Agentic Systems Landscape (September 2026)¶

Reviewed 2026-09-03. Treat an agent system as an application control plane around probabilistic model calls, not as a collection of autonomous personas. The durable units are contracts, state, permissions, evidence, and rollback boundaries.

Protocol Boundaries¶

MCP specifies a host-client-server architecture: the host creates clients, controls permissions, and manages lifecycle. MCP Architecture

A2A is an interoperability protocol for communication between agents. It complements MCP rather than replacing it: an agent can use MCP to reach its tools and A2A to exchange work with another agent. A2A specification

Runtime Choice¶

Choose the smallest runtime that exposes the control you need.

The OpenAI Agents SDK documents two distinct composition patterns: specialists used as tools keep a manager in control, while handoffs transfer the active conversation to a specialist. Its guidance also distinguishes model-selected orchestration from code-selected orchestration. Agent orchestration

Managed runtimes can reduce infrastructure ownership, but they do not remove the need to define data access, approval, output validation, and incident handling. For example, Claude Managed Agents models an agent as a versioned configuration plus an environment and a session. Claude Managed Agents

Production Control Plane¶

An agent invocation should have one durable record. Store references to large inputs and outputs instead of copying them through every prompt.

{
  "run_id": "run_01J...",
  "work_item_id": "news-2026-09-03-001",
  "parent_run_id": null,
  "attempt": 1,
  "input_ref": "s3://private-bucket/intake/001.json",
  "agent_version": "news-curator@2026-09-03",
  "tool_policy_id": "news-read-only-v3",
  "status": "running",
  "output_ref": null,
  "evidence": [],
  "idempotency_key": "news-2026-09-03-001:curate:v3"
}

Required Invariants¶

• One component owns each mutable record. Workers may append evidence, but only the workflow controller changes the terminal status.
• A retry uses the same work item and a new attempt number. It never silently creates a second publication candidate.
• A tool call has an allowlisted capability, deadline, caller identity, and receipt. Unknown tool outcomes fail closed.
• A generated answer is not a receipt. A receipt identifies the input, agent/configuration version, tool results, validator result, and timestamp.
• Public publication is a separate state transition after review. Do not equate successful extraction with approval.

Build Order¶

1. Implement a single-agent path with a typed input and typed output.
2. Add deterministic validation before adding another agent.
3. Add a separately scoped evaluator when a bad output is materially costly.
4. Add parallel workers only for independent, partitioned work items.
5. Add durable recovery only when the work can outlive one process.
6. Add cross-service A2A only when independently owned agents need a stable interoperability boundary.

This order keeps the failure surface observable. A multi-agent design is justified by a concrete need for independent work, separation of authority, or a different trust boundary—not by a role name.

Model and Tool Routing¶

Route by the contract, not by a product label.

Use a model-selected route only when the route itself is an open-ended reasoning task. Use application code when the route is a policy decision, an authorization boundary, or a budget limit.

When Not to Add an Agent¶

Do not add a specialist merely to rename a prompt. Keep one agent when:

• the task is sequential and the same permissions apply throughout;
• the result has one deterministic validator;
• sharing full context is cheaper and safer than serializing it between agents;
• no independent reviewer or external trust boundary is needed.

Splitting work introduces context loss, extra cost, more traces to inspect, and another failure mode at every handoff.

Gotchas¶

• Issue: Treating MCP and A2A as interchangeable. MCP authorization belongs to the host/tool boundary; A2A addresses communication between agents. Fix: document both boundaries separately and use the protocol that owns the relationship.
• Issue: Letting a model decide a policy-controlled route. A natural-language instruction is not an authorization system. Fix: keep budgets, publication approval, and destructive-action gates in deterministic application code.
• Issue: Retrying with a new identity. A timeout can leave an external side effect uncertain. Fix: persist an idempotency key and reconcile the prior attempt before resubmitting.
• Issue: Counting a model response as completion. A fluent response may omit required evidence. Fix: make the workflow terminate only after the validator records a PASS receipt.

Limitations¶

Protocols make boundaries explicit; they do not make agents reliable, secure, or mutually trustworthy. Tool behavior, source quality, model non-determinism, and reviewer policy remain application responsibilities. Test the actual workflow with representative failures before increasing autonomy.

See Also¶

• agent orchestration
• managed agents
• multi agent systems
• multi session coordination
• llmops

Sources¶

• Model Context Protocol Architecture
• A2A Protocol
• OpenAI Agents SDK: Agent Orchestration
• Claude Managed Agents Quickstart