Enterprise Agent Architecture: What the Industry's Production Systems Reveal About Control
By M. Mahmood | Strategist & Consultant | mmmahmood.com
TL;DR / Summary
Three industry events from the past year tell executives everything they need to know about enterprise agent architecture. In November 2025, Anthropic disclosed that a state-sponsored group had manipulated agents into executing 80 to 90% of a cyber espionage campaign, with humans intervening at only four to six decision points per intrusion. In December 2025, the Linux Foundation launched the Agentic AI Foundation, with Anthropic, OpenAI, and Block donating their core agent protocols and AWS, Google, Microsoft, Cloudflare, and Bloomberg signing on as platinum members. And in 2026, Salesforce reported that Agentforce passed 1.5 billion dollars in annual recurring revenue, with accounts running agents in production up 70% in a single quarter. The components of agent architecture now work well enough to attack enterprises, to sell at scale, and to standardize. The only open question is whether your organization designs its control system or inherits one.
The money at stake clarifies the urgency. Gartner projects worldwide AI spending will rise 49.5 percent to 2.7 trillion dollars in 2026, while the same firm warns that more than 40 percent of agentic AI projects will be cancelled by the end of 2027 due to escalating costs, unclear value, and inadequate risk controls. The gap between adoption and cancellation is where architecture decisions will be made.
What belongs in enterprise agent architecture?
Enterprise agent architecture comprises the execution and control mechanisms around a model. Most discussions cover five: the loop, chaining, context, identity, and the harness. Production deployments and the industry's incident record reveal three more that are equally decisive: the isolation boundary that contains what agents can touch, the measurement layer that shows what they actually did, and the supply chain that vets what enters the estate.
| Component | Responsibility | Industry evidence base |
|---|---|---|
| Agent loop | Determines what starts work, how it repeats, and when it stops. | Managed loops in OpenAI's Agents API, Copilot Studio, and Anthropic's loop taxonomy. |
| Agent chaining | Transfers assignments, results, and task status between components. | Google-originated A2A protocol; multi-agent orchestration GA in Copilot Studio; measured multi-agent results from Anthropic. |
| Context platform | Retains evidence and supplies relevant, authorized information. | The Agent Skills standard across 70-plus platforms; production session-store architectures. |
| Agent identity | Authenticates acting software and preserves attribution through delegation. | SPIFFE workload identity; Uber's production token architecture; NIST design tenets. |
| AI agent harness | Runs the model loop, routes tools, and manages execution behavior. | Microsoft's cross-product Copilot harness; Anthropic's Managed Agents redesign. |
| Security and sandboxing | Contains what agent code and tools can reach. | OWASP Top 10 for Agentic Applications; Cloudflare's isolate-based sandboxing; NIST's agentic security work. |
| Observability and evaluation | Records what agents did and measures whether outcomes match intent. | OpenTelemetry GenAI conventions; Ï„-bench final-state evaluation published at ICLR. |
| Tool and skill supply chain | Governs which tools, servers, and skills agents may discover and use. | The MCP Registry; the Agent Skills ecosystem; ACM-published research on skill vulnerabilities. |
Each row cites a shipping product, a released specification, or a documented production system. The sections below examine them in turn.
How has the industry standardized the agent loop?
Every major platform now ships a managed loop with explicit triggers and stopping conditions. Anthropic's loop-engineering guide names four types: turn-based, goal-based, time-based, and proactive. OpenAI's agent documentation separates three control levels, from the managed Agents API down to the Responses API for direct control. Microsoft has rolled multi-agent capabilities in Copilot Studio to general availability, including autonomous triggers that start work without a user prompt.
The executive control question is identical across all three: who declares the trigger, who sets the stopping condition, and what happens when the limit is reached. The GTG-1002 report documented the failure mode, where attackers tasked agent instances as autonomous orchestrators sustaining request rates no human team could match.
What do the industry's chaining standards actually deliver?
Agent chaining has moved from framework-specific plumbing to vendor-neutral standards in under a year. The A2A protocol, originated at Google and now openly governed, released version 1.0 with signed Agent Cards and a stateful task lifecycle, while documenting that cancellation is attempted rather than guaranteed and message submission is not universally idempotent. The MCP authorization specification requires token audience binding and forbids passing client tokens through to upstream APIs.
The measured economics come from Anthropic's production Research system, where parallel subagents outperformed a single agent by 90.2% on internal evaluations at roughly fifteen times the token consumption of ordinary chat. Salesforce's filings add the commercial side, with billions of Agentic Work Units delivered across tens of thousands of paid deals. Approve chaining where independent investigation or separation of authority measurably beats a simpler workflow, as the distinction between automation, AI workflows, and agents explains, and design integrations with the discipline set out in A2A and MCP for enterprise integration.
