Your vendor's architecture diagram is a skeleton. It shows what the system is made of and nothing about what moves through it. Here is the whole body, followed end to end through one ordinary request.
If you only have a minute, here's what you need to know.
- Gartner polled more than 3,400 organizations investing in agentic AI and predicts over 40% of those projects will be canceled by the end of 2027. The three causes they name are escalating cost, unclear business value, and inadequate risk controls. Model capability is not on the list.
- None of those three failure modes gets fixed by a smarter foundation model. They are all structural, and they all live in parts of the system that never appear on the architecture diagram.
- A production agentic system is eleven layers and roughly fifty-six components. The model is one layer. Teams build the two that demo well, the runtime and the tools, then discover they were missing identity, governance, and the system of record.
- To make that concrete, this series follows one ordinary request end to end: an employee resigns. Three days, eleven layers, and exactly one moment where the system stops and asks a human. You already know how this goes wrong in real life.
- The reason it needs eleven layers and not four is the thing most people get backwards. Automation handles the case you predicted. The agent exists for the case you didn't.
This is Part 0 of an eight-part series on the anatomy of an agentic system. Each post takes one organ system and follows the same story through it.
The diagrams are all skeleton, no blood
Go and look at the agentic architecture diagram your vendor showed you. I will wait.
It has a user on the left. It has a model on the right, probably in a rounded rectangle, probably purple. In between there are three or four boxes with words like "orchestration" and "tools" and "memory." Arrows connect them. Everything flows left to right, and nothing ever fails.
Now here is the honest question about that picture. When the agent revokes someone's access, whose name is in the audit log?
If you do not know, the diagram was decoration. The reason these programs stall is not that the boxes are wrong. The boxes are usually roughly right. It is that a box diagram tells you what a system is made of and tells you nothing about what moves through it: identity, cost, state, permission, and the write back to the system the business actually runs on.
Skeletons are easy to draw. They are also not alive.
The failure data says the model is not the problem
Gartner surveyed more than 3,400 organizations actively investing in agentic AI and concluded that over 40% of agentic AI projects will be canceled by the end of 2027. The reasons they give are escalating costs, unclear business value, and inadequate risk controls.
Over 40% of agentic AI projects will be canceled by the end of 2027. The named causes are escalating cost, unclear business value, and inadequate risk controls. Model capability is not among them.
Source: Gartner, June 2025, based on a poll of 3,400+ organizations
Read that list again and notice what is missing. Nobody is canceling a program because the model could not reason well enough. They are canceling because the thing ran up a bill nobody could explain, or produced work nobody could value, or did something nobody could govern.
MIT's Media Lab study of enterprise generative AI landed in the same place from a different direction. Examining why the overwhelming majority of pilots produced no measurable return, it found brittle workflows, no contextual learning, and misalignment with how the business actually operates. Not reasoning. Not benchmarks. Plumbing.
Cost governance, value measurement, and risk control are not features of the model. They are layers of the system, and they are three of the layers that almost never make the vendor slide.
Eleven layers, not four
A real agentic platform, the kind that survives contact with a compliance officer, has eleven layers. To make that navigable rather than exhausting, this series groups them into seven organ systems, and takes one per post.
Roughly fifty-six components hang off those eleven layers. That sounds like a lot until you notice how many you already own. You have an identity provider. You have a CRM. You have an audit requirement. Most of an agentic platform is not new technology. It is your existing enterprise, wired so an agent can act inside it without lying about who it is.
Note where the model sits: behind the Model Gateway, one component group inside one layer out of eleven. I am not being cute about that placement. It is roughly the share of the engineering work that actually touches the model.
Dana Okafor gives two weeks' notice
Maps are cheap. Here is the same system with something moving through it.
Dana Okafor is a senior engineer. On a Tuesday morning she opens Workday and resigns. Two weeks' notice, voluntary, and her manager marks it regretted. That is the whole trigger. No agent swarm, no autonomous research, no science fiction. One person quitting a job, which is a thing your company does several times a week and has never once done cleanly.
You already know the failure modes here, because everyone does. The guy whose VPN still worked eight months after he left. The woman whose knowledge walked out with her and took a quarter to reconstruct. The contractor who got paid twice. Nobody had to explain those to you, which is why it is the story.
Getting her out of the building properly takes the system three days, and it touches all eleven layers on the way. Here is where each piece of it lives. Each one of these is an article.
The Front Door. Her resignation was never a chat message. It was an event, fired by a system, and most teams have only ever built the chat message. Then the harder half: the agent that revokes her access needs a name of its own, because an agent that can revoke Dana's access can revoke yours.
The Brain Stem. One coordinator, a handful of specialists, a dozen tasks with an ordering that genuinely matters, because some of them cannot happen until her last day and one of them is waiting on a laptop to physically arrive in a box. That is one way to arrange a multi-agent system. There are four. They fail differently, and most teams pick one by accident.
