From the portal that presents to the platform that solves

• It is not the description of a specific portal: the subject is always “a large corporate portal”.
• It is not supplier recommendation: the technological matrix compares, does not elect.
• It does not propose a unique ideal architecture: there are explicit trade-offs and decisions that depend on the context.
• There are no dates: the roadmap has phases and criteria of passage, because the duration depends on the current state, which only the discovery reveals.

Every block derived from the study carries a stamp. The label is text; the color is not the only carrier.

FACT

Verifiable in primary source (specification, RFC, official documentation, law).

INFERENCE

Conclusion derived from facts, with explicit reasoning.

HYPOTHESIS

Plausible assumption, not yet verified.

RECOMMENDATION

Architecture position proposed by the study. When a block mixes labels, it's worth the weakest.

EXP (Employee Experience Platform)

Layer that organizes employee services and journeys on registration systems.

SoR (registration system)

Where is the official data and business rule: sheet, point, benefits, service.

ECM and CSP

Corporate Content Management (enterprise content management) and content service platform (content services platform): the governed repository and its version exposed as a service.

Headless

Structured content in fields and delivered by API to any channel without docked screen.

RAG (retrieval-augmented generation)

Answer generated by a model from excerpts from documents recovered by search.

Groundedness

The answer is based on the cited sources.

ACL, IdP and SSO

List of document permissions; identity provider; unique login.

AG-UI, MCP, A2A, A2UI

Open protocols: agent interaction ↔ application; agent ↔ tools; agent ↔ agent; and a declarative interface format generated.

HITL (human-in-the-loop)

Confirmation or formal human decision before action in effect.

BFF (backend for frontend)

Layer that adapts APIs to the channel that consumes them — here, the agent channel.

ESB, CDC and outbox

Central integration bus; capture of changes in the bank of a legacy; pattern that saves the state and event in the same transaction.

SLI, SLO and error budget

Indicator, objective on the indicator and how much of the goal can be missed before freezing changes.

DEX (digital employment experience) and ILM

Digital experience of the collaborator; management of the information life cycle (retention and disposal).

LGPD

General Data Protection Act (Law No 13.709/2018).

To be in an internship, the organization meets the all His criteria. Stage 1 has no entry criteria.

“Micro-frontends” in stage 3 formula indicates modularity of experience, not the obligation to adopt them in runtime.

• FACT Snapshot replaces the whole state ("not a merge"). Delta applies JSON Patch (RFC 6902) operations atomicly. If a patch fails, the consumer rejects the partial result and the producer must resynchronize with a snapshot.
• FACT An execution that needs external input ends with RUN_FINISHED carrying an interruption (id, motive, readable message, response schema). The producer shall not report it as success or perform the action if the interruption is not covered by the resumption.
• INFERENCE Thus, human approval ceases to be an “if” in the agent code and becomes a protocol event, with schema of response, expiration and explicit rule of non-execution — which facilitates auditing.
• FACT The required transport is HTTP with Server-Sent Events; Protobuf is optional; WebSocket is not binding default, but is allowed. Any transport shall deliver the events of an execution in an orderly and complete manner.
• INFERENCE Proxies and CDNs cannot buffer SSE; the stream needs valid token throughout the run; on unstable mobile networks, snapshots resynchronize the state.

Permission-aware retrieval in five steps: permissions as metadata of each chunk, inherited from the origin; prefilter in the index, with the identity solved by the idP and never after of the model see the content; event-oriented synchronization, with SLO; continuous leak tests with low privilege identities; overshare review before indexing.

RECOMMENDATION Never use the text of a recovered document as a rule source to execute an action: the document explains; the API decides. Transactional data goes by tool; structured content, by Content API; normative content, by RAG with filters; relationships, by graph or domain API; tacit knowledge no use — it is explained first or referred to a person.

1. Choose a domain high-volume questions (e.g. people's policies).
2. Do inventory and define canonical sources, owners and durations.
3. Build the evaluation set from the real logs.
4. Implement hybrid search with permissions and measure recovery.
5. Only then add RAG, with citations and assessment of groundedness.
6. Then connect to the agent and the tools.
7. Expand domain to domain.

Agents push the authorization of pure RBAC for combinations with ABAC and ReBAC, because the decision depends on actor, action (risk class) and context (Was there confirmation? What channel?) INFERENCE.

• RBAC: roles; good for stable permissions per function; suffers from paper explosion.
• ABAC: attributes of subject, resource, action and environment; good for contextual rules; complex auditing policies.
• ReBAC: relationships (“is manager”); requires consistent graph; the reference is Zanzibar’s paper.
• Policy as a code (OPA, Cedar): consistency between layers and policy tests; requires governance of policies.

RECOMMENDATION The point of application (PEP) mandatory is the closest to data — domain API or registration system. The former reduce the surface, but never replace the latter. OWASP recommends applying the authorization to downstream systems, and not depending on the decision of the LLM FACT. Zero Trust (NIST SP 800-207) turns: tool call with token, audience and scope of its own; no confidence for being “within the network”; short tokens; identity for runtime; agent traits in SIEM.

