# Agent platform
Where agents run: buy the runtime, build the loop around the model, give every run several ways to stop, keep its state where people can read it, and let only tested versions run.
Author: Murali Sid (https://linkedin.com/in/muralisid)
Source: https://www.agenticarchitectureskills.com/layers/r07-agent-platform
Published: 2026-08-20
Updated: 2026-10-15
Licence: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/
Cite as: Murali Sid. Agent platform. Agentic Architecture Skills. https://www.agenticarchitectureskills.com/layers/r07-agent-platform
---
The agent platform layer (R07) is where agents run. It is one of the [fourteen layers](/layers) you own, and it is mostly new. Today it holds robotic process automation bots, workflow and rule engines, chatbots and copilots. Agent builders inside vendor products are arriving on top. When agents arrive, this layer becomes the home of the runtime. The runtime is one of the [seven capabilities](/architecture/system-view) an agent platform adds. This layer must provide a loop around the model with several independent ways to stop. It must keep each run's state where a person can read it, and survive a crash. It must also let only tested versions of an agent run. The loop around the model is called the harness. It decides what the model sees, what it may call and when it stops. Buy the runtime from a vendor. Build and own the harness yourself.
## What sits in this layer today [#what-sits-in-this-layer-today]
Here is what a typical estate already runs in this layer. Vendors in brackets are examples, not a market claim.
| System category | Electricity distributor | Water utility | Hospital network | Generator, oil and gas, or miner |
| ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Automation: robotic process automation and rule engines (UiPath, Blue Prism, Power Automate, SAP BPEM, Pega) | Bots move data between billing, market and email screens at many retailers (typical, unsourced). SAP's exception queue routes billing exceptions | Same. Oracle CC\&B sites route exceptions with configurable algorithms | Bots register referrals, run payroll steps and file results (typical, unsourced) | Bots handle invoices, joint venture statements and regulatory forms (typical, unsourced) |
| Chatbots and virtual agents | Retailers: AGL's assistant on IBM watsonx \[vendor]. Mercury's Hiko in NZ (2019) | Customer chatbots. Hansen's AI Virtual Agent for its own billing system \[vendor] | Website chatbots. Healthdirect virtual triage handled about 1.55 million encounters from April 2023 to March 2025 | Cat AI Assistant for mining fleets. Launch window Q1 2026, availability not confirmed \[vendor] |
| Copilots and assistants (Microsoft 365 Copilot, Copilot Studio) | Copilot use and Copilot Studio builds | Same | Copilot Studio and Azure OpenAI pilots (typical, unsourced) | Woodside's Startup Advisor (July 2026). Uniper builds agents in Copilot Studio \[vendor] |
| Agent builders inside vendor products | SAP Joule Studio, generally available Q1 2026 per a roundup. Salesforce Agentforce | Same | Epic Agent Factory, previewed March 2026. Wider release reported for 2027, not verified \[vendor] | Cognite Atlas AI, Seeq "Build Your Own Agent", Siemens Intelligence Center X, Emerson AVA \[vendor] |
| Tool servers for agents (Model Context Protocol, MCP) | IBM Maximo MCP server for work orders (August 2026) \[vendor]. LiveEO Treeline MCP, in early access \[vendor] | AVEVA says MCP links for its historian are coming (May 2026) \[vendor] | None found | IBM Maximo MCP server in MAS 9.2 (June 2026) \[vendor] |
| Vendor agents announced for the industry | Retail side: Kraken agents with Sierra, live at one unnamed utility (June 2026) \[vendor]. SAP's billing agents not confirmed shipped | Hansen's agent claims it can arrange payment plans. One named US deployment \[vendor] | Heidi II, launched 28 September 2026, rolling out in Australia and NZ, primary care first. No public hospital site found \[vendor]. Epic, Oracle and Microsoft agents are US-first | Honeywell Experion Operations Assistant, launched March 2026, advises operators \[vendor]. Experion Cognition says it will act; availability not confirmed |
| Own runtime, registry and tracing | AWS published a read-only alarm investigation design on Bedrock AgentCore (September 2026) \[vendor] | None found | No Australian or NZ public health service found with its own runtime, registry or per-agent identity | Platform deals: Palantir AIP at Rio Tinto (November 2024). ADNOC's USD 340 million contract for ENERGYai (March 2025) |
Standards: the Model Context Protocol for tools, and agent-to-agent (A2A) messaging in energy. Nothing is specific to any of these industries. Hospitals also apply local AI assurance frameworks, covered on the [governance, risk and sovereignty layer (R11)](/layers/r11-governance-risk-sovereignty). The full estates are on the [utilities](/use-cases/utilities), [healthcare](/use-cases/healthcare) and [energy](/use-cases/energy) pages.
