Skip to main content
Agentic Architecture Skills.
Start hereUse casesArchitectureIntelligence ladderKnowledge & memoryResearchSkills
Layers

Agent platform

Where agents run: buy the runtime, build the loop around the model, give every run several ways to stop, keep its state where people can read it, and let only tested versions run.

By Murali SidLinkedInPublished Updated
Download the architecture diagram (SVG)

The agent platform layer (R07) is where agents run. It is one of the fourteen layers you own, and it is mostly new. Today it holds robotic process automation bots, workflow and rule engines, chatbots and copilots. Agent builders inside vendor products are arriving on top. When agents arrive, this layer becomes the home of the runtime. The runtime is one of the seven capabilities an agent platform adds. This layer must provide a loop around the model with several independent ways to stop. It must keep each run's state where a person can read it, and survive a crash. It must also let only tested versions of an agent run. The loop around the model is called the harness. It decides what the model sees, what it may call and when it stops. Buy the runtime from a vendor. Build and own the harness yourself.

What sits in this layer today

Here is what a typical estate already runs in this layer. Vendors in brackets are examples, not a market claim.

Standards: the Model Context Protocol for tools, and agent-to-agent (A2A) messaging in energy. Nothing is specific to any of these industries. Hospitals also apply local AI assurance frameworks, covered on the governance, risk and sovereignty layer (R11). The full estates are on the utilities, healthcare and energy pages.

What agents add

layer · architecture

Buy the runtime, build the harness

The harness owns context assembly, explicit multi-condition termination, artifacts-as-state, separate verification, and budgets; the managed runtime owns isolation and durability.

  1. 01

    Agent

    Harness

    Context assembly and reset, iteration and wall-clock caps, per-run budgets

  2. 02

    Control

    Verification path

    Separate agent or process; self-assessment distrusted

  3. 03

    Evidence

    Artifacts-as-state

    Inspectable state outside the context window

  4. 04

    System

    Managed runtime

    Isolation, durable execution, hibernate-and-wake

  5. 05

    Control

    Registry

    Eval-gated promotion; staleness demotes; search returns PUBLISHED only

  6. 06

    System

    Routing tiers

    Deterministic pre-router, light models, frontier synthesis

Approval rules are held in the harness and enforced at the gateway.

The harness is the lock-in and the differentiator; the runtime is becoming the portable substrate.

Diagram description: Agent platform architecture separating the enterprise-owned harness (context, termination, verification, budgets, artifacts-as-state) from the managed runtime (isolation, durable sessions), with the registry gating promotion. The map contains Harness: Context assembly and reset, iteration and wall-clock caps, per-run budgets; Verification path: Separate agent or process; self-assessment distrusted; Artifacts-as-state: Inspectable state outside the context window; Managed runtime: Isolation, durable execution, hibernate-and-wake; Registry: Eval-gated promotion; staleness demotes; search returns PUBLISHED only; Routing tiers: Deterministic pre-router, light models, frontier synthesis. Its connections are harness to runtime for runs on; harness to verify; harness to artifacts; registry to harness for gates promotion; harness to router for model calls. Important boundary: Approval rules are held in the harness and enforced at the gateway.

The harness is the product

Everything that separates a working agent from a demo lives in the harness. It assembles and resets the context, calls tools, records state, checks the work and stops the loop. Production practice has settled on four habits. State lives outside the model's working memory, in files a person can read. Stopping rests on more than one condition. A separate agent or process checks the work, because models praise their own weak work. Recovery from failure is a planned path, not an afterthought.

The model sits in the centre of a loop. The loop has five steps. They are assemble context, call tools, write state a person can inspect, verify separately, and repeat or stop. On the left are the hard controls. They are an iteration cap, a time limit, a cost budget, an approval gate and a kill switch. On the right is the foundation: a managed runtime and crash survival. The line underneath reads: buy the runtime, own the harness.
The model is a component; the harness is the production systemThe harness owns the loop, the state files, the separate check and every stop condition. A managed runtime gives isolation and crash survival underneath.

Meta's production harness, called REA, has the strongest published results. It doubled average model accuracy across six production models [vendor]. Harness choice can also matter more than the retrieval method. On 116 memory questions run through four harnesses, plain text search generally beat vector search (May 2026). So a benchmark comparison across different harnesses cannot tell you which part made the difference.

