Every enterprise agent demo looks the same: a model, a prompt, a few tools. Every enterprise agent in production looks different, because production adds everything the demo skipped: identity, policy, state, cost limits, audit, and a way to roll back. This post lays out a seven-layer reference architecture that we use to keep those concerns from collapsing into one giant prompt.
The layers are ordered from the business downward. Each layer has one job, one owner, and a contract with the layer beneath it.
The seven layers
- Experience. Where humans meet the agent: chat, inbox, ticket queue, API. It owns identity of the *caller* and the shape of approvals.
- Orchestration. The control flow: single agent, supervisor, or graph. It owns task decomposition, retries, and termination.
- Reasoning. The model calls themselves, plus routing between models. It owns prompts, structured output, and per-run budgets.
- Tools and context. Everything the agent can read or do: APIs, databases, retrieval, MCP servers. It owns capability definitions and schemas.
- Policy and identity. Authorization, data classification, and guardrails. It decides what a given agent, acting for a given user, may do right now.
- State and memory. Checkpoints, conversation state, long-term memory. It owns durability and data retention.
- Observability and evaluation. Traces, evals, cost, and audit. It owns the answer to "what did the agent do and was it right?"
The rule that matters most
Layers talk only to their neighbours through typed contracts. The moment the reasoning layer starts deciding who is authorized, or the tools layer starts holding conversation state, you have rebuilt the monolith with extra steps.
If a security review needs to read your prompts to understand your access model, the access model is in the wrong layer.
Where the seams break
The failure modes cluster at three seams.
- Orchestration to tools. Agents get tools with broader permissions than the task needs, because narrowing them is tedious. Fix it with per-run scoped credentials issued by layer five.
- Reasoning to state. Long tasks lose their place when a process restarts. Fix it with explicit checkpoints in layer six, never "the conversation is the state".
- Everything to observability. Teams log model calls but not decisions. Fix it by tracing the *plan step*, not just the HTTP request.
How to use this
Treat the seven layers as a review checklist. For any agent proposal, ask for one sentence per layer: who owns it, what is its contract, and what happens when it fails. Blank answers are the roadmap.
You do not need a platform team to start. A single agent can implement all seven layers thinly. The point is that each one exists as a named boundary you can later harden, replace, or buy.
The next posts in this series go deep on individual layers: the control plane, tool authorization, durable execution, evals, memory, routing, and human review.