Not a swarm of agents, but a well-rehearsed system. Workflow where possible. Agents where decisions are open. Humans where it matters.
Classify, extract, route: most enterprise use cases work best as a fixed process with individual AI steps. Predictable, affordable, auditable.
An agent comes in where there is real freedom to decide: unstructured input, changing solution paths, research.
A team of agents only pays off when context and responsibility can be cleanly separated. Otherwise cost, latency and errors go up without better quality.
Everything around it is the hard part. Eight layers we build minimal, but right.
Agent logic belongs in a persistent, resumable process, not in a chat session. For long-running flows with waits, approvals and retries we rely on durable execution.
We connect tools and data via the Model Context Protocol. An MCP gateway centrally controls which agent sees which tools, with authentication, rate limits and an audit log.
Every agent has its own identity in the identity provider. It acts on behalf of a person with their permissions, or with narrowly scoped permissions of its own. Never through a shared superuser.
No filter reliably stops prompt injection. We solve it in the architecture: separate capabilities, control outbound connections, allowlist tools, sandbox code execution.
Retrieval inherits the permissions of the source systems. An agent only finds what the person it works for may see. For numbers we use defined metrics instead of free-form SQL on raw tables.
A gateway in front of the models enables multi-model operation, fallbacks and cost control per team. Large models plan, small ones handle routine. With EU data residency on request.
Every run is fully traced, including tool calls, context, cost and latency. Evals built from real cases run as regression tests on every change. Without evals, every model switch is flying blind.
An agent registry shows which agents exist, who owns them and what they may do. Plus audit logs, a kill switch, risk classification under the EU AI Act, GDPR and, where needed, the works council.
An agent that reads private data, processes untrusted content and can send data out is vulnerable. Simon Willison calls this the “lethal trifecta”. No guardrail model solves it reliably. That’s why we take at least one of these capabilities away from every agent.
One or two tightly scoped cases with high volume and measurable success.
Identity, gateway, tracing and evals. Minimal, but right. No platform built on spec.
Suggestions first, then execution with approval, then autonomous execution at low risk.