AI Factory: a five-layer framework

Building useful, reliable agents takes more than a model. The “five-layer cake” is the teaching framework BORAMA uses to organise an AI Factory. Layers build on each other but interact in both directions: it is not a strictly linear chain.

Select a layer to see its role, interactions and an example.

SecurityGovernanceObservabilityHuman oversight

5 Applications

Role: The layer users see: conversational assistants, agents that complete a task, workflows that chain several steps with approvals.
Interactions: It combines models and skills, reads permitted data and sends usage feedback that improves the other layers.
Example for an SME: Every Monday an agent prepares a summary of pending quotes; the sales director reviews it before sharing.

4 Models

Role: Models interpret, write, classify or extract. The model is chosen per task, cost, confidentiality and measured quality.
Interactions: One model can serve several applications; skills frame how it is used, evaluations compare models on your own cases.
Example for an SME: A general model drafts meeting minutes; a lighter model sorts incoming e-mails.

3 Skills

Role: Skills describe how to do a task: instructions, examples, procedures, callable tools and connectors to your software.
Interactions: They connect models to data and tools, and are reused across applications.
Example for an SME: The “prepare an invoice” skill reads timesheets and fills in the invoice template, without issuing it.

2 Data

Role: Agents are only as good as the information they can access: documents, knowledge base, business data, with their quality and access rights.
Interactions: Permissions defined here apply to every layer above; data quality drives deliverable quality.
Example for an SME: Terms and conditions and the product catalogue are indexed; HR files remain off-limits to sales agents.

1 Infrastructure

Role: The foundation: where models and agents run, where data is stored, how test and production environments are separated.
Interactions: It sets the cost, performance, data location and security constraints for everything else.
Example for an SME: Hosting in France, a separate test environment and verified backups before any go-live.

Four cross-cutting dimensions

Security

Access control, protected secrets, separated environments, connector review.

Governance

A human owner for each agent, a register, versions, usage rules and a suspension procedure.

Observability

Logs of actions, costs, errors and evaluations, available to authorised people.

Human oversight

Approval points defined upfront; no reserved decision is taken by an agent.

What an AI Factory produces

Documents

Drafted by the agent, reviewed and approved by a professional.

Human approval point
Review and approval before sharing

Code

Proposed with its tests and documentation.

Human approval point
Code review and tests before merge

Analyses

Summaries and comparisons with their sources.

Human approval point
Sources and assumptions checked

Business actions

Follow-ups, updates, file preparation.

Human approval point
Explicit authorisation before execution