AI agent architecture
The building blocks of a production AI agent — reasoning core, tools, memory, the control loop, and the safety layer — and how they fit together into a system you can trust.
Five components, one system
- Reasoning core — the model that interprets the goal, plans steps, and decides the next action.
- Tool layer — the gateway through which the agent calls APIs, databases, and services to perceive and act.
- Memory layer — short-term context for the current task and durable storage for what persists across runs.
- Control loop — the engine that runs observe, decide, act, repeat, with a stopping rule.
- Safety layer — scoped permissions, an authority bar, audit logging, and human escalation.
Reasoning, loop, and stopping rule
At the centre, the reasoning core reads the current state and decides the next action; the control loop executes that action, feeds the result back, and asks the core to decide again. This cycle is what makes an agent agentic. Two design choices dominate its behaviour: how the loop decides it is done — the stopping rule — and what it does when it is stuck. A loop without a firm stopping rule will spin, retry, and burn cost; a loop with no escalation path will fail silently rather than ask for help.
We version-pin the reasoning model so its behaviour does not shift under the loop between releases — drift in the core ripples through every decision the agent makes.
Tools and memory done safely
Tools are how an agent touches reality, which makes the tool layer the highest-risk part of the architecture. The pattern that holds up is a gateway: tools sit behind a uniform interface that holds scoped credentials, rate-limits calls, and logs every request, so the agent gains capability without ever holding a raw secret. Memory is split deliberately — a working context for the task at hand, and durable storage for facts the agent should carry forward — with sensitive data hosted where your governance requires.
In the operators we run, the gateway and the audit log are non-negotiable; an agent we cannot inspect or constrain is not one we put in front of a client's systems.
The safety layer is part of the design
Permissions, the authority bar, logging, and escalation are not bolted on after the agent works — they are load-bearing parts of the architecture. The agent runs in a contained environment with least-privilege access, so a misfire cannot reach systems it was never meant to touch. Every action and its reasoning are written to an append-only log. And the authority bar defines, in writing, what the agent may do alone versus what it must escalate. Architecture that omits this layer is not finished; it is unsafe.
What are the main components of an AI agent architecture?
Five layers: a reasoning core (the model that plans), a tool layer (how it acts on the world), a memory layer (context and durable storage), a control loop (observe-decide-act), and a safety layer (permissions, audit logging, and human escalation).
Is the model the most important part of agent architecture?
No. The model is one of five layers. The tool layer, memory, control loop, and safety layer determine whether an agent is reliable and auditable. Teams that reduce architecture to "pick a model" design the least important part well and the rest poorly.
What is the control loop in an AI agent?
The engine that runs the agent: it executes an action, feeds the result back to the reasoning core, and asks for the next decision, repeating until a stopping rule fires. Its design — especially the stopping rule and escalation path — governs the agent's behaviour.
How should tools connect to an agent safely?
Through a gateway that holds scoped credentials, rate-limits and logs every call, so the agent gains capability without holding raw secrets. The tool layer is the highest-risk part of the architecture and should be treated as such.
Why is the safety layer part of the architecture?
Because permissions, the authority bar, audit logging, and escalation determine whether an agent can be trusted in production. They are load-bearing design components, not optional add-ons applied after the agent works.
We don't advise on AI. We run it for you.
Proven on your data before you commit.