A production AI agent is a system of seven layers: the foundation model, the context layer, the tool layer, the orchestration layer, the enterprise integration layer, the governance layer, and human oversight. The model is one of the seven, and usually the least of the engineering effort.
That proportion explains why so many agent demonstrations never become production systems. A demo needs layers one to three. A system that runs inside a business needs all seven.
Why the layer model matters
An agent that works in a notebook has a model, a prompt, and access to a document. An agent that runs a procurement exception process has to authenticate against a purchasing system, respect approval limits, survive a timeout halfway through a multi-step task, produce an audit record, and escalate when it encounters something it shouldn’t decide alone.
Those are not model problems. They are systems problems, and they are where the schedule goes.
Design Your Enterprise AI Agent Architecture
Define the right architecture across models, tools, memory, orchestration, integrations, security, and operational controls.
Layer 1 — Foundation model
The reasoning engine: interpreting instructions, extracting meaning from unstructured input, generating language, and choosing between options.
The practical decision is not which model is most capable overall, but which model is appropriate per step. A workflow that classifies incoming documents, extracts fields, decides a routing path and drafts an explanation does not need the same model for all four. Classification and extraction are frequently well served by smaller, cheaper, faster models; the judgement step may warrant a larger one.
Two design rules that save money and grief later:
- Abstract the model behind an interface. Providers change pricing, deprecate versions and ship new models. An agent hard-wired to one model version becomes a migration project.
- Decide per step, not per system. Mixed-model architectures are normal in production and unusual in demos.
Layer 2 — Context
What the agent knows when it reasons. In enterprise settings this is rarely the model’s training data — it is your documents, your records, your policies and your current state.
The context layer covers retrieval over unstructured content, structured data access, and the assembly of both into the prompt the model actually sees.
Retrieval quality determines output quality more often than model choice does. An agent with a strong model and poor retrieval produces confident answers from the wrong documents. An agent with a modest model and precise retrieval produces useful answers. When agent output disappoints in testing, the context layer is the first place to look — usually before anyone touches the prompt.
Practical considerations: how documents are chunked, whether retrieval respects the permissions of the requesting user, how freshness is handled when source systems change, and what happens when nothing relevant is found. That last one matters more than it sounds. An agent that returns a confident answer on an empty retrieval is worse than one that says it doesn’t know.
Layer 3 — Tools
The functions the agent can call: query a database, read a record, calculate something, call an internal API, write to a system.
Tool design is interface design, and the discipline is the same as any API you expose to an unpredictable caller:
- Narrow, explicit schemas. A tool that accepts a free-text query is a tool that will be called with something you didn’t anticipate.
- Validation at the boundary. Never trust the model’s arguments. Check them as you would check user input.
- Meaningful errors. “Failed” tells the agent nothing. “Purchase order not found for supplier ID 4471” lets it recover or escalate.
- Read and write separated. Read tools and write tools deserve different permissions and different scrutiny.
The most common production incident in agent systems is not a hallucinated sentence. It is a tool called with plausible but wrong arguments.
Layer 4 — Orchestration
Multi-step execution: sequencing, branching, retries, state, and knowing when a task is finished or has failed.
This is what separates an agent from a single model call. The orchestration layer decides what happens when step three fails after steps one and two have already written to a system — whether the work rolls back, pauses, or escalates with partial state preserved.
Patterns worth knowing:
| Pattern | Use when |
|---|---|
| Sequential | Steps have hard dependencies and a fixed order |
| Routed | The first step classifies, then dispatches to specialized handlers |
| Parallel | Independent subtasks can run simultaneously and be merged |
| Supervised | A coordinating agent delegates to specialized agents and evaluates results |
Frameworks such as LangGraph and CrewAI implement these patterns; so does bespoke code. The choice matters less than deciding, explicitly, what your workflow’s failure semantics are. Most teams discover they never decided when the first partial failure occurs in production.
Layer 5 — Enterprise integration
Controlled connections to the systems of record: ERP, CRM, ITSM, data warehouses, document stores and internal APIs.
