Agentic AI architecture, answered.

Agentic AI architecture is the full set of design decisions that turn a capable model into a dependable system: the pattern the work follows, the placement of control flow, the data the model can reach, the guardrails around its actions, the evaluations that gate every change, and the operational plumbing that keeps it reliable at scale. Model selection is one decision on that list. The rest of the list determines whether the model's capability survives contact with production.

Because the expensive failures are baked in early. A cost projection that exceeds the budget ceiling means the architecture changes before code is written, not after. A single regulated data field in scope changes the entry point, the hosting region, and the logging design. A pattern chosen by default rather than deliberately becomes a system nobody can test, explain, or afford. Deciding first costs days; rebuilding later costs quarters.

These are the three foundational patterns, separated by where control flow lives. An augmented call is a single model invocation doing one bounded job in one pass. A workflow decomposes the task into named steps orchestrated by your own code. An agent receives a goal and a set of tools, and the model determines its own sequence of steps to reach that goal. The choice deserves to be made deliberately per use case, because everything downstream, from cost to observability to risk, follows from it.

Only when the path through the work cannot be enumerated in advance, and only when the cost of an unexpected or inconsistent output is acceptable and recoverable. Control flow lives inside the model, which means the path is not written down anywhere you can inspect. Production agents therefore run inside constrained tool entry points, per-turn budgets, explicit permissions, and stopping criteria. Those constraints are requirements; they keep an agent from becoming a liability.

The orchestrator owns the goal. It decomposes the work, decides what to delegate, and synthesizes the results into a single answer. It never does the sub-task work itself; delegation and synthesis are the whole job. Keeping that boundary clean is what makes a multi-agent system debuggable.

The freshness requirement decides. A corpus that is static or changes slowly, such as policies and procedures, fits retrieval. Live state, such as an order status or an account balance, requires a tool call to the system of record. Most enterprise use cases need both, and forcing everything through one mechanism produces either stale answers or an expensive, fragile pipeline.

Direct injection is a user crafting input that overrides the system's instructions and redirects its behavior. Indirect injection is subtler: malicious instructions arrive through retrieved content or tool outputs that the model treats as trusted. Defense pairs input screening, with a defined action on every hit, whether block, flag, or route to a human, with output screening as the last line before anything reaches a customer. Then add detection, because prevention is never complete: monitor screening hit rates, anomalous instruction patterns, and output spot checks, on the assumption that some attempts get through.

The rule that no change ships without passing the evaluation suite, including a delta threshold set in advance below which the change does not go out. Set the threshold before running the evaluation; a threshold set afterward is not a standard, it is acceptance criteria written after the build. The gate only works when it applies to every change, including the small ones.

Four inputs: call volume, token budget per request, model tier, and the sensitivity parameters around them. Size every use case across all four before committing to a design. The token budget has two components, input tokens covering the system prompt, retrieved context, and user message, and output tokens covering the expected response length. Model the distribution rather than the average, because long documents and long conversations live in the tail, and the tail is where budgets break.

Four conditions, each with rules defined per agent: the customer asks for a person, confidence drops, sentiment turns, or the topic sits on a mandatory escalation list. The path to a human stays visible at all times; hiding the exit is a brand risk dressed up as a cost saving.