Architectures for Building Agentic AI

AI summary

Overview

• Research area: Agentic and generative AI system design, with a specific focus on reliability engineering for autonomous, tool-using AI systems.
• Technical level: Intermediate. The chapter is conceptual and architectural rather than mathematical; it assumes some familiarity with large language models, retrieval-augmented generation, and classical agent concepts, but presents its arguments through components, interfaces, and design patterns rather than equations or experiments.
• Scope in one sentence: The chapter argues that the reliability of agentic AI comes primarily from architectural structure — decomposition, contracts, and control loops — and surveys recurring agent architectures with an analysis of the failure modes and safeguards each one requires.

Note on completeness: The supplied content is a truncated preprint of Chapter 3 of Generative and Agentic AI Reliability: Architectures, Challenges, and Trust for Autonomous Systems (Springer Nature), arXiv:2512.09458v1 [cs.AI], 10 Dec 2025, by Sławomir Nowaczyk (Center for Applied Intelligent Systems Research, Halmstad University, Sweden), licensed CC BY 4.0. The text cuts off mid-sentence inside Section 3.4 (Multi-agent systems), so the treatment of the fifth taxonomy family (embodied or web agents) and any later sections are not available in the provided content.

What This Paper Is About

The chapter addresses a practical problem: even state-of-the-art generative models behave inconsistently, cannot be audited, and break down on novel situations when they are not wrapped in the right engineering scaffolding. Its goal is to show that reliability in agentic and generative AI is chiefly an architectural property — emerging from how a system is split into components, how the interfaces between those components are specified and enforced, and how control and assurance loops are wrapped around the parts that reason, remember, and act. It delivers this through a taxonomy of modern agentic architecture families, an analysis of each family's failure modes, and concrete design guidance for building dependable systems.

Key Contributions

1. A definitional framing of reliability as architecture. The chapter defines agentic AI as goal-directed, tool-using decision makers operating in closed loops — observing, planning, acting, and learning under uncertainty and partial observability — and defines reliability as the consistent achievement of intended outcomes under stated conditions, within acceptable bounds of safety, security, data protection, and resource usage, and with evidence that failure modes are known, contained, and recoverable.

2. A component-level reference architecture. It proposes a decomposition into a goal manager, perception and retrieval layer, planner, tool router, execution gateway, verifier/critic, memory subsystem, and safety supervisor, plus an immutable audit trail — and identifies three mutually reinforcing design levers that determine behaviour under stress: componentisation, interfaces and contracts, and control and assurance loops.

3. A pattern-centric taxonomy of five agentic architecture families. These are tool-using agents, memory-augmented agents, planning and self-improvement agents, multi-agent systems, and embodied or web agents, organised along five orthogonal facets: reasoning mode, memory strategy, control structure, action surface, and assurance envelope. Each family is analysed for the risks it introduces and the reliability tools needed to control it.

4. A consolidated set of design guidance and mitigation strategies. These include typed schemas and validators, idempotent tools and request deduplication, capability-based permissioning with least privilege, transactional semantics and compensations ("saga" patterns), memory provenance and hygiene, runtime governance through budgets and termination criteria, and simulate-before-actuate safeguards.

Main Findings

• Reliability is an architectural property, not a model property. The chapter's central claim is that without the right scaffolding, models will behave inconsistently and prove fragile; the architecture supplies the machinery for validating, enacting, bounding, and recording what the generative model proposes.

• Three design choices determine behaviour under stress. Componentisation confines faults to well-defined boundaries and limits their blast radius; interfaces and contracts convert free-form model outputs into predictable, auditable actions; control and assurance loops prevent small reasoning slips from cascading into hazardous sequences and enable graceful degradation.

• Classical architectures remain relevant. Reactive architectures fail through myopic responses, partial observability, and unmodelled delays; deliberative architectures fail through stale plans, model incompleteness, and computational overrun; hybrids remain the most practical template but fail through coordination faults such as unclear authority between layers or missing hand-off criteria.

• BDI maps cleanly onto modern generative agents. Beliefs map to world state and memory (short-term scratchpads, episodic case logs, long-term semantic stores); Desires map to goals and constraints; Intentions map to active plans and tool calls. Assurance belongs at adoption filters, execution monitors, and reconsideration policies.

• Tool-using agents gain reliability from separating three concerns. Planners generate intentional structure, tool routers map abstract actions to concrete permissioned tools, and execution sandboxes perform pre-condition checks, rate limits, simulation, and transactional commitment. Three illustrative patterns are analysed: MRKL (neuro-symbolic modularity with a tool-router-first worldview), ReAct (interleaved reasoning and acting with human-readable trajectories), and ReWOO (plan-then-execute, which makes the plan an auditable artefact with verifiable pre- and post-conditions).

• Characteristic tool-use failure modes and their mitigations are identified. Hallucinated tools or arguments are addressed by whitelisting tool names and schema validation; infinite or unproductive loops by step and time budgets with safe halts; tool flakiness by "design for retry" with jitter, circuit breakers, and degrade-to-read-only advice; prompt or retrieval injection by sanitising tool outputs and treating untrusted text as data rather than instructions. The guiding principle stated is "models propose, architectures dispose."

• Memory should be treated as a first-class subsystem. Working memory, episodic memory, and semantic memory serve distinct functions; RAG provides a non-parametric pathway into semantic memory; and MemGPT-style virtual context reframes memory as an active subsystem with admission, eviction, and prefetch policies. Reliability requires provenance and attribution, freshness and validity windows, poisoning defences with trust tiers, compaction and retention policies, separation of working memory from long-term stores, and deterministic APIs such as retrieve, write, page_in, and evict.

