How AI agents work: the architecture of a production agent

An AI agent is a language model wrapped in five more layers — perception, memory, tools, orchestration and monitoring — so that it can act on a goal rather than only answer a question. A chatbot answers. An agent reads a ticket, looks up the order, issues a refund within policy and tells the customer, or hands the case to a person when it is unsure. The difference is not a bigger model or a longer prompt; it is architecture that makes actions safe, grounded and observable. Adoption is broad but shallow: McKinsey reports that 78% of organisations used AI in at least one business function in 2024, while only a small minority were scaling agents (McKinsey, 2025).

This is the structure we use for agents we build for clients and for our own products. Names differ between frameworks; the responsibilities do not.

Choose a chatbot when the outcome is an answer and a person will act on it; choose an agent when the outcome is a completed task inside your systems. The agent costs more to build and secure because it holds tools and permissions, so it only pays off where the task volume and the manual effort per task are both real. The table sets the two side by side.

Everything the agent acts on enters through one layer that parses, validates and routes: chat messages, emails, PDFs, images, webhook events, database rows. Perception extracts text from documents, classifies intent, attaches the identity of the user and their permissions, and rejects what it cannot handle. Keep it thin, strict and typed at the boundary, with a "cannot process" path that reaches a human instead of the model guessing.

What breaks: agents fed raw input hallucinate on edge cases — a scanned invoice with two currencies, a message in a language nobody expected. Input is also the main attack surface: OWASP ranks prompt injection, including indirect injection through documents and web pages the agent reads, as the number-one risk for LLM applications (OWASP, 2025).

The LLM is the cognitive engine: it interprets the goal, decomposes it into steps, chooses the next tool and decides when it is done. Production agents plan explicitly (a visible list of steps), re-plan when a step fails, and run under a budget — maximum iterations, maximum cost, maximum time. A capable model without a budget is a loop waiting to happen.

What breaks: loops that never end, plans that drift from the goal, a new model version that changes behaviour silently. What we do: an evaluation set of real cases replayed on every prompt or model change, hard limits on iterations and spend, and a preference for smaller specialised agents over one that does everything. The business case is fragile without this discipline: Gartner has predicted that over 40% of agentic AI projects will be cancelled by the end of 2027, citing unclear value and inadequate risk controls (Gartner, 2025).

Short-term memory holds the current conversation and intermediate results; long-term memory stores facts about the user, preferences and past outcomes; knowledge — your documents, CRM, databases — is reached through retrieval: a vector index for unstructured text, SQL or API calls for structured data. That is what makes an answer grounded: it comes with a source. The pattern goes back to the original retrieval-augmented generation paper, which showed that combining a retriever with a generator improved factual accuracy over the model alone (Lewis et al., 2020).

What breaks: stale indexes, chunking that cuts tables in half, retrieval that returns ten near-duplicates. What we do: hybrid search (keywords plus vectors), metadata filters, reranking, and a retrieval quality metric tracked separately from the final answer — see our RAG go-live checklist.

Tools are how the agent changes the world: search, read and write records, send an email, create an invoice, run code, call another agent. Each tool is a typed contract — inputs, outputs, errors — with an access scope and an audit log. Small, well-named tools that return summaries work better than one broad tool that returns a wall of JSON, and every irreversible action needs a human in the loop.

What breaks: a tool that returns output the model misreads; an action that cannot be undone taken on a misunderstanding. What we do: idempotent operations, scoped credentials and human approval for payments, deletions and outbound messages to customers. OWASP lists this failure mode as "excessive agency" — more tools, permissions and autonomy than the task needs (OWASP, 2025).

The control loop runs the agent: it sequences the steps, handles retries and timeouts, enforces limits, and coordinates several agents when one is not enough (a router, a researcher, a writer, a checker). Guardrails validate inputs and outputs: PII filtering, policy checks, confidence thresholds that stop the loop and escalate. This is the least glamorous layer and the one that decides whether the agent survives contact with production. A capable model in a poor loop fails constantly; a modest model in a good loop is reliable.

NIST's generative AI profile frames the same responsibilities as risk functions — govern, map, measure, manage — and lists human oversight and content provenance among the suggested actions for deployed systems (NIST, 2024).

Before answering, the agent reviews its own output against the goal and the rules — a cheap second pass that catches a surprising share of errors. After answering, every run is traced: prompts, tool calls, tokens, latency, outcome. Production metrics — task success rate, escalations, human corrections — feed the evaluation set, and the evaluation set gates the next release. An agent without this loop drifts, and nobody notices until a customer does.

What breaks: nobody looks. What we do: dashboards the business reads (tasks completed, cost per task, correction rate), alerts on drift, and a weekly review of failed runs with the people who own the process.

Pick one process with a clear number attached — hours spent, error rate, response time — and build the six layers for that slice only, with an evaluation set from real cases. Measure before and after, then widen. Starting narrow is what separates the organisations reporting value from the rest: McKinsey finds that companies seeing the largest EBIT impact from generative AI are the ones that redesigned specific workflows rather than deploying a general assistant (McKinsey, 2025). Our case studies show what this looks like in retail, finance and our own products; if you want to talk through your process, book a discovery call.