O execution record by task is a single artifact that serves security (forense), compliance (decision review, art. 20 of LGPD) and SRE (diagnostic). Fields: Correlation ID; subject; actor; channel; version of instructions and model; interpreted intention; consulted sources (with version); tools called (masked arguments); policy decisions; interruptions and responses; effects (protocols in the registration system). Reconstruction requires old versions of instructions and content to remain available for the audit period INFERENCE.

Explainability, here, is not explaining the weights of the model: it is telling the collaborator and the auditor which sources support the answer, which rules were applied and by whom, which data the collaborator was used and what the agent did, with which authorization. That gets a lot more direct when the rule is outside the model INFERENCE. In AI governance, the NIST AI RMF gives the risk structure, ISO/IEC 42001 serves those seeking certification and the OWASP Top 10 for LLMs is the technical checklist FACT.

Governance without stopping delivery RECOMMENDATION: automatically verifiable standards (classification of validated IC tools, leak tests, assessment suite with thresholds, policy as code); approval by risk class; review after delivery, by sampling, for knowledge responses, and review before for actions.

• Agent as initiator: collect and initiate an existing process — most transactional services.
• Agent as human stage assistant: summarizes, suggests and prepares for the human to decide — approvals, documentary analyses.
• LLM Step within the workflow: the workflow calls the model for a delimited task (classify, extract, summarize). It matches what Anthropic calls workflow (predefined code paths) and tends to be the lowest risk for regulated processes INFERENCE.
• Agent as orchestrator: decides the sequence between services — only for low risk journeys and high variability, with clear limits.

Intentions that cross domains (“I’m moving around” involves HR, benefits, facilities, IT and sheet) are journeys EXP, with named owner, implemented as orchestration workflow. The agent conducts the conversation and shows progress; never improvise the sequence Every conversation.

Use AI to compensate poorly defined process is to put an agent in front of a tacit rule, without owner or inconsistent, hoping that the model “resolves”. The result is the tacit rule applied inconsistently, now on a scale. The alternative is to use the discovery of the project to explain rules, exceptions and owners before automating; the agent can even help by analyzing calls and conversations.

The mature experience combines modes instead of exchanging everything for chat: navigation, search, conversation, structured component and proactive notification. The intention box is the preferred input, but navigation and search remain; remove menus before the agent proves resolution reduces confidence RECOMMENDATION.

• Confirmation before effect: the confirmation component is fixed and non-parametric in the essential structure — highlighted critical values, simple language, clear primary action and possibility of editing without restarting.
• Calibrated trust: cite sources with name, version and date; admit uncertainty; not simulate excessive empathy in sensitive topics.
• Handoff: explain why the case goes to a person, transfer structured context, inform queue and SLA, allow to resume the conversation.
• Accessibility: aria-live="polite" with moderation; streaming announced per step, not by token; explicit focus management when components are replaced; only certified components of the catalog; alternative paths by navigation.
• Risks of UX: opaque text box; excessive anthropomorphization; long answers when a button would suffice; inconsistency between channels; advanced users required to talk to what they did in two clicks.

The matrix compares, does not elect: necessary capabilities; technologies are alternatives to implementation.

These are not requirements: micro-frontends, Kafka, service mesh, dedicated vector bank, multi-agent, full MACH. Each makes sense in specific contexts.

Measure by intention, not by the screen: with the dynamic interface, time on the page and clicks lose meaning. Experience metrics are resolution rate, time to resolution, perceived effort, resolution shifts, editing rate in confirmations, step abandonment, scheduling and recount in 7 days. Combined with the telemetry and feeling of DEX tools, they form an independent view of the interface shape RECOMMENDATION.

1. Kill switches by tool, intent and whole agent.
2. Configuration Rollback: instructions, catalog and model version are versioned and reversed.
3. Reproduction: the execution record allows the execution of the case with the same context in test environment.
4. Communication: if there was a wrong response about a policy, evaluate to notify the affected.
5. Postincident: classify the cause by layer (content, search, model, tool, process, policy).

• Production evaluation: sampling with human evaluation; automatic evaluator calibrated by humans; periodic synthetic tests; continuous permission tests with low privilege identities; feedback analysis; canary and A/B configuration.
• Internal platform: paved paths (tool server template with delegated authentication, idempotence, telemetry and testing); catalog of tools and components with owner, version, classification and SLO; evaluation environments with simulated systems; model cost budgets per domain.
• INFERENCE Maturity: SRE and distributed observability are mature; observability and evaluation of agents are in consolidation.

HYPOTHESIS “Happiness” (high volume, clear rule, moderate risk) and “IT call” (high volume, low risk) tend to be better pilots than “dependent inclusion” (sensitive data) or “access solicitation” (security risk).

Regression signs: drop in groundedness after changing model or chunking; increase in editing rate in confirmations (the collection worsened); increase in staggering by “I did not understand”; increase in cost by intention without resolution gain; increasing average age of the quoted content (curacy stopped).

1. Choose a journey (e.g. vacation).
2. Each profile analyzes the journey through the lens itself, alone — as in the architectural board.
3. Consolidate in a responsibilities matrix between roles (the twelve lenses serves as a starting point).
4. Identify conflicts and resolve them with the standards of trade-offs.
5. Position the journey in maturity model and define the next phase of roadmap.