• Planning and self-improvement agents deliver large gains but need governance. Tree of Thoughts turns inference into search over intermediate thoughts with branching, depth, and scoring policy as explicit levers, showing gains over chain-of-thought on case studies including Game of 24, creative tasks, and mini crosswords. Graph of Thoughts generalises this to arbitrary dependency graphs with reported quality improvements and cost reductions relative to Tree of Thoughts. PAL shifts reasoning into executable programs run by a trusted interpreter, and Reflexion adds verbal self-reflection stored in episodic memory without gradient updates. All require search control, decoupled verifiers, test-time repair, cost and latency governance, sandboxed execution, and provenance for replay.

• Multi-agent systems trade a single generalist for a specialised team. Supervisor–worker topologies are easy to govern because authority and escalation paths are clear, while peer collaboration relies on protocol rules such as turn-taking and proposal–critique–revise cycles. The content available ends here, mid-sentence; the analysis of this family and of embodied or web agents is not available in the supplied text.

Methodology in Plain English

The chapter is a conceptual and architectural survey rather than an experimental study — no new benchmarks, datasets, or model training runs are reported. The author builds the argument in three layers.

First, he establishes definitions and a reference architecture, then walks through a single running example — a fleet operator responsible for electric power systems in autonomous service vehicles, whose agent triages anomalies, recommends mitigations, and executes pre-approved actions within a narrow envelope — to show step by step where the architecture contributes reliability: containment and least authority, validators before actuators, assured fallbacks, observability, memory hygiene, and cost and latency governance.

Second, he reviews classical agent foundations (reactive, deliberative, and hybrid architectures; the BDI model) to extract the control abstractions that modern systems still need and to map them onto generative components.

Third, he organises contemporary designs into families along a small set of orthogonal facets and, for each family, compares reasoning and control, memory, action surface, assurance envelope, risks, and mitigations — presented as a comparison figure in the chapter — and then discusses selected influential patterns in depth with their specific failure modes and safeguards. The chapter repeatedly notes that it is not comprehensive and that the three tool-use patterns discussed were subjectively selected to illustrate distinct trade-offs.

Why This Matters

Impact on research. The chapter reframes the reliability conversation away from pure model-centric benchmarking and toward architectural design. It connects decades-old work on autonomous agents, BDI, and commitment strategies with the newer behaviour of foundation-model-driven systems, arguing that some challenges are well understood while others are genuinely novel and require rethinking what was believed to be known. It also frames assurance as something to design in from the first diagram rather than bolt on after the first incident.

Real-world applications (the running example and the transfer targets named explicitly in the chapter):

• Fleet operations for electric power systems in autonomous service vehicles — anomaly triage, digital-twin simulation, and reversible derating commands under operator oversight.
• Data-centre operations.
• Industrial robotics.
• Clinical decision support.

The chapter states that the same architecture applies with minor changes across these settings: swap the tools, adjust the policies, retain the architectural guarantees.

Industry relevance. The design guidance is directly actionable for engineering teams: typed schemas and validators, idempotency tokens and deduplication, least-privilege capability scoping, saga-style compensating actions, budgets and "why-stopped" codes, deterministic observability with input hashes and policy snapshots, and two-phase writes to knowledge stores. These practices matter for auditability, regulatory evidence, predictable latency and cost, human-override paths, and limiting the blast radius of an incident.

Future Directions

• Setting budget and termination thresholds. The chapter states explicitly that determining the exact thresholds for step or time budgets is not necessarily straightforward — an open practical question for any deployment.
• Balancing reliability against creativity. Constraining the tools available to an agent improves reliability but trades off against creativity; the chapter notes this tradeoff without resolving where the line should sit.
• Robust injection defence. Sanitising tool outputs, stripping control tokens, and treating untrusted text as data rather than instructions is described as easier said than done, leaving room for better practical techniques.
• Governance of multi-agent coordination. The available content introduces coordination failure and chatter as risks for multi-agent systems and mentions protocols, quorum, and leadership hand-off as mitigations, but cuts off before elaborating — the full treatment of team topologies, embodied and web agents, and the broader assurance discussion is not available in the supplied text.

Target Audience

The chapter is written for architects, engineers, and technical leads building agentic AI systems who need principled templates and checklists rather than a broad introduction to generative AI. It also suits reliability, safety, and security engineers responsible for assurance, auditability, and incident response in systems that take actions; researchers in autonomous agents and generative AI who want the classical foundations reconciled with modern practice; and technically literate readers in regulated domains — such as energy, industrial automation, and clinical decision support — who need to reason about bounded failure modes, escalation paths, and human oversight. A working familiarity with large language models, tool calling, and retrieval-augmented generation is helpful but not required.

Authors’ abstract

This chapter argues that the reliability of agentic and generative AI is chiefly an architectural property. We define agentic systems as goal-directed, tool-using decision makers operating in closed loops, and show how reliability emerges from principled componentisation (goal manager, planner, tool-router, executor, memory, verifiers, safety monitor, telemetry), disciplined interfaces (schema-constrained, validated, least-privilege tool calls), and explicit control and assurance loops. Building on classical foundations, we propose a practical taxonomy-tool-using agents, memory-augmented agents, planning and self-improvement agents, multi-agent systems, and embodied or web agents - and analyse how each pattern reshapes the reliability envelope and failure modes. We distil design guidance on typed schemas, idempotency, permissioning, transactional semantics, memory provenance and hygiene, runtime governance (budgets, termination conditions), and simulate-before-actuate safeguards.