Every run has several ways to stop

A production loop needs several independent ways to stop. The limits are a step cap, a time cap and a cancellation check between rounds. They also include stop hooks, approval rules, a per-run token and cost budget, and a kill switch. Each agent has a budget with hard caps. The VS Code Copilot harness (May 2026) publishes its stop conditions. The Microsoft Agent Framework Harness (July 2026) gives the fullest published list of harness parts.

Tool approval is decided in the harness, because only the harness sees the whole loop. It is enforced at the tool gateway, because the harness is not a security boundary. The gateway sits in the integration fabric layer (R03).

State lives in files a person can read

Long-running work keeps its state in three files [vendor]. The first is a feature list, with every feature marked failing at the start. The second is a progress log, and the third is the version history in git. Work runs one feature per session, with a fixed checklist at the start of each. Prefer resetting the context to squeezing it into a summary. Sub-agents return short summaries of 1,000 to 2,000 tokens, not full transcripts. Skills load their detail only when needed. Each skill costs about 100 tokens of always-loaded description. Its body, under 5,000 tokens, loads only when the skill is triggered [vendor].

The run survives a crash

Saving a run's data is not the same as making the run survive. A checkpoint saves data, but a checkpointed run still lives in one process. If that process dies, the run dies with it [vendor]. Durable execution makes the run itself survive a crash. A pause for a human approval then uses no resources and survives worker restarts. That makes day-long approval waits affordable. Very long jobs can sleep and wake, as Meta's REA does. The other path avoids the engine entirely. Reset the context and carry state in the files above.

The infrastructure and compute layer (R01) provides the durable sessions underneath. This layer decides which runs need them.

Only tested versions run

A version moves through five release states: draft, approved, published, deprecated and retired. Gates sit between them: offline evaluation, safety review, version and lineage checks, and a freshness check. A version that fails a gate is removed from circulation. A note reads: users can find only published agents. The line underneath reads: promotion is tested, demotion is automatic.
A version earns and keeps its release statusOne published design for releasing a version. It sits inside the nine-stage agent lifecycle, which tracks the whole agent.

One published design moves each agent version through five release states (Kang and Wang, July 2026). They are draft, approved, published, deprecated and retired. Each promotion gate has a named threshold. For example, correctness must be at least 0.90 and harm at most 5 percent. Each agent is re-tested every 7 days and demoted if it fails. Search through MCP returns only published agents, so a weaker agent becomes harder to reach. This is a six-agent proof of concept by a cloud consultancy, not observed enterprise practice.

These five states track one version's release inside the nine-stage agent lifecycle, which tracks the whole agent. Draft and approved fall in its evaluate and approve stages, and published means the registry state active.

An agent's autonomy level is itself a versioned setting that needs review to change. Prompt refinements take a light review. Model updates and autonomy changes take a full review. The levels are set out on the autonomy contract page. One pharmaceutical programme publishes five levels of agency. It requires policy enforcement at the AI gateway before the higher levels are switched on.

Simple routing beats clever routing

A May 2026 study by Rice and Amazon compared 21 routing methods across 5 benchmarks. The top 5 finished within 0.22 points of each other. All of them trailed a perfect router by 10 to 30 points. Hard queries caused most of that gap. A simple nearest-neighbour lookup beat the trained methods on every benchmark. So a cleverer router does not help much. What helps is fixed first-step rules, clear limits on which model handles what, and fallbacks. About 70 percent of instrumented organisations run three or more models [vendor]. Light models handle extraction and tagging, and large models handle synthesis.

What moves between vendors

Managed runtimes now accept most agent frameworks. One hyperscaler runtime takes LangChain, the OpenAI Agents SDK, the Claude Agent SDK, Strands or your own code. Harnesses stayed custom. So the runtime is now easier to move between vendors than the harness. Prompts, tool definitions, model choice and Agent Skills move between vendors. Control flow, saved state formats, human-pause handling and approval models do not. Put portability effort into the harness design, not into the choice of framework.

A worked example: alarm investigation

AWS published a reference design for utility alarm investigation on its agent runtime (September 2026) [vendor]. One agent reads work orders from Maximo, and another reads the PI historian. Both have read-only database access. The utility behind it is not named. In this shape, the runtime is bought and the harness decides what each agent reads and when it stops. Any work order the investigation proposes should stay a draft until a person approves it.

What must be true before an agent touches it

Before an agent runs on this platform, these must hold.

