Architecting Agentic Systems

You shipped the demo. The model worked. Now production is coming, and the demo is not a system.

Foundation models are useful, volatile, and impossible to fully trust. They work just well enough in a stage-managed demo to be handed things they cannot structurally guarantee once that demo meets real load, real users, and real consequences. The industry is sleepwalking into the result: conversational logs treated as databases, system prompts treated as security boundaries, open-ended reasoning loops deployed with the hope that the model will behave like a careful engineer. It will not.

An agentic system is not an AI project; it is a distributed-systems engineering problem. The model at its center is a highly useful, highly volatile probabilistic component, valuable exactly insofar as its behavior can be bounded, governed, observed, and recovered from by the deterministic infrastructure built around it. The reliability lives in the shell, not the model.

That shell is the harness: the deterministic loop that assembles context, calls the model, parses intent, and dispatches every proposed action through bounds and governance before it touches the world. The model proposes; the harness disposes. No effector runs outside the harness's reach, so every hand and eye passes through a place where a bound can refuse, a gate can escalate, and the trace can record.

This book is the architectural discipline for engineering dependable AI agents, dependable in the formal sense, the umbrella over reliability, safety, governance, observability, and recoverability. Where existing catalogs (Gulli, Anthropic, CSIRO, Andrew Ng) enumerate patterns and demonstrate frameworks, this book integrates the discipline end to end: bounded autonomy as substrate, governance as load-bearing structure, failure-mode taxonomies, trace discipline, the harness, and the design-time/runtime boundary made explicit by the skills layer. The governance-as-architecture position is now consensus the book documents and builds on; the integration is the contribution.

Inside:

• Bounded autonomy — the iteration, cost, and risk limits the architecture enforces before the expensive call, not after
• Governance as architecture — validators, policy gates, and human oversight as load-bearing structure, not a bolt-on
• The harness — the deterministic envelope designed in full: context assembled not accumulated, the execution seam defended, the model's every effect routed through the gateway
• The skills boundary — design-time guarantees in code, runtime know-how as content; where capability lives, and the rule that know-how may move into skills but power may not
• Memory and ingestion — working, episodic, and semantic memory, and the write-path that feeds them
• Failure modes — the taxonomy of what goes wrong, and how the architecture catches it
• Trace discipline — replay, evaluation, and regression against the typed events a governed system emits
• Integration, model routing, and operations — the production layers around the core
• Concord — a coding-assistant agent worked end to end, from bounds to tool surface to trace

For senior engineers and architects who carry the pager when these systems meet production, and who need the vocabulary and the structure to ship them without gambling on the model.

Damian Beresford is a Distinguished Engineer with 30+ years in the software industry, working on agentic systems in production.