The decision catalog

Each entry is a challenged defaultChallenged default. A technology choice most people treat as obvious, re-examined here against the simplest credible alternative on evidence and cost.: a hyped or habitual technology choice the research contested, resolved by evidence and economics rather than adoption momentum. Each record holds the question, the verdict, the discriminator that decides your case, and the register status in the research vocabulary. The statuses are converged, supported with reframe, split, conditionally approved, and position. This catalog records technology decisions; the programme's own decision log is at /library/decisions.

The records

CD-1. Graph database vs embedding retrieval

In short: Use ordinary search plus meaning-based search for most questions; add a graph only to follow exact relationships.

Verdict: routed hybrid, vector-first. Keep a canonical raw and event store. Combine lexical search with contextual dense embeddingsEmbedding. A numeric fingerprint of a piece of text that lets a computer find similar meaning quickly. Embeddings are derived data and inherit the protections of what they came from. (numeric fingerprints of text that let a computer find similar meaning). Where content is aspect-rich, keep multiple purpose-specific views. Rerank over candidates. Treat topics as versioned, regenerable navigation metadata. Add a selective, provenanceProvenance. The record of where a piece of information came from, carried with it so every answer can be traced back to its source.-linked graph only for deterministicDeterministic. Always gives the same answer for the same input by following fixed rules. The opposite of probabilistic, where the answer can vary. relationship traversal: lineageLineage. The chain of steps data went through to reach its current form., dependency and impact, authorisation paths, temporal validity, transactional shared state. Edge hygiene if you do: every generated edge carries a source-span identifier (ID), extraction model and version, confidence, and a validity interval. The measured spreads justify routing rather than picking a side. Graph-augmented retrievalRetrieval. Finding the few relevant pieces of company information for a task and placing them in front of the model. wins multi-hop benchmarksBenchmark. A public test used to compare models or agents. Useful for orientation; scores can be gamed, so they are claims rather than measurements. while costing an order of magnitude more to build, and dense-plus-graph beat either alone. Rejected outright: graph-only memoryAgent memory. What an agent keeps between tasks, from the current conversation up to long-term knowledge about customers or assets. The longer it is kept, the more privacy and retention duties it carries., vector-only without lexical and raw sources, topic summaries as source of truth, and fine-tunedFine-tuning. Adjusting a model's internal weights with examples. Slow, hard to undo, and rarely the right first step. weights as factual memory. Status: converged. Owner: R14, R02.

CD-2. Dedicated MCP gateway vs extending API management

In short: Use the API management tools you already own for agent traffic; buy a dedicated gateway only for controls they lack.

Verdict: extend the incumbent by default. The incumbent is the application programming interface (APIAPI. A defined way for software to talk to other software. Agents reach systems through governed APIs rather than through screens.) management platform you already run. The 2026-07-28 Model Context Protocol (MCP)MCP (Model Context Protocol). An open standard for connecting agents to tools and data, like a universal plug. An MCP gateway is the governed version of that plug. specification was deliberately redesigned to be routable and authorisable by ordinary Hypertext Transfer Protocol (HTTP) gatewaysGateway. The single door every agent request passes through on its way to a tool or model. Because everything goes through it, it is where rules are enforced and activity is recorded.. Every incumbent shipped support within a year. Choose a dedicated gateway for agent-specific controls that incumbents do not model well: tool-description diffing and poisoning scans, multi-runtime federation, and elicitation mediation. Status: conditionally approved, converging. Owner: R03.

CD-3. Replace RPA vs coexist

In short: Keep the old screen-clicking bots for mechanical steps, let agents handle judgement, and retire bots only when a proper interface arrives.

Verdict: coexist, supervised. Robotic process automation (RPA)RPA (robotic process automation). Older software bots that click through screens on fixed scripts. Kept alongside agents rather than replaced on day one. bots stay the deterministic execution layer for systems without APIs; agentsAgent. Software that uses an AI model to work toward a goal on its own: it reads, decides the next step, uses tools, and keeps going until the job is done or a limit stops it. reason and handle exceptions above them. Replacement is earned per workload when a governed API arrives, never declared estate-wide. Status: converged. Owner: R03.