## What agents add [#what-agents-add]
### The harness is the product [#the-harness-is-the-product]
Everything that separates a working agent from a demo lives in the harness. It assembles and resets the context, calls tools, records state, checks the work and stops the loop. Production practice has settled on four habits. State lives outside the model's working memory, in files a person can read. Stopping rests on more than one condition. A separate agent or process checks the work, because models praise their own weak work. Recovery from failure is a planned path, not an afterthought.
Meta's production harness, called REA, has the strongest published results. It doubled average model accuracy across six production models \[vendor]. Harness choice can also matter more than the retrieval method. On 116 memory questions run through four harnesses, plain text search generally beat vector search (May 2026). So a benchmark comparison across different harnesses cannot tell you which part made the difference.
### Every run has several ways to stop [#every-run-has-several-ways-to-stop]
A production loop needs several independent ways to stop. The limits are a step cap, a time cap and a cancellation check between rounds. They also include stop hooks, approval rules, a per-run token and cost budget, and a kill switch. Each agent has a budget with hard caps. The VS Code Copilot harness (May 2026) publishes its stop conditions. The Microsoft Agent Framework Harness (July 2026) gives the fullest published list of harness parts.
Tool approval is decided in the harness, because only the harness sees the whole loop. It is enforced at the tool gateway, because the harness is not a security boundary. The gateway sits in the [integration fabric layer (R03)](/layers/r03-integration-fabric).
### State lives in files a person can read [#state-lives-in-files-a-person-can-read]
Long-running work keeps its state in three files \[vendor]. The first is a feature list, with every feature marked failing at the start. The second is a progress log, and the third is the version history in git. Work runs one feature per session, with a fixed checklist at the start of each. Prefer resetting the context to squeezing it into a summary. Sub-agents return short summaries of 1,000 to 2,000 tokens, not full transcripts. Skills load their detail only when needed. Each skill costs about 100 tokens of always-loaded description. Its body, under 5,000 tokens, loads only when the skill is triggered \[vendor].
### The run survives a crash [#the-run-survives-a-crash]
Saving a run's data is not the same as making the run survive. A checkpoint saves data, but a checkpointed run still lives in one process. If that process dies, the run dies with it \[vendor]. Durable execution makes the run itself survive a crash. A pause for a human approval then uses no resources and survives worker restarts. That makes day-long approval waits affordable. Very long jobs can sleep and wake, as Meta's REA does. The other path avoids the engine entirely. Reset the context and carry state in the files above.
The [infrastructure and compute layer (R01)](/layers/r01-infrastructure) provides the durable sessions underneath. This layer decides which runs need them.
### Only tested versions run [#only-tested-versions-run]
One published design moves each agent version through five release states (Kang and Wang, July 2026). They are draft, approved, published, deprecated and retired. Each promotion gate has a named threshold. For example, correctness must be at least 0.90 and harm at most 5 percent. Each agent is re-tested every 7 days and demoted if it fails. Search through MCP returns only published agents, so a weaker agent becomes harder to reach. This is a six-agent proof of concept by a cloud consultancy, not observed enterprise practice.
