The decision catalog

Many technology choices for agentsAgent. Software that uses an AI model to work toward a goal on its own: it reads, decides the next step, uses tools, and keeps going until the job is done or a limit stops it. are made by habit, or because everyone else made them. A graph database for knowledge. A dedicated gateway for tools. Several agents where one would do. This catalog tests twenty-five of those choices against the simplest credible alternative, on evidence and cost. Each record gives a verdict. It also gives the one test that decides your own case, because the common answer may not fit it.

How to read a record

Each record has the same five parts, in the same order.

1. The choice: the question a team faces.
2. The common choice: what most teams do by default.
3. Verdict: what the evidence supports, and why.
4. The discriminator: the one test that separates the options for your case.
5. What changes the answer: the evidence or condition that would move the verdict.

A status line closes each record. "Verdict holds" means the evidence supports the verdict as written. "Verdict refined" means research narrowed or reframed it, on the date shown. "Verdict reversed" would mean evidence overturned it. No verdict has been reversed. Each record also names the layer that owns the decision, one of the fourteen layers.

Data and search

CD-1. Graph database or embedding retrieval

The choice. How agents find knowledge: by following a graph of relationships, or by searching for similar meaning.

The common choice. Pick one side: a graph database for everything, or vector search on its own.

Verdict: routed hybrid, vector-first. Keep the raw sources and an event store as the record. Combine keyword search with embeddingsEmbedding. A numeric fingerprint of a piece of text that lets a computer find similar meaning quickly. Embeddings are derived data and inherit the protections of what they came from., numeric fingerprints of text that let a computer find similar meaning. Where documents cover many aspects, keep several views per document. Rerank the candidates. Treat topics as navigation labels that can be regenerated. Add a graph only for exact relationship paths. These are lineageLineage. The chain of steps data went through to reach its current form., what depends on what, who may authorise what, validity over time, and shared transaction state. If you add a graph, every generated edge carries its source passage and the extraction model and version. It also carries a confidence value and a validity interval. Graph-augmented retrievalRetrieval. Finding the few relevant pieces of company information for a task and placing them in front of the model. wins benchmarksBenchmark. A public test used to compare models or agents. Useful for orientation; scores can be gamed, so they are claims rather than measurements. where answers need several linked steps. It costs about ten times more to build. Embedding search plus a graph beat either one alone. Rejected outright: graph-only memory, and vector search without keyword search and raw sources. Also rejected: topic summaries as the source of truth, and fine-tunedFine-tuning. Adjusting a model's internal weights with examples. Slow, hard to undo, and rarely the right first step. weights as a store of facts.

The discriminator. Does the question need an exact path through relationships? If yes, route it to the graph. If not, use hybrid search.

What changes the answer. A large fall in the cost of building and keeping a graph would let more questions justify one.

Status: verdict holds. Layer: agent data engineering (R14) and data platform (R02).

CD-8. A semantic-layer product or governed views

The choice. How agents get shared business definitions, such as what "revenue" means. One path is a semantic-layer product. The other is governed views in the database.

The common choice. Buy a semantic-layerBusiness definitions (semantic layer). One set of business definitions that every reporting agent uses, so two agents never compute revenue two ways.Read the page product, because benchmarks show accuracy gains.

Verdict: per use case, chosen by how it fails. The property that matters is what happens to wrong answers. Governed definitions turn silent wrong answers into refusals or fixed answers. Benchmarks show large gains, but only on the part of the data that was modelled. A disciplined counter-camp reaches similar accuracy through data modelling alone. Both camps have published. The real variable is curatedCuration. Preparing data for a specific purpose before agents use it, with a named owner responsible for its quality. business context. A semantic-layer product is its most governable packaging.

The discriminator. How does this use case fail? If a wrong number would pass silently and cost a lot, governed definitions pay. If not, well-modelled data may be enough.

What changes the answer. A portable standard for definitions would lower the lock-in cost of a product. The Open Semantic Interchange published a first specification in January 2026.

Status: verdict holds. Layer: data platform (R02).

CD-9. A dedicated vector database or the simplest store

The choice. Where to keep the embeddings that agents search.

The common choice. Buy a dedicated vector databaseVector index. A database of embeddings built for finding similar meaning fast. The storage behind most retrieval. from the start.

