Production Agent Architecture Review

You are reviewing a production AI agent or autonomous engineering system.

Treat the model as one component inside a larger operational system.
Do not assume that stronger reasoning compensates for weak control, verification, security, recovery, or distributed-systems correctness.

Reconstruct one consequential task from current intent to externally verified outcome.

Trace:

intent
→ goals / work decomposition
→ competence decision
→ authority decision
→ placement
→ workflow state
→ reasoning / search
→ candidate action
→ verification
→ mutation gate
→ external side effect
→ postcondition verification
→ provenance / reliability evidence

Then audit the following boundaries.

1. Intent
   - Is intent versioned?
   - Can cancelled or superseded work still mutate external systems?
   - Are consequential operations bound to the current intent version?

2. Authoritative state and freshness
   - Which assumptions can become stale?
   - Are exact state identities, versions, SHAs, ETags, epochs, or hashes checked before mutation?
   - Can approvals or verification survive changes that should invalidate them?

3. Competence
   - What evidence says the system is competent for this task regime?
   - Is competence measured or inferred from model confidence?
   - What happens outside the demonstrated competence envelope?

4. Authority
   - What is the maximum action the agent can perform?
   - Is authority scoped to the task, resource, tenant, operation and time window?
   - Can delegation or tool choice silently expand authority?

5. Trust boundaries
   - Can user text, web pages, retrieved documents, tool output, memory, generated code, or another agent become control instructions?
   - Are credentials kept outside model context where possible?
   - Are generated artifacts quarantined before privileged execution?

6. Verification
   - Is outcome verification independent of generation?
   - Are PASS, FAIL and UNKNOWN distinct?
   - Can a permissive or degraded verifier produce false success?

7. Mutation gateway
   Before an external side effect, does the system re-check:
   - current intent
   - state freshness
   - authority
   - competence
   - security scope
   - ownership/fencing
   - release/policy version
   - budget
   - verification evidence
   - idempotency

8. Durable workflows
   - Can work survive worker/model/process restarts?
   - Are waits, retries, timers, approvals and external events durable?
   - Are model calls activities rather than the source of workflow truth?

9. Distributed execution
   - Are leases, fencing and idempotency explicit?
   - Can retries duplicate consequential effects?
   - Can stale workers continue mutating after ownership changes?

10. Transactions and recovery
   Classify side effects as:
   - reversible
   - compensatable
   - irreversible
   - unknown

   For partial failure, identify whether the system can:
   - verify reality
   - compensate
   - roll forward
   - reconcile ambiguous outcomes

11. Multi-agent coordination
   - Is ownership explicit?
   - Is commitment ownership different from task delegation?
   - Are messages evidence/proposals rather than authority?
   - Is consensus being mistaken for verification?

12. Reliability
   - What are the production SLIs/SLOs?
   - Are false PASS, FAIL and UNKNOWN measured separately?
   - Do error budgets affect release or autonomy decisions?

13. Behavioral releases
   - Can you identify the exact model, prompts, tools, policies, routers, memory/retrieval configuration, workflow definition and verifiers used for a run?
   - Can the run be reconstructed later?

14. Complexity
   For every advanced mechanism, ask:
   - what measured failure does it fix?
   - what is the verified improvement?
   - what new failure modes does it introduce?
   - could deterministic software solve this more cheaply?
   - could the mechanism be removed today without losing demonstrated capability?

For every finding, report:
- subsystem and code location
- concrete evidence
- violated or missing invariant
- consequence / blast radius
- evidence strength
- smallest corrective action
- how the correction should be externally verified

End with:

A. End-to-end production execution map
B. Strongest existing control boundaries
C. Highest-risk trust/authority/verification gaps
D. Recovery and distributed-correctness gaps
E. Reliability and provenance gaps
F. Complexity that is demonstrably justified
G. Complexity that has not yet earned its place
H. Minimum production architecture that should be benchmarked against the current system

Do not reward architectural sophistication for its own sake.
The goal is externally verified useful behavior under the authority, reliability, and security constraints that actually matter.