These five states track one version's release inside the nine-stage [agent lifecycle](/architecture/agent-lifecycle), which tracks the whole agent. Draft and approved fall in its evaluate and approve stages, and published means the registry state active.
An agent's autonomy level is itself a versioned setting that needs review to change. Prompt refinements take a light review. Model updates and autonomy changes take a full review. The levels are set out on the [autonomy contract](/architecture/autonomy-contract) page. One pharmaceutical programme publishes five levels of agency. It requires policy enforcement at the AI gateway before the higher levels are switched on.
### Simple routing beats clever routing [#simple-routing-beats-clever-routing]
A May 2026 study by Rice and Amazon compared 21 routing methods across 5 benchmarks. The top 5 finished within 0.22 points of each other. All of them trailed a perfect router by 10 to 30 points. Hard queries caused most of that gap. A simple nearest-neighbour lookup beat the trained methods on every benchmark. So a cleverer router does not help much. What helps is fixed first-step rules, clear limits on which model handles what, and fallbacks. About 70 percent of instrumented organisations run three or more models \[vendor]. Light models handle extraction and tagging, and large models handle synthesis.
### What moves between vendors [#what-moves-between-vendors]
Managed runtimes now accept most agent frameworks. One hyperscaler runtime takes LangChain, the OpenAI Agents SDK, the Claude Agent SDK, Strands or your own code. Harnesses stayed custom. So the runtime is now easier to move between vendors than the harness. Prompts, tool definitions, model choice and Agent Skills move between vendors. Control flow, saved state formats, human-pause handling and approval models do not. Put portability effort into the harness design, not into the choice of framework.
### A worked example: alarm investigation [#a-worked-example-alarm-investigation]
AWS published a reference design for utility alarm investigation on its agent runtime (September 2026) \[vendor]. One agent reads work orders from Maximo, and another reads the PI historian. Both have read-only database access. The utility behind it is not named. In this shape, the runtime is bought and the harness decides what each agent reads and when it stops. Any work order the investigation proposes should stay a draft until a person approves it.
| Part | What it does | Where it runs |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| Harness | Assembles and resets context, runs the tool loop, stops and recovers. Holds the caps, budgets, approval rules and kill switch | Built in-house, deployed on the managed runtime |
| Managed runtime | Sandbox, session store, identity, scaling and crash survival | A hyperscaler agent runtime or a self-hosted equivalent |
| Checking path | Grades outputs apart from generation | A separate evaluator agent or process |
| Agent registry | Holds each agent's lifecycle state and each version's release state | Beside the tool catalogue in the integration fabric layer (R03) |
| Skill library | Curated skills, signed and version-pinned | An internal repository |
| Model router | Sends each request to the right model, with fixed first-step rules and fallbacks | The model gateway you already run |
| Durable execution engine | Keeps runs alive through crashes and long approval pauses | A workflow engine, or state files instead |
## What must be true before an agent touches it [#what-must-be-true-before-an-agent-touches-it]
Before an agent runs on this platform, these must hold.
* **It is registered.** A registry record holds its lifecycle state, its owner and its sponsor.
* **It has its own identity.** The [security and identity layer (R10)](/layers/r10-security-and-identity) issues it. The harness carries the caller's identity into every tool call. The [delegation chain](/architecture/delegation-chain) then traces each action to the person who asked.
* **It has several ways to stop.** Step and time caps, a cancellation check and stop hooks are set. Approval rules, a capped budget and a kill switch are set too.
* **Checking is separate.** The part that generates the work never grades it.
* **State is readable.** Long-running work keeps its state outside the context, in files a person can inspect.
* **Crash recovery is tested.** Runs that wait on people use durable execution or carry their state in files.
* **Its autonomy is set and versioned.** Changing it needs a full review.
* **Its skills are signed.** Skills and instruction files are version-pinned and checked for scope before use.
The harness is not the enforcement point. It decides when to ask for approval. The tool gateway and the policy decision point enforce the answer, outside the model. That is [enforcement outside the model](/architecture/enforcement).