CD-4. Agent-to-agent protocols now

In short: Standards for agents talking directly to other agents are not worth adopting yet, except across company boundaries.

Verdict: not yet for most. The standard consolidated and stabilised, but published milestones are organisation counts rather than production evidence. Teams approximate coordination with toolTool. A function an agent can call to do something real: look up a record, send an email, run a query. Tools are where agents touch your systems.-protocol primitives. Adopt selectively for cross-organisation agent federation, where nothing else fits. Status: position, re-verify quarterly. Owner: R03.

CD-5. Modernize the ESB first vs bypass

In short: Do not wait for the old integration bus to be modernised; govern what agents use and replace the rest gradually.

Verdict: strangle, do not wait; govern before you wrap. To strangle an enterprise service bus (ESB)ESB (enterprise service bus). An older central integration system that many companies still run. is to replace it one slice at a time while it keeps running, instead of waiting for a full modernisation. Of modernisation programmes, 74 percent fail to complete. Incumbent gateways expose governed APIs as tools with zero backend change. The discipline: govern the specific API paths agents will use before exposing them, and let each strangler increment retire real load. Status: converged. Owner: R03.

CD-6. Self-hosted GPU estate vs metered APIs

In short: Pay per use for AI models rather than running your own GPU fleet, unless the work must stay isolated.

Verdict: metered by default; the cost path is open-weight via metered APIs, not self-hosting. Open-weight models are models whose weights are published for anyone to run. Break-even for self-hosting sits at sustained nine-figure tokenToken. The unit AI usage is measured and billed in, roughly three-quarters of a word. volumes per month per workload at high utilisation, with operations multipliers of 1.3 to 2 times. At 10 percent utilisation, cost per token rises roughly tenfold. Against budget open-weight API pricing, break-even recedes to billions of tokens per month. Self-hosting earns its place for air-gap and classificationClassification (data). A label for how sensitive data is. Anything derived from data inherits the strictest label of its sources., not for generic residencyData residency and sovereignty. Rules about which country or region data may be stored and processed in, including the copies created for agents.. Status: refined by evidence. Owner: R01.

CD-7. Kubernetes everywhere vs managed agent runtimes

In short: Use Kubernetes only for model servers you host yourself; run the agents themselves on a managed service.

Verdict: split by layerLayer (the fourteen layers). One of fourteen parts of the enterprise estate that agents touch, from infrastructure (R01) to agent data engineering (R14).. ModelModel. The AI engine that reads and writes text. On its own it has no access to your systems; everything built around it decides what it may do. serving belongs on Kubernetes only if you self-host at all. Agent orchestrationOrchestration. Coordinating several agents or steps so they work together on one job. Useful for breadth; it does not make any single step smarter. belongs on managed runtimesAgent platform. The software that runs agents: the runtime, the harness, the list of approved agents, and the rules for how they start, stop, and change. with per-session isolationSandbox. An isolated environment where agent code runs with limited access to the network and the rest of the machine, so mistakes and attacks stay contained. and durability. The lock-in is symmetric: managed runtimes are proprietary control planes, and the portability camp sells its own ecosystem. Status: position with strong support. Owner: R01, R07.

CD-8. Semantic-layer product vs governed views

In short: Whether to buy a shared-definitions product depends on how each use case fails, not on small accuracy differences.

Verdict: per use case, chosen by failure mode. The load-bearing property is failure-mode conversion: governed semantics turn silent wrong answers into refusals or deterministic answers. Benchmarks show large gains on modelled scope with partial coverage. A disciplined counter-camp reaches comparable accuracy through data modelling alone. The binding variable is curatedCuration. Preparing data for a specific purpose before agents use it, with a named owner responsible for its quality. business context, and a semantic-layerSemantic layer. A shared set of business definitions (what counts as revenue, or an active customer) that keeps agents and reports using the same meaning. product is its most governable packaging. Status: split, both camps published. Owner: R02.

CD-9. Dedicated vector database vs the simplest substrate

In short: Start with the simplest storage that handles your data volume, and move up only when measurements show strain.