How should enterprises govern agent context as the standards consolidate?
The Agent Skills format, a folder of instructions and resources that gives agents procedural knowledge, was published openly in December 2025 and donated to the Agentic AI Foundation in October 2026, with more than 70 integrated platforms, one million published skills, and nearly 280 million installs reported. Portability cuts both ways: skills travel across vendors including ChatGPT, GitHub Copilot, and Cursor, which reduces lock-in while raising the stakes of vetting third-party instructions, a risk pattern the analysis of model access and platform dependency examines in detail.
On the evidence side, production architectures now separate the durable session record from the model's working context, storing events outside the harness so summarization cannot silently discard information, and passing large outputs as external artifacts by reference. The purchasing question that follows, extending the analysis of agent memory management, is blunt: where does the evidence live after the conversation ends, and can you export it?
What does production-grade agent identity look like?
Uber's published architecture builds on SPIFFE workload identity, the CNCF standard for cryptographically verifiable workload credentials, and adds a Security Token Service that verifies agent registration, issues short-lived destination-scoped tokens, and preserves the actor chain from the originating employee through every delegated hop. Uber reports thousands of internal agents on this fabric with token-exchange P99 latency below 40 milliseconds under its own conditions.
The risk frameworks have caught up with the deployments. The OWASP Top 10 for Agentic Applications, released in December 2025 and built from real incidents, ranks identity and privilege abuse among the top agentic risks. NIST's October 2026 design tenets recommend distinct agent identities, narrowing delegation, zero standing privilege, and short-lived revocable access. Attribution must survive every delegation, which is the architectural expression of the board-level AI governance checklist.
Why has the AI agent harness become the strategic control plane?
The harness, the software that runs the agent loop and supervises execution, has become the layer vendors fight hardest to own. On October 28, 2026, Microsoft announced the Microsoft Copilot harness, extending what began as the GitHub Copilot harness into a shared foundation across Copilot Code, Copilot Studio, the CLI, and VS Code, now available through Microsoft Foundry for multi-model, long-running agent work. Anthropic's Managed Agents redesign separated session store, harness, and sandbox so failed components can be replaced independently, keeping credentials outside the execution sandbox and reporting roughly 60 percent lower median time-to-first-token as a result.
Whoever owns the harness owns the enforcement points: which tools are reachable, where credentials live, what gets logged, and how failures recover. Evaluate harnesses on isolation, credential handling, recovery behavior, and trace export rather than developer experience, and beware the dependency dynamics described in the AI co-innovation trap, where free platform help becomes a permanent tax on your P&L.
Where does the isolation boundary belong?
Sandboxing determines what agent-generated code and tool calls can reach, and the industry now treats it as a first-class component rather than an infrastructure detail. Cloudflare's Dynamic Workers run agent-generated code in lightweight isolates with configurable network restrictions, positioned at request-level economics so that a fresh execution environment costs no more than the request it serves. The GTG-1002 investigation showed the boundary's value from the other direction: the campaign was contained in part because tool access and human checkpoints limited what the manipulated agents could complete.
The boundary must cover data semantics as well as compute. Agents acting on inconsistent entity definitions across systems can compound small semantic errors into operational damage, which is why the analysis of agentic AI data quality, ontology, and confidential computing argues that trusted execution environments and semantic discipline must precede scaled agent deployment, not follow it.
What can you not govern if you cannot see?
Observability and evaluation form the measurement layer, and both are standardizing. The OpenTelemetry GenAI conventions define vendor-neutral trace spans for agent runs, model calls, and tool executions, so any backend can read an agent's behavior; the gen_ai attributes remain in Development status, which argues for instrumenting now with an abstraction layer rather than waiting for stability. OpenAI ships agent evaluations alongside its AgentKit tooling, and Anthropic publishes harness-level evaluation guidance, a signal that vendors now treat measurement as part of the product rather than an afterthought.
The methodological anchor comes from Ï„-bench, published at ICLR 2025, which evaluates agents by comparing final database state against intended goals across repeated trials, on the documented finding that a correct-sounding response does not establish that records changed correctly or consistently. Enterprises that cannot see their agents face a second, quieter version of the same problem: unmeasured usage becomes unbudgeted spend and unvetted behavior, the dynamic at the center of why shadow AI is a strategy problem.
Who vets what enters the agent estate?