Verdict: start with the simplest store, and step up only on measured strain. Use brute-force search below about 100,000 vectors. Use pgvector, an extension to the Postgres database, up to the low millions. At 1 million vectors it answers in under 20 milliseconds with recall above 95 percent. Recall is the share of true matches it finds. Index builds get painful from about 2 million vectors. You need partitioning at 5 million and above. Scale-out Postgres extensions carry you to about 50 million. Use a dedicated engine for extreme scale, heavy write rates, or many tenants with heavy filtering. There the gap in worst-case latencyLatency. How long a request takes to come back. (the 99th percentile) becomes real. Vector search bundled into data platforms is now standard. Prefer it where the data already lives. Governance and access control list (ACL)ACL-aware retrieval. Retrieval that checks the requester's permissions before returning information, so an agent cannot surface documents its user could not open. inheritance then come with it. Include the vendor's viability in the selection.

The discriminator. Your measured load: how many vectors, how many writes and how much filtering. Step up only when measurements show strain.

What changes the answer. The burden of running it can justify a managed service earlier than scale does. Long index builds and recall that drops under filtering are the usual signs.

Status: verdict holds. Layer: data platform (R02).

CD-10. Data mesh or a governed central store

The choice. Whether each business domain serves its own data to agents, or a governed central store does.

The common choice. A data mesh, where each domain owns and serves its data on its own infrastructure.

Verdict: mesh ideas on a governed central store. Every shipped design that keeps search permissions in step with source systems assumes a governed central index. A pure mesh multiplies three problems that agents punish. These are keeping permissions in step, keeping definitions consistent, and checking freshness. Keep domain ownership, data contracts and agreed definitions as ways of working. Keep the store and its permissions central and governed.

The discriminator. Where are permissions, definitions and freshness enforced? If each domain does it alone, agents inherit every gap between them.

What changes the answer. A shipped permission-sync design that works without a central index would reopen the question.

Status: verdict holds. Layer: data platform (R02).

CD-11. One universal index or indexes scoped to each use case

The choice. Whether agents search one index across everything, or smaller indexes built for each purpose.

The common choice. One universal enterprise index.

Verdict: both, for different jobs. A permission-aware universal index serves discovery and questions that cross silos. Curated indexes scoped to one purpose serve high-stakes tasks. Scoped routing over the universal index can do the same job. The trade is coverage against trust. Even the largest universal-index vendors shipped scoping controls to reduce the risk.

The discriminator. What does a wrong answer cost? For discovery, use the universal index. For high-stakes tasks, use a scoped, curated index.

What changes the answer. A universal index that keeps its quality as the corpus grows, and stops oversharing. Today search quality falls as a corpus broadens.

Status: verdict holds. Layer: agent data engineering (R14).

CD-12. Real-time or batch grounding

The choice. How fresh the data behind agent answers must be, and how it gets there.

The common choice. Real-time streaming for all agent data.

Verdict: change data capture is the default; streaming is earned. Change data capture (CDC)Change data capture (CDC). Streaming each change in a database as it happens, so copies, including agent indexes, stay current. copies each database change as it happens. It keeps groundingGrounding. Making an agent answer from trusted company sources it can point to, and refusing when the evidence is weak. data minutes old, at close to batch cost. One documented like-for-like comparison ran $400 against $7,600 a month.

The discriminator. How fast must the decision be made? Windows under a minute, such as fraud or operational triage, earn streaming. Everything else uses change data capture.

What changes the answer. The cost of freshness is falling as streaming and table storage converge. So the boundary is revisited every year.

Status: verdict holds. Layer: data platform (R02).

CD-25. Purpose-specific embedding views or matched chunks

The choice. How to cut documents into pieces for search. One path is views designed around a purpose. The other is plain chunks of fixed size.

The common choice. Design purpose-specific viewsMulti-view (multi-card) embeddings. Giving one document several numeric fingerprints instead of one, each built from the text about one purpose (what is asked, what was promised, what went wrong), so a question about one aspect matches that aspect rather than a blurred average. for each document.

Verdict: chunks first, views only on a measured win, and never shape the index around the objective. Several embeddings per document beat one on documents that cover many aspects. Most of that gain comes from having more vectors, not from the purpose. A blind sliding window recovered most of it. On human-judged scientific abstracts, purpose views scored below matched chunksMatched control. A comparison arm given the same budget as the method under test, here the same number of embeddings per document, so the experiment measures the idea rather than the extra capacity.. Views won only where queries targeted one aspect. Shaping the views around the objective, the business context or the schema made search worse in every form tested. Keyword search stays in the mix either way.

