 17, 19 and 21

Table 2.2: Minimum platform baseline by usage mode, with the chapters that build each part.

Mode changes are platform events

A useful prompt often travels from a chat window to a team skill, into a built application and finally towards running unattended. AI Governance, Chapter 2, explains why governance must therefore track the use case rather than the tool (73, Nordqvist, 2026). Each step relocates the control point, although the code gives no sign of it, so the mode recorded in the register must therefore be machine-read: issuing a gateway route, agent identity or connector checks the entry's mode and its baseline, and a mode change blocks the pipeline until a review is attached. Because one brand often spans several modes, platform policy keys on service, tier, mode and data classes, with the vendor as an attribute.

Practical guide: map each use case to its platform control point

Purpose. Give every use of a large language model a control point and enforce its baseline at provisioning.

Roles. The platform owner maintains the baseline and provisioning checks; the AI architect maintains the usage-mode register; the security team provides proxy, DNS and identity telemetry; under DORA the ICT risk function takes part.

Steps.

  1. Start from the usage-mode register; if none exists, build one from 90 days of proxy and DNS logs, tenant add-ins, agent tools on managed workstations and issued provider API keys.
  2. Record the control point for each entry, using Table 2.1, and mark each cell of its mode's row in Table 2.2 met, partly met or missing, with an evidence link.
  3. Close gaps in order of exposure: Mode 5 agents without a dedicated identity or tested stop path; Mode 3 tools without a fail-closed sandbox; Mode 4 calls that bypass the gateway, found by comparing provider API usage with gateway logs; consumer-tier Mode 1 use with personal data.
  4. Codify the baseline in the platform repository and make provisioning read it, so that no route, agent identity or connector is issued unless the entry meets its baseline.
  5. Fail the pipeline when an entry's mode changes without a linked review, and reconcile the register against telemetry every quarter.

Definition of done. Each use seen in telemetry has a register entry; each Mode 3 to 5 entry meets its baseline or carries a dated exception; and someone named owns the quarterly reconciliation.

Worked example: a mode baseline as platform policy

Illustrative example. Hansa Mutual, one of the two example organisations, keeps the per-mode baseline as a policy file that provisioning reads.

# platform/mode-baselines.yaml - Hansa Mutual (illustrative)
apiVersion: ai-architecture.example.org/v1
kind: ModePlatformBaseline
metadata: {organisation: hansa-mutual, owner: ai-platform-owner, version: 2026.11.0}
modes:
  "1":
    controlPoint: identity-and-egress
    egress: {allow: approved-enterprise-endpoints, consumerEndpoints: block}
  "2":
    controlPoint: tenant
    identity: user-delegated-after-access-review
    dataBoundary: {sensitivityLabels: enforced, restrictedGrounding: required}
  "3":
    controlPoint: managed-policy-and-sandbox
    routing: {confidentialAndAbove: hansa-dc-frankfurt, other: approved-cloud}
    containment: {sandbox: fail-closed, egress: allow-list, productionCredentials: forbidden}
  "4":
    controlPoint: ai-gateway
    identity: {service: workload-identity, endUser: propagated-to-retrieval}
    evidence: [gateway-logs, evaluation-results, release-attestation]
  "5":
    inherits: "4"
    controlPoint: agent-manifest
    identity: dedicated-agent-identity
    delegation: {bindToMarketOfRecord: true}
    containment: {toolAllowList: required, budgets: required, stopPath: tested-quarterly}

The file proved its worth when the claims-triage assistant UC-2026-014 became the claims-triage agent acting on the core claims system within approval rules. When the entry moved from Mode 4 to Mode 5, provisioning withheld the new gateway route until the agent had its own identity, a manifest with tool allow-list and budgets, a recorded stop-path test, and a delegated token binding each tool call to the claim's market.

Nordvik Region keeps the baseline as status fields in its register, which permits no Mode 5 and restricts Mode 3 to the platform team; the extract shows a gap that its plan in Chapter 24 closes.