This layer is typically the largest share of the build, and it is the reason agent project estimates are wrong when they are based on the model work alone. Each integration brings its own authentication, its own data model, its own rate behavior, its own error semantics and its own release cycle.
Three things to establish early:
Identity
The agent should authenticate as itself — a dedicated service identity with least-privilege roles — not through a human user’s account. Without this, the audit trail cannot distinguish agent actions from human ones, and the agent inherits permissions nobody scoped for it.
Data path
Transactional context usually comes through APIs. Analytical volume usually should not; extracts into a warehouse are cheaper and safer than repeatedly querying a production system. Choosing wrongly shows up as latency and as an awkward conversation with the platform administrator.
Update cadence
Enterprise platforms change on their own schedules. Oracle Fusion Cloud Applications, for example, update quarterly, and integrations that depend on API responses or report definitions can behave differently afterward. Pin versions where you can and keep a regression suite you run against the preview environment. This is a standing operational commitment, not a build-time task.
Layer 6 — Governance
Identity management, permission scoping, approval policy, logging, monitoring and auditability.
Governance is frequently deferred to a later phase and then discovered to be architectural. Whether every action is logged with enough context to reconstruct a decision is not something you retrofit comfortably.
What this layer must answer, for any agent, on any day:
- What can this agent access, and who granted it?
- What actions can it take without approval, and within what limits?
- What did it do yesterday, and why?
- Who owns it?
- When was it last evaluated, and against what?
An agent with write access to a financial system is a different security object from a chatbot. The National Institute of Standards and Technology has published work on agent hijacking, noting that instructions embedded in content an agent processes can influence its behavior — which means content your agent reads is an input channel that needs the same suspicion as any other untrusted input.
Layer 7 — Human oversight
Where the agent acts alone, where it prepares work for a human decision, and how it escalates.
The useful framing is not how autonomous the agent is, but how autonomous this particular decision should be. Reversibility is the practical test. An action you can undo cheaply tolerates more autonomy than one that posts to a closed accounting period or sends a message to a customer.
A single agent can operate at different levels across its own workflow — executing routine steps independently while staging high-value exceptions for approval. Designing this per decision, rather than per system, is what makes agents deployable in regulated environments.
Ready to Operationalize AI Agents?
Build scalable agentic systems that can execute meaningful business workflows while remaining observable, governed, and controllable.
What this means for scoping
When an agent project is estimated on layers one to three, the estimate is wrong by a wide margin. Integration, governance and oversight are where the effort concentrates, and they are also what determines whether the system survives contact with real operations.
A useful question to ask of any agent proposal: which of the seven layers has actually been designed? If the answer stops at three, what exists is a prototype — valuable for proving feasibility, and not yet a system.
For a broader view of how agents fit into enterprise strategy, governance and ROI measurement, see our guide to enterprise AI agents. For how these layers are built and integrated in practice, see AI agent development and AI integration services.
Frequently asked questions
What are the layers of an AI agent?
A production enterprise AI agent has seven layers: foundation model, context and retrieval, tools, orchestration, enterprise integration, governance, and human oversight.
Which layer takes the most effort to build?
Enterprise integration, in most projects. Each connected system brings its own authentication, data model, error behavior and release cycle, and that work scales with the number of systems rather than the complexity of the model.
Do AI agents need a large language model for every step?
No. Classification, extraction and routing steps are often well served by smaller, faster models. Mixed-model architectures are standard in production systems.
Why do AI agent prototypes fail to reach production?
Prototypes typically implement the model, context and tool layers. Production requires orchestration failure semantics, enterprise integration, governance and oversight — which is where most of the engineering and nearly all of the operational risk sits.
How should an AI agent authenticate to enterprise systems?
Through a dedicated service identity with least-privilege roles, never through a human user's account. This keeps the audit trail meaningful and bounds what a misbehaving agent can reach.
Build a Production-Ready AI Agent
Discuss Your AI Agent