The discriminator. What do your queries ask? Queries aimed at one aspect of a many-aspect document earn views. Queries about whole documents do not.

What changes the answer. The positive result for views rests on synthetic data. A test on a real corpus with human judgements could move it.

Status: verdict refined (2026-08-23). Layer: agent data engineering (R14). The measurements are in the context patterns.

Connecting to systems

CD-2. A dedicated MCP gateway or extending API management

The choice. How agent traffic to tools is controlled: a new gateway built for agents, or the API management you already run.

The common choice. Buy a dedicated Model Context Protocol (MCP)MCP (Model Context Protocol). An open standard for connecting agents to tools and data, like a universal plug. An MCP gateway is the governed version of that plug.Read the page gateway, because agents seem to need their own.

Verdict: extend the incumbent by default. The incumbent is the application programming interface (API)API. A defined way for software to talk to other software. Agents reach systems through governed APIs rather than through screens. management platform you already run. The MCP specification of 28 July 2026 was redesigned on purpose. Ordinary web (HTTP) gatewaysGateway. The single door every agent request passes through on its way to a tool or model. Because everything goes through it, it is where rules are enforced and activity is recorded.Read the page can now route and authorise it. Every incumbent shipped support within a year.

The discriminator. Do you need controls built for agents that your platform lacks? Examples are scanning tool descriptions for changes and poisoning, and joining several agent runtimes. Another is controlling a tool's requests for more input from the user. If you need these, add a dedicated gateway for them.

What changes the answer. Incumbents adding those agent controls would remove the case for a dedicated gateway. This market moves fast, so the verdict is checked every quarter.

Status: verdict holds. Layer: integration fabric (R03).

CD-3. Replace robotic process automation or keep it

The choice. What happens to the screen-clicking bots of robotic process automation (RPA)RPA (robotic process automation). Older software bots that click through screens on fixed scripts. Kept alongside agents rather than replaced on day one. when agents arrive.

The common choice. Replace the bots with agents across the whole organisation.

Verdict: coexist, supervised. Bots keep doing fixed steps on systems that have no API. Agents reason and handle the exceptions above them. Replacement is earned one workload at a time, never declared for the whole organisation.

The discriminator. Does this workload have a governed API? If yes, and the cost and reliability case is proven, move it to the API and an agent. If not, the bot stays.

What changes the answer. If most bot workloads gained governed APIs, coexistence would give way to replacement.

Status: verdict holds. Layer: integration fabric (R03).

CD-4. Agent-to-agent protocols now

The choice. Whether to adopt a standard protocol now for agents to talk directly to other agents.

The common choice. Adopt it now, so agents are ready to work together.

Verdict: not yet for most. The standard has consolidated and stabilised. But its published milestones count member organisations, not production use. Teams get most coordination today from toolTool. A function an agent can call to do something real: look up a record, send an email, run a query. Tools are where agents touch your systems.-protocol features. Treat calls between agents as ordinary governed APIs.

The discriminator. Do your agents need to work with agents in another organisation? If yes, adopt selectively, because nothing else fits. If not, wait.

What changes the answer. Published evidence of production use, not counts of members. The verdict is checked every quarter.

Status: verdict holds. Layer: integration fabric (R03).

CD-5. Modernise the enterprise service bus first, or go around it

The choice. Whether agents wait for the old integration bus to be modernised.

The common choice. Modernise the enterprise service bus (ESB)ESB (enterprise service bus). An older central integration system that many companies still run. first, then add agents.

Verdict: strangle, do not wait; govern before you wrap. To strangle a system is to replace it one slice at a time while it keeps running. To wrap an API is to put it behind a governed tool. Of modernisation programmes, 74 percent fail to complete. Gateways you already run can expose governed APIs as tools with no change to the backend. Govern the specific API paths agents will use before you expose them. Let each slice you replace retire real load.

The discriminator. Are the specific API paths the agent will use governed? If yes, expose them as tools now. If not, govern those paths first. The state of the whole bus is not the test.

What changes the answer. If a path cannot be exposed as a governed tool without changing the backend, that slice needs work first.

Status: verdict holds. Layer: integration fabric (R03).

CD-17. Vendor-embedded agents or your own agents through governed APIs

The choice. Whether work in a packaged application runs on the vendor's built-in agent, or on your own agent through governed APIs.

The common choice. Back one side for everything.