# usage-modes/nordvik-region.yaml - extract (illustrative)
policy: {modes_not_permitted: [5], mode_3_permitted_for: [platform-team]}
use_cases:
  - id: NR-UC-017
    name: Coding agent for the platform team's infrastructure code
    mode: 3
    baseline: {managed_policy: met, sandbox_fail_closed: missing, egress_allow_list: met}
    owner: head-of-platform

Nordvik Region and Hansa Mutual

Nordvik Region's control points are mostly contracts, the tenant and the egress proxy, and with no Mode 5 and Mode 3 confined to one team it has deferred the hardest containment problems by choice. Hansa Mutual, by contrast, faces the whole gradient, from Mode 5 baselines across seven jurisdictions to confidential Mode 3 work routed to the self-hosted models in Frankfurt. Hansa needs every row of Table 2.2; Nordvik needs the upper rows done well.

Where the book builds each mode's platform

Table 2.2 names the chapters that build each part of the baseline. Chapters whose answer varies by mode carry an "Across the usage modes" subsection linking to the anchors above.

Summary

Each of the six usage modes puts the organisation's control point in a different place: an inventory and a supplier contract in Mode 0, the identity provider and egress proxy in Mode 1, the tenant in Mode 2, a managed policy and fail-closed sandbox in Mode 3, the whole reference architecture in Mode 4, and in Mode 5 additionally a dedicated identity, a manifest, budgets and a tested stop path.

Because use cases drift, the mode is a register field the platform reads, and provisioning refuses what the mode's baseline in Table 2.2 does not allow. Chapter 3 turns from usage to obligation, condensing European law into the engineering requirements and evidence a platform must provide.

Sources

  1. Nordqvist, G. (2026). AI Governance: Governing Artificial Intelligence in European Enterprises and Public Authorities. The Transformed Architecture, Book 2, published at aig.geon.se. (73, Nordqvist, 2026)
  2. Amazon Web Services. Generative AI Security Scoping Matrix. aws.amazon.com, undated. (196, AWS, n.d.)
  3. European Parliament and Council of the European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, 12 July 2024. (1, European Union, 2024)
  4. OpenCode (2026). OpenCode documentation: Intro, with the linked Providers and Agents pages. Last updated 1 November 2026; repository licensed under MIT. (218, OpenCode, 2026)
  5. GitHub. Risks and mitigations for GitHub Copilot cloud agent. GitHub Docs, living page. (216, GitHub, n.d.)
  6. Microsoft (2026). Event triggers overview – Microsoft Copilot Studio. Microsoft Learn, updated 10 September 2026. (217, Microsoft, 2026)
  7. Lamanna, C. (2025). Microsoft Agent 365: The control plane for AI agents. Microsoft 365 Blog, 18 November 2025. (149, Lamanna, 2025)
  8. Anthropic. Configure permissions and Configure the sandboxed Bash tool. Claude Code documentation, living page. (214, Anthropic, n.d.)
  9. OpenAI. Agent approvals & security. Codex documentation, living page. (215, OpenAI, n.d.)
  10. Milanta, M. & Beurer-Kellner, L. (2025). GitHub MCP Exploited: Accessing private repositories via MCP. Invariant Labs, 26 May 2025. (163, Milanta & Beurer-Kellner, 2025)
  11. OWASP Foundation (2025). OWASP Top 10 for Agentic Applications for 2026. OWASP GenAI Security Project, 9 December 2025. (102, OWASP, 2025)
  12. OpenAI (2026). What is the ChatGPT Enterprise and Business data policy? OpenAI Help Center, living page read 1 November 2026. (210, OpenAI, 2026)
  13. Anthropic (2025). Updates to Consumer Terms and Privacy Policy. Anthropic, 28 August 2025. (211, Anthropic, 2025)
  14. Microsoft (2026). Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat. Microsoft Learn, updated 31 October 2026. (212, Microsoft, 2026)
  15. OWASP Foundation. OWASP Top 10 for LLM Applications 2025. OWASP GenAI Security Project. (27, OWASP, 2025)
  16. Reddy, P. & Gujral, A. S. (2025). EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System. arXiv:2509.10540, AAAI Fall Symposium Series 2025. (213, Reddy & Gujral, 2025)