## Choices and their verdicts [#choices-and-their-verdicts]
Each choice is the common choice, tested against the simplest credible alternative. The full records are in the [decision catalog](/decisions).
* **[One agent or many](/decisions#cd-21) (CD-21):** use several agents only for wide work that splits into independent parts. Most famous multi-agent gains came from spending about 15 times the tokens.
* **[Vendor-embedded agents or your own](/decisions#cd-17) (CD-17):** use the vendor's agent when work stays inside one product. Use your own agents when work spans systems.
* **[Replace robotic process automation or keep it](/decisions#cd-3) (CD-3):** keep the bots running beside agents, under supervision. Replace one only when a workload earns it.
* **Build or buy the harness:** buy the runtime, build the harness, and expect to own its upkeep. No credible published dataset exists for this choice.
## Concerns this layer must honour [#concerns-this-layer-must-honour]
The ten cross-cutting concerns are set out in the [concern matrix](/architecture/concern-matrix). This layer carries a specific duty for seven of them.
* **Identity and access:** the harness carries caller identity into every tool call. Approval rules live in the harness and are enforced at the gateway.
* **Observability:** loop telemetry covers steps, stops by type, context resets and how many sub-agents ran.
* **Traceability and audit:** session files and event logs are the durable record. Each released version traces to its test evidence.
* **Grounding:** checking is separate from generation. Self-assessment is distrusted by default.
* **Safety and oversight:** caps, stop hooks, approval rules and the kill switch.
* **Cost:** per-run budgets are enforced in the harness. The multi-agent token cost is chosen per task.
* **Resilience:** durable execution or state in files, with crash recovery tested.
## Evidence and limits [#evidence-and-limits]
The failure record here comes from traces, not vulnerability records. A taxonomy called MAST (NeurIPS 2025) was built from 150 traces and checked on more than 1,600. It names 14 failure modes and finds that multi-agent failures are design failures. A benchmark contest over 2,196 traces found that spending more tokens did not predict success. Winning teams improved their guardrails, not their architectures.
Several figures come from vendors and carry the \[vendor] tag. They include the multi-agent token figures, the three-file pattern and the checkpoint framing. The framework and single-call telemetry also comes from vendors, though it was measured, not self-reported. The five-state release design is a six-agent proof of concept.
This guide recommends judging an embedded agent by tested behaviour and logged exceptions, not by its autonomy. Every published taxonomy reviewed uses autonomy or action scope as its defining test. By that test, a deliberately bounded advisory agent would not count as an agent at all.
## Next step [#next-step]
See this layer at work in the proposed [vegetation inspection](/use-cases/vegetation-inspection) example. Then read the next layer, the [productivity and collaboration layer (R08)](/layers/r08-productivity-and-collaboration).
Explore this topic
* [Agent platform findings](/library/layers/r07-agent-platform/findings) and [sources](/library/layers/r07-agent-platform/sources).
* [Products named for orientation](/architecture), on the one-page wall chart.
* Estate table: industry research for utilities, healthcare and energy, 15 October 2026. Rows are industry knowledge unless a source is named.
* Table sources: AGL on IBM watsonx (IBM case study, undated) \[vendor]. Hansen AI Virtual Agent (18 February 2025) \[vendor]. Mercury Hiko (Datacom, 2019). SAP Joule Studio availability (SAP Community roundup, title only).
* Table sources: IBM Maximo MCP server (IBM, 12 August 2026; MAS 9.2, 25 June 2026) \[vendor]. LiveEO Treeline Agent and MCP (2 July 2026) \[vendor]. AVEVA MCP plans (20 May 2026) \[vendor]. AWS alarm investigation design (1 September 2026) \[vendor].
* Table sources: Kraken and Sierra (11 to 12 June 2026) \[vendor]. SAP billing agents (ASUG, 21 January and 27 May 2026) \[vendor]. Healthdirect triage (Medical Republic, 2025). Heidi II (Medical Republic, 30 September 2026). Epic Agent Factory (HIT Consultant, 10 March 2026).