The Bloodstream. The models it reasons with, and everything it reaches out and touches. Including one of Dana's systems that has no API at all, a vendor application older than some of the people it affects, which the agent has to click through screen by screen like a person would.
The Memory. This is where it asks the question no offboarding checklist thinks to ask: what does Dana own? Fourteen customer accounts. Three production services where she is the on-call primary. And one runbook that only she has ever edited, which is the expensive one, and the one a human would have missed. Separately, and this is a different thing entirely, it also has to know where it left off. Knowing things and knowing where you are are not the same, and losing them are not the same disaster.
The Immune System. The dial that lets it revoke her production database access on its own, without asking anyone, and then stops it dead in front of her final paycheck. It has worked that number out to the dollar and it has the permission to submit it. It will not. It puts the number in front of a human and waits.
The Nervous System. How you prove it actually revoked everything. And how you notice when the whole thing quietly starts taking twice as long as it used to.
The Skeleton. Workday, the CRM, the ledger. The systems that were true before the agent existed and will still be true after you switch it off. In nine months an auditor is going to ask whether Dana's production access was revoked on her last day, and "probably" is not an answer.
Why this is not just a workflow
The obvious objection is that I have described an RPA job with extra steps. Companies have automated offboarding for twenty years. Why would this need eleven layers when a workflow engine needs four?
Because a workflow only handles the offboarding you predicted.
The predictable case is genuinely easy, and you should absolutely automate it. Voluntary, no equity, no direct reports, no legal exposure, laptop back on time. Draw the flowchart, ship it, walk away. It never needed an agent.
The exceptions are the entire job. Make it involuntary, and legal moves first and everything else stops. Put her four months from an equity cliff, and the money is contested. Put her on a visa, and immigration has a clock. Put her under a litigation hold, and you must not delete the thing you would normally delete. Every one of those is a fork the flowchart author never drew, and no flowchart has drawn them all, because the interesting cases are the ones nobody anticipated. Automation handles the case you predicted. The agent exists for the case you didn't.
Which is why the anatomy is eleven layers deep and a workflow engine is four. If you are only executing a flowchart you drew in advance, you need no judgment, so you need no memory to inform it, no guardrails to constrain it, no autonomy tiers to decide when it stops, and no audit trail to defend it afterwards. You need all eleven layers precisely because you are letting the system decide something. Take away the deciding and you have a workflow engine, and you should go build one, and it will work.
Leave the deciding in, and every one of those layers becomes load-bearing. That is the trade, and the diagram never shows it to you.
Five questions to ask about your own program
Enough about Dana. You have an agent program, or you are about to fund one. Here is how to find out which layers you actually have.
Each of these is a question, not a claim. The uncomfortable part is how fast you run out of answers.
Whose name is in the audit log when your agent acts? If the answer is the user's, your agent does not have an identity. It has a borrowed one, and every record it wrote is attributed to a human who did not do it. You cannot go back and re-attribute a year of logs.
What did your last agent run cost, and can you charge it to a team? If you cannot, you do not have a model gateway. You have a direct line to a provider's invoice, and no way to explain it when it doubles.
If the agent dies halfway through a task, what happens? If the answer is that it starts over, you have no persisted state. You are one provider outage away from doing something important twice.
What is the largest irreversible action your agent can take without a human? Most teams have never asked. If you do not know the number, you have not set an autonomy tier. You have set it to whatever the code happens to allow.
Which system of record does it write back to? If the answer is none, you have not built an agent. You have built a chatbot with good manners, and it will demo beautifully right up until someone checks the ledger.
Most people I ask cannot answer three of those. That is not a failure of the team. It is a failure of the diagram they were handed. Nobody skips identity or state or the write back on purpose. They skip them because the picture on the slide had four boxes, and none of those boxes was the one that mattered.
What you are actually building
I have written before about why the harness matters more than the model, and about what it takes to build one. This series is the wider frame around both. The harness is a part of the anatomy. This is the anatomy.
The model will keep getting better. It will not, at any capability level, decide what your company owes Dana Okafor, or tell your ledger it paid her, or put its own name in the audit log. Those are things you build.
Next: The Front Door. Your agent has no identity of its own, and that is why you cannot audit it.
Matthew Kruczek is Managing Director at EY, leading Microsoft domain initiatives within Digital Engineering. Connect with Matthew on LinkedIn to discuss the architecture underneath your agent program.
References
- Gartner. "Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027." June 25, 2025. gartner.com
- MIT Media Lab / Project NANDA. "The GenAI Divide: State of AI in Business 2025." August 2025. fortune.com
- Harvard Business Review. "Beware the AI Experimentation Trap." August 2025. hbr.org
