Working notes on enterprise agent architecture, governance and the engineering underneath.
Models that return a label from a fixed set, with probabilities, are easier to route, test and afford than free text. They are still model judgments. Calibration, abstention and routing are your design work, and the authority check sits outside the model.
A single model call, a fixed workflow and an agent loop are three different designs with three different cost profiles. Choose by whether the path can be known in advance, and keep authority outside all three.
Traces show that each step succeeded. They don't show whether the steps formed an acceptable process. Mining agent runs against invariants does.
A graph can connect enterprise meaning, source evidence and agent history. The harder design is deciding what an agent may read, what may become shared memory, and what may cause an effect. This article introduces the Contextual Agentic Graph (CAG), a proposed CAE design pattern, and shows where its boundaries sit.
Open-weight models give an enterprise real and specific control: where inference happens, what the model is adapted on, what the unit economics look like, and whether the system still runs when the network does not. They do not transfer the supply chain, the regulatory obligation, the evidence or the contestability of knowledge. Those remain the enterprise's work.
Durable execution keeps a workflow alive across interruption. It does not keep it authorised. Four engineering objections to the architecture, and what actually answers them.
Most enterprise AI programmes begin with a model question. The question that decides whether the initiative becomes useful and trusted is what the system is allowed to know, decide and do — and how anyone will prove it acted appropriately.
TOGAF, COBIT, ITIL, SAFe, programme management and enterprise risk each answer a real question about the enterprise. So do the AI management standards, and so do the vendor agent platforms. None of them answers the one that decides whether an agent should have acted.
Most agentic programmes pick a model, write a prompt, add retrieval, and write the evaluations last — by which point the evaluations can no longer change the design. Reversing the order gives an architect something better than an opinion: gates that show whether a model swap, a prompt change or a new retrieval strategy measurably improved the system.
Agent cost is mostly input re-read on every turn. Multi-agent designs may read more tokens yet cost less per result, so budget each task and measure cost per successful task.
Prefill is compute-bound, decode is bandwidth-bound and the KV cache fills scarce GPU memory. That is why cached prefixes, small windows and short outputs make agents faster and cheaper.
A/B tests assume a stable treatment, independent units and an observable outcome. Agents break all three, and the failures you fear are too rare to test for.
Enterprise AI assurance is argued at the model boundary. The real control point is the integration layer, where the system asks to change something real.
An agent that reads untrusted content will one day be fooled. Security comes from six boundaries enforced in code, so a persuaded model still cannot do harm.
A multi-agent design is portable; product names are not. Map categories first, then ask of every control feature whether it enforces or only records.
The popular AI tool maps list a hundred products in two planes: what the agent knows and what it can do. The plane that decides what it may do is usually missing.
A multi-agent demo has three boxes. Production has ten layers, each owning one job and failing in one familiar way. Most incidents start in a layer nobody owned.
Minutes saved on a task are not roles removed from an organisation. Measure outcomes with quality, then redesign human work around authority, exceptions and evaluation.
LLM, RAG, agent, agentic system: every popular diagram stops at four rungs. The enterprise needs a fifth, where authority is checked before anything changes.
An agent is neither a user nor a service account. Zero Trust still applies, but it has to verify the agent, the principal and each action, and treat content as influence, never authority.
Enterprises know how to run a shared engine in front of valuable data: attributed connections, filtering by who is asking, audit, pinned versions and a named operator. Many estates quietly gave the model the database's job instead, and a model holds nothing addressable and enforces nothing. Keep knowledge and rules where they can be enforced.
Relationship questions, exact-token questions and paraphrase questions need three different retrievers. A small router, entitlement filters inside the query and a fusion step do more than a bigger model.
Policies, approval screens and audit logs describe governance. Only a control on the execution path enforces it, and every consequential action must pass through one.
Dependency checks, secret scans and static rules usually run in CI, after a pull request exists. That placement was built for diffs written at human speed. An agent can be wrong and already be on its next task before the queue starts. Move the same rules to the point before the change is proposed.
When agents produce most of the code, the bottleneck moves from typing to context and verification. Five things shift: the artifact, the review, the tests, the roles and the bottleneck, and the evidence for each is thinner than the slogans suggest.
The Agent2Agent protocol standardises how agents find each other and exchange tasks. It does not decide whom you trust or what a remote agent may cause. That decision belongs at a boundary you own.
A model's explanation is not an audit record, and logs are not a reconstruction. An Evidence-First Decision Record keeps claims, evidence and versions retrievable long after everything has changed.
Don't try to make the model deterministic or simply trust it. Let it propose, and put identity, authority, schema, state and commitment in a shell that decides at the Commit Boundary.
Most context failures are not retrieval misses. They are correct material given to the wrong purpose. A Context Contract declares, versions and tests what an agent may know.
Splitting one agent into five does not add a team. It adds a distributed system. Each boundary has to earn its coordination cost, or it should be a function.
Directors ask whether their AI is safe. The better question is on whose authority it acts, because accuracy, confidence and technical access are not a delegation.
Letting a service desk assistant reset MFA is not phase two of the same programme. Once an agent can change state, the question becomes what it may change, and on whose authority.