Reference8-minute read

How is an AI agent built?

The architecture practice · Checked 20 Oct 2026

In short

Every agent we deploy is built from six blocks: where people review its work, what your business terms mean, one gateway for every action, where it runs, the corrections it keeps, and how it's measured. Four deployment patterns cover almost every job. They change what the agent can reach, never the design.

Our position

We put the limits in the gateway, never in the agent's instructions. An agent can be talked around, and a gateway rule can't.

Chapter 1 · one gatewayEvery action passes through one gateway

The agent sits between your people and your systems, and it never touches a system directly. The gateway decides what it gets, serves read-only copies where a copy is enough, and records what it did.

The agent works in the second layer. Everything it may reach is listed in the third, and the gateway is the only path to your systems.fig 1 · agent-layers

Chapter 2 · six building blocksWe build four blocks, choose one with you, and measure one

Block	What it does	Who decides
Where your team reviews the work	A console built for the role, or the collaboration tool you already use. It's cheap to change later.	We build it
What your business terms mean	Only the terms the job touches, and which system holds the true definition.	We build it, your owners confirm
One gateway for every action	It decides what each agent may do, records every action, and can serve read-only data.	We build it
Where the agent runs	A managed service, an instance destroyed after the job, or a person's workstation.	We choose it with you
Every reviewer correction, kept	Each correction becomes a signal you can measure, not rework nobody sees.	We build it
Measurement from the first release	Correction rate, escalation rate, and the job's business number, against a baseline taken first.	We measure it with you

Chapter 3 · four patternsFour patterns cover almost every deployment

Pattern	What it may reach	Jobs we use it for
Work a queue your team owns	Only its tool list, through the gateway	Claims intake, prior authorization, and RFQ response
Answer from a copy, never the original	A read-only copy. Your system of record is never contacted.	Chart preparation, lane quoting, and month-end close
Research outside your walls	Public sources only, so nothing inside is opened	Due diligence and supplier research
Change code and submit it for review	A machine created for the job and destroyed after it, with no route to production	Fixes, migrations, and tests in the software factory

Chapter 4 · what the gateway recordsThe gateway records every call, allowed or not

Each call the agent makes becomes one record, with the reach rule that allowed or stopped it. A call outside the list doesn't fail quietly. It stops, and the case goes to the reviewer.

Two gateway records

at: 2026-10-14 09:12:44   agent: intake-agent   acts_for: claims-team
call: claim.draft          decision: allowed
rule: may draft [claim]    source: email from the policyholder

at: 2026-10-14 09:12:51   agent: intake-agent   acts_for: claims-team
call: payment.write        decision: stopped
rule: may_not write [payment]   # a person signs
next: case sent to the reviewer, with the reason

Chapter 5 · your hardest rulesEach of your hardest rules maps to one block

The rule you can't break	How the design keeps it
Keep the core you can't replace	No agent writes inside your system of record. Every action goes through the gateway.
Let a regulator rebuild any decision	Every case keeps its reasoning, and every action has a record from the first release.
Keep data inside your tenancy	The gateway controls what leaves, and the runtime can sit in your own cloud.
Spare your team another tool	Review happens in the platform your team already uses.
Use the AI spend you've committed	We check your licenses first. If your agreement covers the runtime, we don't bill for it.

Chapter 6 · how autonomy growsAutonomy grows by the numbers, switched at the gateway

Stage	Who checks the work	What moves it on
Reviewed	A reviewer approves every case, and we keep each correction.	The first release always starts here.
Promoted	Fewer cases need approval, starting with the kinds of case you mark as routine.	The correction rate stays under a figure you set, for as many weeks as you set.
Delegated	The agent works inside a written limit. A reviewer checks a sample and every exception.	Your owner signs the limit, and can move it back at any time.

All three stages are the same build. Moving between them is a change to the gateway's rules, with its own record.

Chapter 7 · how we measure an agentThree numbers tell you whether an agent is working

Number	How it's counted
Correction rate	The share of the agent's cases a reviewer changed before approving.
Escalation rate	The share of cases the agent handed to a person instead of finishing.
The job's business number	The number the job exists to move, such as hours per review, against a baseline taken before the first release.

!A falling escalation rate with a rising correction rate means the agent is finishing cases it should hand over. We read the two together.

Questions architects ask

Which model do you use?

The one your agreement and your data rules allow. The gateway and the reach list don't depend on the model, so changing it doesn't change the controls.