Enterprise Agent Platform Stack

An enterprise agent platform is a governed distributed system with probabilistic components. It needs durable execution, identity-aware context, policy enforcement, evidence, evaluation and rollback—not merely an agent builder or a collection of prompts [src-251, src-255, src-256].

The eight layers

1. Enterprise data, knowledge and memory

• Connectors should read authoritative systems of record rather than silently creating competing truth stores.
• Retrieval must evaluate the user, agent, purpose, tenant and current access policy.
• Keep ephemeral working context, retrieved evidence, private memory, shared memory, institutional knowledge and workflow state separate.
• Durable memory needs provenance, sensitivity, confidence, permissions, expiry and supersession metadata ^[src-259].
• Candidate memories should be quarantined until validated and approved.

2. Model gateway, routing and safety

• Maintain an approved-model registry with residency, retention and use-case restrictions.
• Route by quality, risk, latency and cost rather than one default model.
• Record model, prompt, policy and decoding versions for every consequential decision.
• Fallback models must remain inside the evaluated operating envelope.

3. Agent development frameworks

• Register each agent's owner, purpose, schemas, tools, permissions, risk class and evaluation suite.
• Prefer typed contracts and bounded roles to open-ended persona conversations.
• Use deterministic code for known process structure and model reasoning for genuine ambiguity.
• Keep methodologies, SDKs, runtimes, platforms and protocols distinct [src-252, src-253].

4. Durable orchestration

• Persist task state, checkpoints, idempotency keys, deadlines, cancellation, retries and compensating actions.
• Use central coordination for consequential multi-agent workflows.
• Bound agent count, rounds, tokens, tool calls and wall-clock time.
• Separate proposer, executor and verifier when independent checking is valuable.
• Repeated model opinions are not independent evidence [src-256, src-257].

5. Tools and interoperability

• Use MCP for structured access to tools, resources and prompts.
• Use A2A for discovery and stateful work between independent agents.
• Keep OpenAPI, events and ordinary service calls where agent protocols add no value.
• Treat every remote agent, MCP server, model and memory service as a supplier.
• Protocol conformance advertises capability; it does not prove trust ^[src-254].

6. Identity, security and human authority

• Give users, agents, workloads and services distinct identities.
• Broker short-lived credentials at action time.
• Separate permissions to read, infer, remember, delegate and act.
• Gate actions by consequence, not simply by tool name.
• Preserve the complete delegation chain and every external effect in an immutable ledger.
• Provide manual takeover, kill switch and rollback ^[src-255].

7. Evaluation, observability and controlled learning

Traces should connect user intent, task and agent IDs, model and prompt versions, retrieved sources, memory IDs, tool and protocol calls, approvals, safety decisions, external effects, latency, tokens, cost and evaluation results.

Evaluation must include:

• single-agent and non-agent baselines;
• equal-cost or equal-token comparisons;
• task success and business outcomes;
• retrieval, provenance and access-control tests;
• hand-off and error-propagation tests;
• adversarial cases and graceful degradation;
• human calibration of automated judges;
• shadow, canary and post-deployment monitoring [src-255, src-256, src-257].

8. User surfaces and systems of record

• Show evidence, confidence and freshness.
• Distinguish retrieval, memory and model inference.
• Preserve human correction and escalation.
• Write commitments to systems of record rather than leaving them in chat or vector memory.
• Prevent agent drafts from being mistaken for approved organisational decisions.

Minimum viable enterprise control plane

A credible minimum includes:

• agent, model and tool registry;
• workload and end-user identity;
• policy decision and enforcement points;
• credential broker;
• durable orchestration;
• tenant-aware context gateway;
• governed memory with provenance and supersession;
• approval and external-effect ledger;
• distributed traces and cost accounting;
• versioned evaluation suites;
• incident response, kill switch and rollback;
• supplier and protocol-conformance management.

Related

• Governed Enterprise Agent Learning
• Agent Orchestration
• Enterprise Agent Governance
• Continuous Agent Evaluation
• Enterprise AI-Agent Platforms and Frameworks 2026

Source references

• ^[src-251] Enterprise managed AI-agent platforms official documentation bundle
• ^[src-252] Enterprise agent frameworks official documentation bundle
• ^[src-254] MCP and A2A specifications
• ^[src-255] NIST AI RMF and EU AI Act controls
• ^[src-256] Why Do Multi-Agent LLM Systems Fail?
• ^[src-257] Towards a Science of Scaling Agent Systems
• ^[src-259] Collaborative Memory
• ^[src-260] Multi-Agent Risks from Advanced AI