Agentic architecture patterns

Understand each pattern by watching it work: a short animated scene shows who talks to whom, who decides the path, what flows and what it costs. Then the sheet covers the problem it solves, when to use it, when to avoid it, and what the people who ran it in production say.

Building blocks

The components of every other pattern: an enriched model call, well-designed tools, structured outputs.

A1 · Augmented LLM — A single model call, enriched with documents, tools and memory.
A2 · Tools and agent-computer interface (ACI) — The model is given functions it can ask to call; the quality of that interface matters as much as the architecture.
A3 · Structured output — The model answers in a schema that code can check and use without ambiguity.

Workflows

Code decides the path, LLMs carry out steps. The most common form in production.

B1 · Prompt chaining — The task is split into fixed steps; each call processes the output of the previous one.
B2 · Routing — A classifier sorts each request into a category and sends it to the specialised handler.
B3 · Parallelization — Independent subtasks run at the same time, then a step aggregates their results.
B4 · Sampling and voting — Several answers are generated for the same question, then the one that wins the vote is kept.
B5 · Generator-evaluator — One model produces, another evaluates against explicit criteria, and the loop repeats until acceptance.
B6 · Custom state graph — The flow is declared as a graph of nodes, conditions and cycles, some nodes being plain code and others LLMs.

Single agent

One model decides its own steps and tools, in a loop.

C1 · Agent loop (ReAct) — The model alternates reasoning, tool call and observation until a stop condition is met.
C2 · Plan and execute — A planner writes the whole plan, executors carry it out, a solver writes the answer.
C3 · Reflection — The agent critiques its own output, or draws a lesson from a failure, then tries again.
C4 · Code agent — Instead of JSON tool calls, the agent writes a program that composes the tools itself.
C5 · Tree search — Several branches of reasoning or action are explored and evaluated, and the agent backtracks when needed.
C6 · Agentic search — The agent decides what to look for, reads, judges relevance and tries again, instead of receiving pre-selected passages.

Context and memory

What the model sees at each step: compaction, notes, memory, skills, isolation.

D1 · Compaction — When the context nears its limit, it is summarised and work restarts in a fresh window.
D2 · Structured notes and recited plan — The agent writes its notes and plan to files outside the context, and rereads them to stay on course.
D3 · Long-term memory — The agent keeps facts, experiences and know-how from one session to the next.
D4 · Skills (progressive disclosure) — Folders of instructions of which only the name and description are loaded at the start; the rest comes on demand.
D5 · Context-isolation subagent — An exploration is handed to a subagent with a clean context, which returns only a condensed summary.
D6 · Long-running harness — One agent sets up the environment, then another moves forward one feature at a time across several sessions.

Multi-agent

Several agents coordinate. Powerful on tasks that split well, costly everywhere else.

E1 · Orchestrator and subagents — A central agent splits the task, hands it to specialised subagents, often in parallel, then synthesises the results.
E2 · Task-ledger orchestrator (Magentic) — The orchestrator keeps a ledger of tasks and progress, spots blockages and replans.
E3 · Hierarchy — Nested orchestrators: a supervisor of supervisors, with recursive decomposition.
E4 · Handoff — Only one agent is active at a time; it hands control over entirely to a better-suited agent, which becomes the point of contact.
E5 · Group chat and debate — Several agents share one thread, propose, critique and converge under a moderator.
E6 · Mixture-of-agents (layered) — Layers of models propose answers; each layer reads the previous one, then an aggregator synthesises.
E7 · Swarm and peer network — Every agent can talk to every other; with no central coordinator, the path emerges.
E8 · Agent teams on a task queue — A coordinator launches persistent agents that pull from a shared task queue.
E9 · Message bus — Agents publish events and subscribe to topics through a router; the flow emerges from the events.
E10 · Shared state (blackboard) — Autonomous agents read from and write to a common store, with no coordinator.
E11 · Distributed agents (A2A) — Agents run as independent services, sometimes from different vendors, that discover each other and talk through a protocol.

Oversight and operations

The human role, guardrails, model choice and background execution.

F1 · Human in the loop — Checkpoints where a human approves, corrects or takes over.
F2 · Layered guardrails — Defence in depth: several stacked checks, on input, on tools and on output.
F3 · Model cascade and routing — Each request goes to the cheapest model able to handle it, and moves up a notch if confidence is too low.
F4 · Ambient agent — An agent that listens to an event stream, works in the background and asks the human only when needed.
F5 · Budgets and circuit breakers — Code sets the limits of each run and cuts off before they are crossed: turns, tokens, cost, time.

Security by design

Architectures that stay safe even when the model is manipulated by a prompt injection.

G1 · Action selector — The model picks an action from a closed list; no tool result ever comes back to it.
G2 · Plan before untrusted contact — The action plan is settled before any untrusted data is read, then executed as is.
G3 · Isolated map-reduce — Each untrusted item is handled by an isolated instance whose output is constrained, then the results are aggregated.
G4 · Dual LLM (and CaMeL) — A privileged LLM holds the tools without ever seeing untrusted content; a quarantined LLM reads it, with no tools.
G5 · Context minimization — Once the action is chosen, whatever is no longer needed is removed from the context, the initial request included.
G6 · Rule of Two — Never combine, autonomously, the three properties that make prompt injection dangerous.
G7 · Environment containment — Security lives in the environment, not in the model: sandbox, filtered network egress, separate environments.