Verdict: climb the ladder. Use brute force below roughly 100,000 vectors. Use pgvector up to the low millions. At 1 million vectors it answers in under 20 milliseconds with recall above 95 percent. Build pain starts at roughly 2 million, and partitioning is needed at 5 million and above. Use scale-out Postgres extensions to roughly 50 million. Use a dedicated vector databaseVector index. A database of embeddings built for finding similar meaning fast. The storage behind most retrieval. engine for extreme scale, heavy write rates, or filter-heavy multi-tenancy, where the 99th-percentile (p99) latencyLatency. How long a request takes to come back. gap becomes real. Platform-bundled vector search is table stakes: prefer it where the corpus already lives, because governance and access control list (ACL)ACL-aware retrieval. Retrieval that checks the requester's permissions before returning information, so an agent cannot surface documents its user could not open. inheritance come free. Vendor viability belongs in selection. Status: converged. Owner: R02.

CD-10. Data mesh vs governed central substrate

In short: Let business units own their data, but keep the shared store and its permissions central and governed.

Verdict: mesh ideas on a governed substrate. Every shipped ACL-sync architecture assumes a governed central index. Pure mesh multiplies permission sync, definitional consistency, and freshness monitoring, which are exactly what agents punish. Keep domain ownership as an operating idea; keep the substrate governed and central. Status: converged. Owner: R02.

CD-11. One universal index vs use-case-scoped

In short: Run one permission-aware search across everything for discovery, and separate purpose-built collections where mistakes are costly.

Verdict: two layers. A permission-aware universal index for discovery and cross-silo questions, plus purpose-scoped curated indexes (or scoped routing over the universal one) for high-stakes tasks. The trade is formalised as coverage versus trust, and even the largest universal-index vendors shipped scoping controls as mitigation. Status: converged. Owner: R14.

CD-12. Real-time vs batch grounding

In short: Keep agent data fresh by copying each database change as it happens; buy real-time streaming only where decisions cannot wait.

Verdict: CDC is the default; streaming is earned. Change data capture (CDC)Change data capture (CDC). Streaming each change in a database as it happens, so copies, including agent indexes, stay current. delivers minutes-level freshness for groundingGrounding. Making an agent answer from trusted company sources it can point to, and refusing when the evidence is weak. at near batch cost; a documented like-for-like comparison ran $400 against $7,600 per month. Streaming is justified by decision cadence (fraud, operational triage), not by default. Status: converged. Owner: R02.

CD-13. Dedicated AI security platforms vs SIEM extension

In short: Buy AI security inside the platforms you already run, but know that spotting abnormal agent behaviour is still unsolved.

Verdict: the market resolved toward platform absorption; buy accordingly, but absorption is not parity. Six AI-security acquisitions in roughly fourteen months, plus two non-human-identity deals, moved the capability inside platforms. The honest gap: behavioural baselining of agents remains unsolved in mainstream security information and event management (SIEM)SIEM. The security team's central system for collecting and analysing security events. systems, and guardian agents persist as a distinct runtime category. Status: refined. Owner: R10.

CD-14. Broad vs narrow AI Act classification

In short: Do not bet on a broad or narrow reading; keep basic records for every agent and full records for high-risk ones.

Verdict: neither pole; a risk-tiered evidence posture. Two currents pull on EU AI ActEU AI Act. The European Union's AI regulation. Most duties fall on high-risk uses; this guide keeps an evidence floor for every agent and deeper records for the tier that could classify as high-risk. classification. The legal (de jure) current tilted narrow, through deferrals. The interpretive current tilts broad, through draft classification tests and the multi-purpose presumption. Enforcement capacity is thin. Run an evidence floorEvidence floor. The minimum records every production agent keeps: a registry entry, action logs, named oversight, and traceable sources. for every production agent, and Article 12-grade instrumentation (the Act's record-keeping article) for the plausibly high-risk tier. Re-verify at every regulatory milestone. Status: position, dated. Owner: R11.

CD-15. APM extension vs dedicated LLM observability

In short: The extend-or-buy monitoring question has largely disappeared because the specialists were bought up; choose on standards, testing depth, and self-hosting.