  • It is registered. A registry record holds its lifecycle state, its owner and its sponsor.
  • It has its own identity. The security and identity layer (R10) issues it. The harness carries the caller's identity into every tool call. The delegation chain then traces each action to the person who asked.
  • It has several ways to stop. Step and time caps, a cancellation check and stop hooks are set. Approval rules, a capped budget and a kill switch are set too.
  • Checking is separate. The part that generates the work never grades it.
  • State is readable. Long-running work keeps its state outside the context, in files a person can inspect.
  • Crash recovery is tested. Runs that wait on people use durable execution or carry their state in files.
  • Its autonomy is set and versioned. Changing it needs a full review.
  • Its skills are signed. Skills and instruction files are version-pinned and checked for scope before use.

The harness is not the enforcement point. It decides when to ask for approval. The tool gateway and the policy decision point enforce the answer, outside the model. That is enforcement outside the model.

Choices and their verdicts

Each choice is the common choice, tested against the simplest credible alternative. The full records are in the decision catalog.

  • One agent or many (CD-21): use several agents only for wide work that splits into independent parts. Most famous multi-agent gains came from spending about 15 times the tokens.
  • Vendor-embedded agents or your own (CD-17): use the vendor's agent when work stays inside one product. Use your own agents when work spans systems.
  • Replace robotic process automation or keep it (CD-3): keep the bots running beside agents, under supervision. Replace one only when a workload earns it.
  • Build or buy the harness: buy the runtime, build the harness, and expect to own its upkeep. No credible published dataset exists for this choice.

Concerns this layer must honour

The ten cross-cutting concerns are set out in the concern matrix. This layer carries a specific duty for seven of them.

  • Identity and access: the harness carries caller identity into every tool call. Approval rules live in the harness and are enforced at the gateway.
  • Observability: loop telemetry covers steps, stops by type, context resets and how many sub-agents ran.
  • Traceability and audit: session files and event logs are the durable record. Each released version traces to its test evidence.
  • Grounding: checking is separate from generation. Self-assessment is distrusted by default.
  • Safety and oversight: caps, stop hooks, approval rules and the kill switch.
  • Cost: per-run budgets are enforced in the harness. The multi-agent token cost is chosen per task.
  • Resilience: durable execution or state in files, with crash recovery tested.

Evidence and limits

The failure record here comes from traces, not vulnerability records. A taxonomy called MAST (NeurIPS 2025) was built from 150 traces and checked on more than 1,600. It names 14 failure modes and finds that multi-agent failures are design failures. A benchmark contest over 2,196 traces found that spending more tokens did not predict success. Winning teams improved their guardrails, not their architectures.

Several figures come from vendors and carry the [vendor] tag. They include the multi-agent token figures, the three-file pattern and the checkpoint framing. The framework and single-call telemetry also comes from vendors, though it was measured, not self-reported. The five-state release design is a six-agent proof of concept.

This guide recommends judging an embedded agent by tested behaviour and logged exceptions, not by its autonomy. Every published taxonomy reviewed uses autonomy or action scope as its defining test. By that test, a deliberately bounded advisory agent would not count as an agent at all.

Next step

See this layer at work in the proposed vegetation inspection example. Then read the next layer, the productivity and collaboration layer (R08).