Verdict: decided by the authority boundary. Nobody has measured the two head to head. Inside one system, vendors state that both paths now enforce the same permissions. So choose on control of the model, the cost meter and how far you can customise. Across systems, no single vendor's permission model is authoritative. Records about the same customer or asset must also be matched across systems, which is called entity resolutionEntity resolution. Working out that records in different systems refer to the same real customer, asset, or case.. So your own orchestration becomes a requirement. Generic benchmarks show cost differences of up to fifty times at similar accuracy. The harnessHarness. The engineering shell around the model: what goes into its working memory, which tools it can call, when it must stop, how much it may spend, and how it recovers when something fails.Read the page around the model matters more than whose name is on it.

The discriminator. Does the work's authority boundary sit inside one system of record? If yes, either path works. If it crosses systems, use your own agentsYour own agents and vendor-embedded agents. Agents you build run through your own gateway, so you can govern every action. Agents embedded in vendor products run on the vendor's platform, so you govern them only through its settings and the records it exports. through governed APIs.

What changes the answer. A published head-to-head measurement on the same task. None exists yet. Agent-to-agent protocols that are ready for work across vendors would also change it.

Status: verdict refined (2026-08-19). Layer: systems of record (R04). For packaged software, see agents and packaged applications.

CD-18. Brokered reads or one-way designs for plant systems

The choice. How agents read operational technology (OT)OT (operational technology). The systems that run physical equipment: plants, grids, vehicles. Safety rules keep AI out of the control loop.Read the page, the systems that run physical equipment.

The common choice. Start from the transport. Teams pick a historian, the database of plant readings over time, or a unified namespace or protocol gateway.

Verdict: impact decides the control point; the transport comes after. Impact is what the agent can damage. If any output can reach or influence a control action, use a one-way (unidirectional) or push-based design. Keep a documented path back to manual or fixed control. If output stays as alerts, recommendations and data-quality findings, a brokered read path is defensible. It needs per-agent identityAgent identity. A registered account for an agent with a named owner, limited permissions, and credentials that expire, so every action can be traced to who asked.Read the page, least privilegeLeast privilege. Giving an agent only the access its current task needs, and taking it back when the task ends., inline inspection, logs held by the operator and a tested isolation plan.

The discriminator. Can any output of the agent reach or influence a control action?

What changes the answer. A change in what the agent's output can reach. If it starts to influence a control action, the one-way design applies.

Status: verdict holds. Layer: line of business and OT (R05).

Where agents run

CD-6. Your own GPUs or metered APIs

The choice. Whether to run models on your own graphics processing units (GPUs), or pay a provider per use.

The common choice. Host models yourself on your own GPUs, to save cost and keep control.

Verdict: metered by default. The cheaper path is open-weight models through metered APIs, not self-hosting. Metered means paying a provider per use. Open-weight models have their weights published for anyone to run. Self-hosting breaks even only at hundreds of millions of tokensToken. The unit AI usage is measured and billed in, roughly three-quarters of a word. a month per workload. That assumes high utilisation, and operations add 1.3 to 2 times the cost. At 10 percent utilisation, the cost per token rises about tenfold. Against budget prices for open-weight APIs, break-even moves out to billions of tokens a month.

The discriminator. Must the work run air-gapped, cut off from outside networks, or under a classificationClassification (data). A label for how sensitive data is. Anything derived from data inherits the strictest label of its sources. rule? If yes, self-host. A general need for data residencyData residency and sovereignty. Rules about which country or region data may be stored and processed in, including the copies created for agents. is not enough on its own.

What changes the answer. Sustained, very high volume at high utilisation for one workload. Below about 100 to 250 million tokens a month, or below 60 percent utilisation, the numbers do not close.

Status: verdict refined (2026-08-19). Layer: infrastructure and compute (R01).

CD-7. Kubernetes everywhere or managed agent runtimes

The choice. Where agents and models run: on Kubernetes, or on a managed runtime from a provider.

The common choice. Kubernetes for everything, including the agents.

Verdict: split by workload. Serve modelsModel. The AI engine that reads and writes text. On its own it has no access to your systems; everything built around it decides what it may do. on Kubernetes only if you host them yourself. Run agent orchestrationOrchestration. Coordinating several agents or steps so they work together on one job. Useful for breadth; it does not make any single step smarter. on managed runtimesAgent platform. The software that runs agents: the runtime, the harness, the list of approved agents, and the rules for how they start, stop, and change., with a separate sandboxSandbox. An isolated environment where agent code runs with limited access to the network and the rest of the machine, so mistakes and attacks stay contained.Read the page per session and durable state. The lock-in risk runs both ways. Managed runtimes are proprietary platforms, and the portability camp sells its own ecosystem.