The supply chain is the newest component and the one with the sharpest research evidence. The MCP Registry, launched in preview in September 2025, provides an open catalog of MCP servers with support for private sub-registries, giving enterprises a control point for which tools agents may discover. The Agent Skills ecosystem adds a second surface, with a million published skills that agents can load as procedural knowledge.
The first large-scale empirical study of that surface found it wanting. An ACM-published analysis of 17,022 agent skills identified 520 skills containing 1,708 security issues, with 89.6 percent of leaked credentials immediately exploitable and nearly three-quarters of the vulnerabilities caused by debug logging that fed secrets into model context. A registry and a vetting process are no longer optional infrastructure; they are the difference between a governed estate and an unpatched one.
What does the deployment evidence say about who wins and who cancels?
The deployment data now shows both outcomes at scale. Salesforce's latest reported quarter shows Agentforce ARR above 1.5 billion dollars with production accounts up 70 percent sequentially, while OpenAI documents customers such as Klarna handling two-thirds of support tickets with an agent. On the cancelling side, Gartner's forecast attributes the 40 percent failure rate to escalating costs, unclear business value, and inadequate risk controls, exactly the three failure modes the eight components govern.
| Acceptance test | Required evidence |
|---|---|
| Business outcome | Final records match the approved target state, measured the Ï„-bench way rather than by narrative output. |
| Loop governance | Every agent maps to a declared loop type with documented triggers and stopping conditions. |
| Delegation and identity | The originating requester and participating agents remain attributable across each handoff. |
| Isolation | Agent code executes in bounded environments with explicit network and data restrictions. |
| Observability | Agent runs emit portable traces of model calls, tool executions, and costs. |
| Supply chain | Tools and skills enter only through a vetted registry with documented provenance. |
| Recovery and idempotency | Interrupted execution resumes without duplicating consequential actions, given A2A's documented limits. |
| Economics | Total cost includes coordination, review, retries, and shared infrastructure, benchmarked against the fifteen-fold token multiplier multi-agent systems can carry. |
Assign the resulting bill and benefit to a named owner using the AI cost allocation framework. The programs that survive the Gartner filter will be the ones that pass this table before scaling.
Conclusion: the industry has converged, the decision is yours
Pull the evidence together and the conclusion is unambiguous. The components work: a hostile actor proved that by running most of an espionage campaign through agent loops, chains, and tool access. The standards exist: MCP, A2A, AGENTS.md, SPIFFE, Agent Skills, OWASP's agentic taxonomy, and OpenTelemetry conventions now sit in open governance or public release. The vendors have placed their bets: Salesforce books agent revenue at billion-dollar scale, Microsoft has made the harness a company-wide layer, and every major lab co-funds the same foundation. And the failure mode is documented: Gartner's 40 percent cancellation forecast describes programs that skipped exactly the controls the winning deployments share.
Enterprise agent architecture is therefore no longer a technology selection exercise. It is the decision about whose instructions your agents obey, whose evidence you can produce, and whose costs you can defend. Declare the loop and its stopping condition. Keep identity attributable through every delegation. Govern context as evidence. Evaluate the harness on isolation and recovery. Bound what agent code can reach, instrument everything agents do, and vet every tool and skill before it enters the estate. The organizations that make these decisions deliberately will join the deployment data on the winning side; the rest will join the cancellation statistics. For support making the call, MD-Konsult's strategy consulting connects technical assessment with operating-model decisions, and the AI Strategy Book develops the commercialization framework further.
FAQ: enterprise agent architecture
Does using open standards like A2A and MCP make an agent chain safe?
No. The standards make interactions explicit and governable, but A2A's own documentation states cancellation is attempted rather than guaranteed and message submission is not universally idempotent. Safety still requires application-level controls for duplicates, incomplete cancellation, and authorization, plus a vetted tool supply chain and measured outcomes.
Which vendor's harness should an enterprise standardize on?
Evaluate the layer, not the logo. Microsoft's Copilot harness, Anthropic's Managed Agents, and OpenAI's managed harness each bundle different assumptions about isolation, credentials, and recovery. Standardize on the one whose enforcement points you can inspect, whose traces you can export, and whose failure behavior you have tested, because the harness decision is a control decision.
What are the most commonly skipped components?
The three most neglected are the isolation boundary, the measurement layer, and the tool and skill supply chain. The ACM study of 17,022 agent skills, which found over 500 skills carrying exploitable issues, shows what happens when the supply chain is skipped, and Gartner's cancellation data shows the cost of skipping measurement.
0 Comments