Explore this topic
  • Agent platform findings and sources.
  • Products named for orientation, on the one-page wall chart.
  • Estate table: industry research for utilities, healthcare and energy, 15 October 2026. Rows are industry knowledge unless a source is named.
  • Table sources: AGL on IBM watsonx (IBM case study, undated) [vendor]. Hansen AI Virtual Agent (18 February 2025) [vendor]. Mercury Hiko (Datacom, 2019). SAP Joule Studio availability (SAP Community roundup, title only).
  • Table sources: IBM Maximo MCP server (IBM, 12 August 2026; MAS 9.2, 25 June 2026) [vendor]. LiveEO Treeline Agent and MCP (2 July 2026) [vendor]. AVEVA MCP plans (20 May 2026) [vendor]. AWS alarm investigation design (1 September 2026) [vendor].
  • Table sources: Kraken and Sierra (11 to 12 June 2026) [vendor]. SAP billing agents (ASUG, 21 January and 27 May 2026) [vendor]. Healthdirect triage (Medical Republic, 2025). Heidi II (Medical Republic, 30 September 2026). Epic Agent Factory (HIT Consultant, 10 March 2026).
  • Table sources: Woodside Startup Advisor (2 July 2026). Uniper on Copilot Studio (Celonis case study, undated) [vendor]. Cat AI Assistant (6 January 2026) [vendor]. Honeywell Experion (19 March and 9 June 2026) [vendor]. Palantir and Rio Tinto (12 November 2024). ADNOC and AIQ (10 March 2025).
  • Harness results: Meta REA doubled average accuracy across six models. Staffing moved from two engineers per model to three across eight models [vendor].
  • Harness effects: Yi and Song, arXiv 2607.04528, July 2026. Harness choices often left outcomes unchanged while changing the beliefs behind later decisions.
  • Retrieval inside harnesses: Sen et al., arXiv 2605.15184, May 2026. On 116 LongMemEval questions, grep generally beat vector retrieval. The variation depended on the harness.
  • Routing: Rice and Amazon, arXiv 2606.07587, May 2026. Hard queries were 11 to 35 percent of benchmarks and 70 to 91 percent of the gap. The best combined fix closed 14.6 percent.
  • Release states: Kang and Wang, arXiv 2607.00345, July 2026. Thresholds: faithfulness 0.80, correctness 0.90, tool accuracy 0.90, helpfulness 0.70, latency 15 seconds, harm 5 percent. Evaluation cost $2.10 a month at 10,000 interactions.
  • Durable execution customers named by the engine's vendor: OpenAI, Cursor, Lovable, Block, Abridge and Hebbia [vendor].
  • Single or many agents: the orchestrator-worker win of about 90 percent used about 15 times chat-level tokens [vendor]. Token use explains about 80 percent of variance on a related benchmark [vendor].
  • One vendor compared a solo agent with a full harness on one task. It took 20 minutes and $9, against 6 hours and $200 [vendor].
  • Tran and Kiela, arXiv 2604.02460, April 2026. With reasoning tokens held constant, single agents match or beat multi-agent systems on multi-hop reasoning.
  • Crossover: arXiv 2603.22651. A supervisor-worker design held 0.921 F1 at 1.4 times the cost. A hybrid got most of the gain at 1.15 times.
  • Coordination cost: arXiv 2606.08878. Across 10 topologies, the average pass rate was 17.2 percent. Average information leakage was 217.9 percent per scenario.
  • In production, 59 percent of agentic requests make one service call, and 18 percent make three or more [vendor].
  • Build or buy: about 82 percent of instrumented organisations run agent workloads with no recognised framework [vendor]. Whole AI solutions swung from 47 percent built (2024) to 76 percent bought (2025).
  • The year's major framework merger reached version 1.0 in April 2026. Its surface kept changing for four more months.
  • Survey context: in December 2025 (495 respondents), only 16 percent of enterprise deployments passed a strict test for true agents.
  • Survey context: in July 2026 (100+ leaders), 43 percent limit agents to low-risk work. 33 percent require human approval and 20 percent permit broad autonomy.
  • Skills marketplaces: arXiv 2607.09065. Of 775,790 skills, 11,497 were unique. Only 6.3 percent appear on more than one marketplace. 24 percent raised an instruction-scope concern.
  • The vendor's own documentation says custom skills do not sync across its products.
  • MAST: NeurIPS 2025, inter-rater agreement (kappa) 0.88, 14 failure modes in 3 categories. Benchmark contest: arXiv 2605.08518, 149 teams.
  • Excluded: build-or-buy figures from vendor blogs without method. A token comparison wrongly attributed to AssetOpsBench. A claim that one essay predated a rival post by months; the two are dated one day apart.
  • Excluded as unverified: a compaction saving, a cost claim for an open router and a skills effect size. Also excluded: a framework end date and a failure share credited to MAST. No defensible source gives a ratio of agents to supervisors.
  • Re-verify quarterly: framework change after general availability, the release-state design beyond proof of concept, routing replication, and skills-marketplace hygiene.

Cite this page

Written by Murali Sid, Founder and AI Systems Architect, last updated 15 October 2026. Licensed CC BY-SA 4.0, so quote it freely with attribution.

Murali Sid (2026). Agent platform. Agentic Architecture Skills. https://www.agenticarchitectureskills.com/layers/r07-agent-platform

Machine-readable version of this page: /layers/r07-agent-platform.md

Intelligence and learning

How agents get better without quietly getting worse: experts own the tests, model judges grade with human spot checks, and a rule reaches production only after it survives attempts to break it.

Productivity and collaboration

What office tools must provide for agents: every agent gets its own identity with a named sponsor, a mailbox or meeting seat is a rare separate grant, and assistants roll out task by task.

On this page

What sits in this layer todayWhat agents addThe harness is the productEvery run has several ways to stopState lives in files a person can readThe run survives a crashOnly tested versions runSimple routing beats clever routingWhat moves between vendorsA worked example: alarm investigationWhat must be true before an agent touches itChoices and their verdictsConcerns this layer must honourEvidence and limitsNext step