The discriminator. Do you host models yourself? Only then does model serving belong on Kubernetes. Agent orchestration goes to a managed runtime unless the condition below holds.

What changes the answer. Strong in-house platform engineering plus a real need to run the same agents in several environments. Then Kubernetes for orchestration can make sense.

Status: verdict holds. Layer: infrastructure and compute (R01) and agent platform (R07).

CD-21. Several agents or one good loop

The choice. Whether to split a job across several coordinated agents, or run one agent with good tools.

The common choice. Multi-agentMulti-agent. Several agents splitting one job. It costs many times more than one agent and pays off only when the work is wide and the parts are independent. orchestration, because famous results showed big gains.

Verdict: use several agents only for wide, parallel work. Hold compute constant before you believe any comparison. The famous orchestrator-worker win used about 15 times the tokens. Token use alone explains most of the variation on related benchmarks. With reasoning tokens held equal, single agents match or beat multi-agent systems on questions that need several linked steps.

The discriminator. Four conditions must all hold. The work splits into independent strands that mostly read. The information is more than one context window holds. The accuracy bar is above what one pass reaches. The value covers the extra cost.

What changes the answer. A comparison that holds compute constant and still shows a multi-agent gain on your kind of task. Where agents must share changing state, the cost of coordinating them dominates.

Status: verdict refined (2026-08-19). Layer: agent platform (R07).

Security and regulation

CD-13. A dedicated AI security platform or extending the SIEM

The choice. Where agent security monitoring lives: a dedicated AI security product, or the security tools you already run.

The common choice. Buy a dedicated AI security platform.

Verdict: the market moved toward platform absorption, so buy accordingly. Absorption is not parity. Six AI security acquisitions in about fourteen months moved the capability inside existing platforms. Two deals for non-human identity added to it. One gap remains. Mainstream security information and event management (SIEM)SIEM. The security team's central system for collecting and analysing security events. systems cannot yet learn what normal agent behaviour looks like. Guardian agents, which watch other agents at runtime, remain a separate product category.

The discriminator. Do you need to baseline agent behaviour now? If not, buy inside the platforms you run. If yes, plan for a specialist tool beside them.

What changes the answer. Mainstream SIEMs learning to baseline agent behaviour would close the gap. This market is consolidating fastest of any in the catalog, so it is checked every quarter.

Status: verdict refined (2026-08-19). Layer: security and identity (R10).

CD-14. A broad or narrow reading of the EU AI Act

The choice. How widely to treat agents as high-risk under the EU AI ActEU AI Act. The European Union's AI regulation. Most duties fall on high-risk uses; this guide keeps an evidence floor for every agent and deeper records for the tier that could classify as high-risk..

The common choice. Bet on one reading: treat almost everything as high-risk, or almost nothing.

Verdict: neither pole; scale the records to the risk. Two currents pull on classification. The law itself tilted narrow, through deferrals. The way the rules are read tilts broad. Draft classification tests and a presumption for multi-purpose systems push that way. Enforcement capacity is thin either way. Keep an audit trail baselineAudit trail baseline. The minimum records every production agent keeps: a registry entry, action logs collected where the agent cannot write, named oversight, and sources it can be traced back to. High-risk uses keep the deeper records the EU AI Act asks for.Read the page for every production agent. For uses that may be high-risk, keep the records the Act asks for under Article 12.

The discriminator. Could this use plausibly be high-risk under the Act? If yes, keep EU AI Act record keeping. If not, the audit trail baseline is enough.

What changes the answer. The final classification guidelines, the first harmonised standards and the first enforcement actions. The verdict is checked at each of these milestones.

Status: verdict holds. Layer: governance, risk and sovereignty (R11).

CD-16. Guardrail products or fixed gates

The choice. What decides whether an agent may take an action: an AI-based filter, or a fixed rule.

The common choice. Buy a guardrail product and let it block unsafe actions.

