Skip to content

Part 3 — Summary

Part 3 treated the agent as a distributed system, not as an intelligent prompt. What was established:

  • Agency is a function of action space, tools, permissions and policies. Increasing agency without increasing controls is the recurring mistake.
  • The harness is the real product, the model is just a component.
  • Workflow-first is defensible in most enterprise cases; multi-agent only with real decomposition.
  • Tool use is the most sensitive layer. Function calling, tool registry, MCP, A2A, versioning, lifecycle — all of it is engineering, not a detail.
  • MCP and A2A are protocols, not security mechanisms. Authorization, identity, audit log, eval and HITL remain the system's responsibility.
  • Memory is a system decision, not a property of the model. Without governance, it becomes a source of poisoning and inconsistency.
  • A prompt is not a policy, a tool description is not security, deprecation is not just metadata. The three most recurring anti-patterns in corporate agents.

Part 4 enters security and governance with these foundations assumed, and treats it as a cross-cutting discipline — not as a final layer.