Usage Modes and the Platform: What Each Mode Demands · AI Platform and Security: the course

All courses / AI Platform and Security / Module 1 / Chapter 2

Learning objectives

After the lesson the participant can:

Classify a use of a large language model into one of the six usage modes by integration depth and autonomy.
Identify the platform control point for each mode.
Explain why a change of mode is a platform event that provisioning must detect.
Assess a use case against the minimum platform baseline and rank the gaps by exposure.

Key concepts

Usage mode: One of six architectural patterns of use, from Mode 0 Ambient AI to Mode 5 Autonomous production agents, ordered by how deeply the model is integrated into the organisation's data and systems and how much autonomy its output is given.
Platform control point: The place where the organisation can enforce anything in a given mode: inventory and supplier change control, identity provider and egress proxy, tenant configuration, managed policy and sandbox, the AI gateway and reference architecture, or the agent manifest, identity and stop path.
Minimum platform baseline: The floor of gateway and identity, containment, logging and evidence, and data boundary controls per mode in Table 2.2. It is a floor, not a target: the system's risk class adds controls.
Mode drift: The movement of a use case from one mode to another, for example when a prompt becomes a shared skill or an approval step is removed. Each step relocates the control point although the code gives no sign of it.
Tier: The decisive variable in Mode 1 Conversational assistants: one brand is sold both on consumer terms and on commercial terms backed by a data processing agreement, and the platform leaves only the commercial tier reachable.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Where is the control point?

Sort each use, or each drift trigger, under the platform control point of the usage mode it belongs to or leads to.

Interactive exercise 2 · Put in order

Mapping use cases to control points

Put the steps of the chapter's practical guide in the order in which it gives them.

Teaching plan

10 min	The teacher contrasts a browser chat service with an agent that changes claims records overnight and asks what each requires of the platform.
20 min	Present the six modes and Table 2.1, then the five capabilities with the chapter's documented vendor examples of defaults that the platform has to override with a managed policy.
10 min	Discuss the drift paths and the Hansa Mutual example where provisioning withheld a route when UC-2026-014 moved from Mode 4 to Mode 5.
30 min	Exercise: participants build a small usage-mode register and mark each entry against the baseline; groups compare their ranking of gaps.
5 min	Summarise: Hansa Mutual needs every row of the baseline, Nordvik Region needs the upper rows done well.

Discussion

Which use in your organisation has already drifted to a higher mode than the one it was approved in, and what was the trigger?
The organisation can prove only what crosses infrastructure it runs. What can you prove today about Modes 1 and 2, and what can you not?
Nordvik Region permits no Mode 5 and restricts Mode 3 to its platform team. What does an organisation gain and give up by deferring the hardest containment problems in this way?

Written exercise

Exercise · 30 minutes

Map use cases to their platform control point

List five uses of large language models in your own organisation, at least one in Mode 3 or higher. For each, record the usage mode, the control point from Table 2.1 and the identity it acts with. Then mark each cell of the mode's row in Table 2.2 as met, partly met or missing, and say what evidence would show it. Order the gaps by exposure as the practical guide does: Mode 5 agents without a dedicated identity or tested stop path first, then Mode 3 tools without a fail-closed sandbox, Mode 4 calls that bypass the gateway, and consumer-tier Mode 1 use with personal data.

Deliverable: A usage-mode register of five entries with control point, baseline status per cell and a ranked list of gaps with a named owner for each.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

What is the platform control point for Mode 2 Embedded workplace assistants?
Show the answer
C. The tenant configuration: permissions, sensitivity labels, grounding scopes and audit settings
In Mode 2 the assistant acts with the user's permissions inside the office suite, so the control point moves into the tenant.
On what does it depend whether a system is a high-risk AI system, according to the chapter?
Show the answer
A. On its use under Article 6 and Annex III of the AI Act, never on its usage mode
The chapter states that ranking job applicants with a chat tool is still high-risk: classification follows the use, and the platform duties follow the use as well.
When Hansa Mutual's claims-triage entry UC-2026-014 moved from Mode 4 to Mode 5, what did provisioning do?
Show the answer
D. It withheld the gateway route until the agent had its own identity, manifest, stop-path test and market-bound token
The mode baseline is a policy file that provisioning reads, so the Mode 5 requirements had to be met before the new route was issued.