Verdict: fixed gates own the decision to authorise; guardrails advise wherever they run. In published tests, roughly 72 to 77 percent of attacks got past major commercial guardrailsGuardrail. A filter that uses an AI model to catch bad inputs or outputs. Useful as an early warning, but not reliable enough to be the thing that grants or denies an action.Read the page. Some configurations let up to 100 percent through. Attacks tuned to the defence do even better. The one guardrail measured at 0 percent bypass flagged 16.22 percent of good requests. It also added about 1.5 seconds per call. A policy enginePolicy decision point. The component that says yes or no to an action by checking rules against who is asking. The agent asks, the decision point decides, and the agent cannot skip it.Read the page decides in under a millisecond.

The discriminator. Does the control grant or deny an action? Then it must be a fixed gate. Content policy and spotting personal data can use guardrails, because a miss there is tolerable.

What changes the answer. Better guardrail numbers would change which guardrail you buy. The fixed gate would still authorise, because models may take permission away, never grant it.

Status: verdict holds. Layer: security and identity (R10). Enforcement outside the model gives the full figures and dates.

Improving and measuring

CD-15. Extending APM or a dedicated LLM observability tool

The choice. Whether agent monitoring extends your application performance monitoring (APM), or uses a tool built for large language models (LLMs).

The common choice. Buy a dedicated LLM observabilityObservability. Being able to see what agents did, step by step, from records the agent cannot alter. platform beside APM.

Verdict: the question dissolved. Bigger vendors bought most of the specialists, and the category merged. Choose on three real differences instead. The first is OpenTelemetry (OTel), an open standard, against a vendor's own software development kit (SDK). Both need a translation step while the standard is unstable. The second is the depth of evaluationEval (evaluation suite). A set of test tasks with known right answers, written by people who know the work, used to check an agent before and after any change.Read the page tooling, against seeing agents beside the infrastructure they touch. The third is whether you must host it yourself. Most enterprises use their APM incumbent plus one tool that can run evaluations.

The discriminator. Which of the three differences matters most for you? Choose on that, not on the category name.

What changes the answer. The last gap, between APM and evaluation tools, may close as the category merges. Two of the deals had not closed at research time, so this is checked every quarter.

Status: verdict refined (2026-08-19). Layer: observability and FinOps (R12).

CD-19. Fine-tuning or prompt and context engineering

The choice. How to make a model better at your task: change its weights, or improve its instructions and context.

The common choice. Fine-tune the model.

Verdict: an ordering, not a side. First, optimise contextContext window. The model's working memory for one task. It is limited in size, so what goes in and what gets left out is a design decision. and promptsPrompt. The instructions and information given to the model for a task. A prompt is advice to the model, not a control on it. against a locked evaluationEval (evaluation suite). A set of test tasks with known right answers, written by people who know the work, used to check an agent before and after any change.Read the page suite. Measured wins came with up to 35 times fewer trial runs than reinforcement learning. Next, distilDistillation. Teaching a smaller, cheaper model to imitate a larger one on a narrow task once enough good examples exist. into a smaller model when latency or unit cost forces it. Use reinforcement fine-tuning (RFT) last. RFT is the wrong tool for format and tone.

The discriminator. Is there a grader, a program that scores answers, that is hard to game? And has prompt work hit a flat ceiling? Only then use RFT. The usual sign is accuracy that climbs for a week of prompt work, then stops.

What changes the answer. Narrow classification tasks. There a fine-tuned small model has clearly beaten a prompted frontier model on cost and accuracy.

Status: verdict refined (2026-08-19). Layer: intelligence and learning (R06).

People and service

CD-20. AI-first or human-first service

The choice. Whether customers meet AI first, or people first with AI helping them.

The common choice. AI-first service, measured by how many contacts never reach a person.

Verdict: the question is framed wrong. Set a resolution target, not a containment target. ContainmentContainment versus resolution. Containment counts conversations that never reached a person. Resolution counts problems actually solved. Target resolution. is the share of conversations that never reach a person. Every documented reversal of an AI-first programme had set a containment or headcount target. Set a target for resolved problems instead. Measure repeat contact beside it, and let containment follow.

The discriminator. What is the target: contacts kept away from staff, or problems solved? Track who has to come back.

What changes the answer. A documented case of lasting gains under a containment target would reopen the question. The research found none.

Status: verdict refined (2026-08-19). Layer: experience and channels (R09).

CD-22. Agents as a workforce or agents as tools

The choice. Whether agents are managed like staff, with managers and a place on the org chart. The other path treats them as tools that existing roles run.

The common choice. Treat agents as a digital workforce.