Verdict: the question dissolved. The observabilityObservability. Being able to see what agents did, step by step, from records the agent cannot alter. category merged. Choose on the real fault lines. The first is an OpenTelemetry (OTel)-native pipeline versus a proprietary software development kit (SDK); both need a translation layer while the conventions stay unstable. The second is evalEval (evaluation suite). A set of test tasks with known right answers, written by people who know the work, used to check an agent before and after any change.-loop depth versus infrastructure correlation. The third is self-hosting. Most enterprises land on the application performance monitoring (APM) incumbent plus one eval-capable tool. Status: dissolved by consolidation. Owner: R12.

CD-16. Guardrail products vs deterministic gates

In short: Fixed rules decide whether an agent may act; AI-based filters can warn but must never grant or deny.

Verdict: deterministic gates own the authorisation boundary; guardrails are advisory wherever they run. In published tests, roughly 72 to 77 percent of attacks got past major commercial guardrailsGuardrail. A filter that uses an AI model to catch bad inputs or outputs. Useful as an early warning, but not reliable enough to be the thing that grants or denies an action., and up to 100 percent in some configurations. The one guardrail measured at 0 percent bypass cost 16.22 percent false positives and roughly 1.5 seconds of added latency. Policy enginesPolicy decision point. The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it. decide in under a millisecond. Status: converged. Owner: R10.

CD-17. Embedded vendor agents vs external agents through governed APIs

In short: Use the vendor's built-in agent when work stays inside one product; use your own agents when work spans systems.

Verdict: decided by authority boundary, and nobody has measured the head-to-head. Inside one system, both paths now enforce identical permissions (stated parity), so choose on model control, the cost meter, and the customisation ceiling. Across systems, no vendor's permission plane is authoritative and entity resolutionEntity resolution. Working out that records in different systems refer to the same real customer, asset, or case. binds, so external orchestration is a requirement rather than a preference. Generic benchmarks show up to fiftyfold cost variation at similar accuracy; the harnessHarness. The engineering shell around the model: what goes into its working memory, which tools it can call, when it must stop, how much it may spend, and how it recovers when something fails. matters more than the badge. Status: reframed. Owner: R04.

CD-18. Brokered OT read paths vs unidirectional architectures

In short: For plant and grid systems, the design depends on whether agent output could ever affect a physical control.

Verdict: consequence class decides the control point; transport is downstream. This record covers operational technology (OT)OT (operational technology). The systems that run physical equipment: plants, grids, vehicles. Safety rules keep AI out of the control loop., the systems that run physical equipment. If any output can reach or influence a control action: unidirectional or push-based architectures, plus a documented path back to manual or deterministic control. If output is confined to alerts, recommendations, and data-quality findings, a brokered read path is defensible. It needs per-agent identityAgent identity. A registered account for an agent with a named owner, limited permissions, and credentials that expire, so every action can be traced to who asked., least privilegeLeast privilege. Giving an agent only the access its current task needs, and taking it back when the task ends., inline inspection, operator-custodied logging, and a tested isolation plan. Status: converged across camps. Owner: R05.

CD-19. Fine-tuning and RFT vs prompt-and-context engineering

In short: Improve instructions and context first, then teach a smaller model the results; retrain weights only as a last resort.

Verdict: an ordering, not a side. Optimise contextContext window. The model's working memory for one task. It is limited in size, so what goes in and what gets left out is a design decision. and promptsPrompt. The instructions and information given to the model for a task. A prompt is advice to the model, not a control on it. against a locked eval suite first; measured wins came at up to 35 times fewer rollouts than reinforcement learning (RL). DistilDistillation. Teaching a smaller, cheaper model to imitate a larger one on a narrow task once enough good examples exist. when latency or unit cost forces it. Use reinforcement fine-tuning (RFT) only when a programmable, hard-to-game grader exists and the prompt-optimised ceiling is demonstrably flat. RFT is the wrong tool for format and tone. Counter-evidence kept honestly: a fine-tuned small model has beaten a prompt-engineered frontier model decisively on cost and accuracy in narrow classification. Status: refined. Owner: R06.

CD-20. AI-first vs human-first service

In short: Do not aim to keep customers away from staff; aim to solve their problems and measure who has to come back.

