Add three-plane composition pattern

IMPLEMENTATION_PATTERNS.md

@@ -548,6 +548,53 @@ The five core elements do not operate in isolation. Effective ATF implementation
 | Observability | All Elements | Provides visibility, triggers, and audit trail |
 | Incident Response | Behavior | Incidents inform demotion decisions |
 
+### Pattern: Three-Plane Composition for Verifiable Agent Actions
+
+High-assurance agent systems often need more than one receipt or log entry.
+A complete forensic record separates three questions that are related but not
+identical:
+
+| Plane | Question answered | Typical evidence | Primary ATF links |
+|-------|-------------------|------------------|--------------|
+| Delegation plane | Whose authority allowed this agent to act? | Signed delegation, scoped capability, authority-chain root | Identity, Segmentation, Incident Response |
+| Decision plane | What did policy allow or deny at evaluation time? | Signed policy decision receipt, policy digest, evaluated constraints | Behavior, Segmentation, audit trail |
+| Execution plane | What actually went out to the downstream system? | Signed execution proof, request/response commitment, trace/span reference | Behavior, Data Governance, Incident Response |
+
+These planes should compose by content-hash reference rather than by re-signing
+or mutating another plane's artifact. Each layer keeps its own trust boundary,
+while auditors can walk the references to reconstruct the action.
+
+```mermaid
+flowchart LR
+    A[Delegation plane\nwhose authority?] -->|authority root hash| B[Decision plane\nwhat policy allowed?]
+    B -->|decision receipt hash| C[Execution plane\nwhat actually happened?]
+    C -->|execution proof hash| D[Audit / incident review]
+    A -. independent verifier .-> D
+    B -. independent verifier .-> D
+    C -. independent verifier .-> D
+```
+
+Implementation guidance:
+
+- The delegation plane should prove scoped authority and revocation status for
+  the actor at the time of the decision.
+- The decision plane should bind the evaluated policy, input or argument hash,
+  and allow/deny/escalate outcome.
+- The execution plane should bind the actual downstream request/response or a
+  privacy-preserving commitment to them.
+- Cross-plane links should be hashes of canonical artifacts, not copied mutable
+  fields.
+- Verifiers should report which plane failed: delegation invalid, policy
+  mismatch, execution mismatch, or broken reference. These imply different
+  incident workflows.
+
+Illustrative implementations discussed by the community include APS-style
+delegation chains for the delegation plane, Veritas Acta / ScopeBlind decision
+receipts for the decision plane, and proxy or gateway execution proofs for the
+execution plane. The pattern does not require adopting all three at once; the
+hash-reference boundary lets organizations adopt one plane while preserving a
+path to later composition.
+
 ### Common Integration Failures
 
 | Failure | Symptom | Resolution |
@@ -556,6 +603,7 @@ The five core elements do not operate in isolation. Effective ATF implementation
 | Behavioral monitoring siloed | Anomalies detected but not acted upon | Connect monitoring to incident response |
 | Data governance separate from segmentation | Data boundaries not enforced | Unify data and resource policies |
 | Observability incomplete | Gaps in audit trail | Ensure all elements log to central platform |
+| Planes collapsed into one artifact | A valid signature hides missing authority or mismatched execution | Separate delegation, decision, and execution evidence; link by canonical hash |
 
 ---