Verdict: keep the accountability, drop the idea of agents as staff. The accountability part is now built into products. Each agent has a named sponsorSponsor and owner. The sponsor is the business person accountable for why an agent exists and whether it keeps running. The owner is the technical person who keeps it configured and secure.Read the page on its identity. Sponsorship transfers automatically, and credentials are scoped and expire. The best-known attempt to give agents employee records was withdrawn within days. The strongest field deployment has a named person accountable for each agent, with no place on the org chart.

The discriminator. What does accountability need? A named sponsor, automatic transfer and expiring credentials. None of these needs an HR record.

What changes the answer. A study comparing outcomes under the two approaches. None exists yet.

Status: verdict refined (2026-08-19). Layer: operating model and supervision (R13).

CD-23. One universal assistant or many specialised agents

The choice. Whether everyone gets one general assistant, or teams get many agents built for specific jobs.

The common choice. Pick one side: one assistant for everyone, or a portfolio of specialised agents.

Verdict: the question is framed wrong. Whether the work is done alone or with others predicts the result. AI given to individuals reliably improves work people do alone. It reliably fails to change work people do together, because teams must first agree new ways of working. A third answer has the most deployment evidence. Give everyone an assistant they can build on. Employees then build a long tail of narrow agents inside it.

The discriminator. Is the work done alone or with others?

What changes the answer. Evidence that AI given to individuals changes coordinated work. Today the evidence runs the other way.

Status: verdict refined (2026-08-19). Layer: productivity and collaboration (R08).

CD-24. A separate stack for customer-facing agents or a shared platform

The choice. Whether agents that talk to customers get their own technology stack, or share the platform internal agents use.

The common choice. Build a separate stack for customer-facing agents.

Verdict: a separate lane and a separate edge on a shared platform. The reason is legal exposure, not technology. The lane is a separate budget and governance path. The edge is the part customers touch. It covers channels and telephony, disclosure to customers, hardening against attackers, and the legal evidence record. The rest is shared, and duplicating it is a defect. That covers the knowledge corpus, identity, tools, evaluations, observability and model access. No published case measures either choice.

The discriminator. Is a failure legally attributable, binding and public? Customer-facing failures are. That justifies separate governance, funding gates and risk appetite.

What changes the answer. A published case that measures a separate or a shared stack. None exists, so the verdict rests on legal exposure and market structure.

Status: verdict holds. Layer: experience and channels (R09).

A worked example: grid data at a utility

A distribution utility wants an agent to read grid sensor data and flag feeder faults. Record CD-18 applies. The test is whether any output can reach a control action. Say the agent only raises alerts for an operator. Then a brokered read path is defensible. It still needs its own identity, least privilege, inspection, logs held by the operator and a tested isolation plan. Now say its output could feed a switching action. Switching is safety actuation, one of the four deterministic zones. Then use a one-way design, and keep a tested path back to manual control. This is an illustrative example, not a measured deployment.

Evidence and limits

The verdicts come from the guide's research across the fourteen layers, completed on 2026-08-19. CD-25 rests on the guide's own experiments, run from 2026-08-19 to 2026-08-22. Each choice was tested against the simplest credible alternative, on evidence and cost. Three records have no head-to-head measurement, and say so: CD-17, CD-22 and CD-24. Market facts date quickly. CD-2, CD-4, CD-13 and CD-15 are checked every quarter. CD-14 is checked at each regulatory milestone.

Next step

Find the record that matches a choice in front of you, and apply its discriminator to your case. Then open the layer page it names for the dated evidence. The guide's own editorial decisions are in the decision log.

Explore this topic

• Each verdict's dated sources are on the layer page named in its record.
• CD-2: the Model Context Protocol specification of 28 July 2026.
• CD-25, measured in five rounds on public corpora between 2026-08-19 and 2026-08-22, seeded and replicated on a second machine:
  • A pooled index fell from 0.815 to 0.294 nDCG@10 as aspects per document grew from one to ten.
  • A blind sliding window recovered 0.610 of the 0.674 gain that purpose views made on the LIMIT stress test.
  • On human-judged scientific abstracts, purpose views scored 0.032 to 0.042 below matched chunks.
  • Views won by 0.188 at ten aspects when queries targeted one aspect, with 25 percent fewer embeddings.
  • On real instruction-following data, a plain encoder with the instruction prepended beat every view design.
  • The experiments are in the context patterns and what we got wrong.
• The decision log records the guide's own editorial decisions.