* Table sources: Woodside Startup Advisor (2 July 2026). Uniper on Copilot Studio (Celonis case study, undated) \[vendor]. Cat AI Assistant (6 January 2026) \[vendor]. Honeywell Experion (19 March and 9 June 2026) \[vendor]. Palantir and Rio Tinto (12 November 2024). ADNOC and AIQ (10 March 2025).
* Harness results: Meta REA doubled average accuracy across six models. Staffing moved from two engineers per model to three across eight models \[vendor].
* Harness effects: Yi and Song, arXiv 2607.04528, July 2026. Harness choices often left outcomes unchanged while changing the beliefs behind later decisions.
* Retrieval inside harnesses: Sen et al., arXiv 2605.15184, May 2026. On 116 LongMemEval questions, grep generally beat vector retrieval. The variation depended on the harness.
* Routing: Rice and Amazon, arXiv 2606.07587, May 2026. Hard queries were 11 to 35 percent of benchmarks and 70 to 91 percent of the gap. The best combined fix closed 14.6 percent.
* Release states: Kang and Wang, arXiv 2607.00345, July 2026. Thresholds: faithfulness 0.80, correctness 0.90, tool accuracy 0.90, helpfulness 0.70, latency 15 seconds, harm 5 percent. Evaluation cost $2.10 a month at 10,000 interactions.
* Durable execution customers named by the engine's vendor: OpenAI, Cursor, Lovable, Block, Abridge and Hebbia \[vendor].
* Single or many agents: the orchestrator-worker win of about 90 percent used about 15 times chat-level tokens \[vendor]. Token use explains about 80 percent of variance on a related benchmark \[vendor].
* One vendor compared a solo agent with a full harness on one task. It took 20 minutes and $9, against 6 hours and $200 \[vendor].
* Tran and Kiela, arXiv 2604.02460, April 2026. With reasoning tokens held constant, single agents match or beat multi-agent systems on multi-hop reasoning.
* Crossover: arXiv 2603.22651. A supervisor-worker design held 0.921 F1 at 1.4 times the cost. A hybrid got most of the gain at 1.15 times.
* Coordination cost: arXiv 2606.08878. Across 10 topologies, the average pass rate was 17.2 percent. Average information leakage was 217.9 percent per scenario.
* In production, 59 percent of agentic requests make one service call, and 18 percent make three or more \[vendor].
* Build or buy: about 82 percent of instrumented organisations run agent workloads with no recognised framework \[vendor]. Whole AI solutions swung from 47 percent built (2024) to 76 percent bought (2025).
* The year's major framework merger reached version 1.0 in April 2026. Its surface kept changing for four more months.
* Survey context: in December 2025 (495 respondents), only 16 percent of enterprise deployments passed a strict test for true agents.
* Survey context: in July 2026 (100+ leaders), 43 percent limit agents to low-risk work. 33 percent require human approval and 20 percent permit broad autonomy.
* Skills marketplaces: arXiv 2607.09065. Of 775,790 skills, 11,497 were unique. Only 6.3 percent appear on more than one marketplace. 24 percent raised an instruction-scope concern.
* The vendor's own documentation says custom skills do not sync across its products.
* MAST: NeurIPS 2025, inter-rater agreement (kappa) 0.88, 14 failure modes in 3 categories. Benchmark contest: arXiv 2605.08518, 149 teams.
* Excluded: build-or-buy figures from vendor blogs without method. A token comparison wrongly attributed to AssetOpsBench. A claim that one essay predated a rival post by months; the two are dated one day apart.
* Excluded as unverified: a compaction saving, a cost claim for an open router and a skills effect size. Also excluded: a framework end date and a failure share credited to MAST. No defensible source gives a ratio of agents to supervisors.
* Re-verify quarterly: framework change after general availability, the release-state design beyond proof of concept, routing replication, and skills-marketplace hygiene.