Verdict: the axis is wrong; the target is what fails. Every documented reversal of an AI-first programme set a containmentContainment versus resolution. Containment counts conversations that never reached a person. Resolution counts problems actually solved. Target resolution. target (the share of conversations that never reach a person) or a headcount target. Target resolution, instrument repeat contact beside it, and let containment be an outcome. Status: reframed. Owner: R09.

CD-21. Multi-agent orchestration vs a single good loop

In short: Splitting one job across several agents pays off only for wide, independent work; most famous gains came from extra tokens.

Verdict: parallel breadth only, and hold compute constant before believing any comparison. The famous orchestrator-worker win was bought with roughly 15 times the tokens. Token usage alone explains most of the variance on related benchmarks. At constant reasoning tokens, single agents match or beat multi-agentMulti-agent. Several agents splitting one job. It costs many times more than one agent and pays off only when the work is wide and the parts are independent. systems on multi-hop reasoning. Pay the multiplier only when strands are independent and read-heavy, the information exceeds one context window, the accuracy bar exceeds single-pass, and the value clears the cost. Status: supported with reframe. Owner: R07.

CD-22. Agents as workforce vs agents as tools

In short: Give every agent a named accountable person, but do not treat agents as employees with personnel records.

Verdict: keep the accountability, drop the personnel metaphor. The accountability substance is productised: a named sponsorSponsor and owner. The sponsor is the business person accountable for why an agent exists. The owner is the technical person who keeps it configured and secure. on the identity, automatic transfer, and scoped expiring credentials. The flagship attempt to give agents employee records was withdrawn within days. The strongest field deployment achieves per-agent accountability with no org-chart presence. Status: refined. Owner: R13.

CD-23. One universal assistant vs many specialised agents

In short: Ask whether the work is done alone or with others, because AI reliably helps solo work and rarely changes teamwork.

Verdict: the axis is wrong; solitary versus coordinated work is the predictive variable. Individually provisioned AI reliably improves solitary work and reliably fails to change coordinated work, because coordination requires agreeing new norms. The evidenced third answer is a long tail of narrow agents built by employees inside the horizontal platform. Status: reframed. Owner: R08.

CD-24. Separate customer-facing stack vs shared platform

In short: Customer-facing agents get their own channels and legal safeguards, but share knowledge, identity, tools, and monitoring with everything else.

Verdict: separate lane and separate edge on a shared control plane, justified by legal exposure rather than technology. Edge-specific: channels and telephony, disclosure mechanics, adversarial hardening, and the legal-evidence layer. Shared, and duplicating them is a defect: knowledge corpus, identity, tool layer, evals, observability, and model access. Honest caveat: no published case measures either choice. Status: position with legal anchors. Owner: R09.

CD-25. Purpose-specific embedding views vs matched chunking

In short: Split documents into several vectors, start with plain chunks, and add purpose-specific views only where your own queries prove they help.

Verdict: chunks first, views on a measured win, and never condition the index on the objective. Several embeddingsEmbedding. A numeric fingerprint of a piece of text that lets a computer find similar meaning quickly. Embeddings are derived data and inherit the protections of what they came from. per document beat one on aspect-rich material (a pooled index fell from 0.815 to 0.294 nDCG@10 as aspects grew from one to ten), but most of that benefit is capacity: a blind sliding window recovered 0.610 of the 0.674 that purpose views gained on the LIMIT stress test, and on human-judged scientific abstracts purpose views scored 0.032 to 0.042 below matched chunksMatched control. A comparison arm given the same budget as the method under test, here the same number of embeddings per document, so the experiment measures the idea rather than the extra capacity.. Views won only where queries targeted one aspect (+0.188 at ten aspects, with 25 percent fewer embeddings). Conditioning the view design on the objective, the business context, or the schema made retrieval worse in every form tested, including real instruction-following data, where a plain instruction-prepended encoder beat every view arm. The discriminator is the query distribution: aspect-targeted queries over aspect-rich items earn views; whole-document queries do not. Keyword search stays fused in either case. Status: independently measured, five rounds, two machines. Owner: R14; the evidence is on the research pages, and the design is the recommended approach.