The Anatomy of an Agentic AI System

Call something “agentic” and half the room hears autonomy; the other half hears a chatbot with plugins. The anatomy is what settles the argument. A genuinely agentic system is not a single model call. It is a set of parts that keep proposing and applying next steps under constraints you own.

Why anatomy beats branding#

In one support org, three teams shipped “agents” in the same quarter. Team A wrapped a ticket classifier. Team B ran a fixed refund workflow with an LLM drafting the email. Team C let a model choose tools until a budget stopped it. Only Team C had agentic failure modes: duplicate credits, thrashing search, and trajectories nobody could explain in incident review.

If you cannot name the parts, you cannot name the risks. Anatomy is the shared vocabulary for design review, evals, and on-call.

The parts that actually matter#

Think in six pieces. Skip any one and you still might ship something useful — just do not call it a full agentic system.

Perception#

Perception is how the world enters the loop: ticket text, retrieved docs, tool results, screenshots, sensor payloads. It is not “the prompt.” It is the assembly of observations the next decision will see.

Weak perception looks like stuffing raw HTML into context and hoping. Strong perception ranks, truncates, and labels evidence so the model is not guessing which paragraph matters.

Reasoning#

Reasoning is the model’s short-horizon judgment: what is true given the observations, what is still unknown, what is risky. In production this is rarely a free-form essay. It is structured enough that your runtime can branch on it — confidence, missing fields, policy flags.

Planning#

Planning turns judgment into a reviewable sequence: which tools, in what order, with what stop conditions. Some systems plan explicitly (a step list). Others plan implicitly one hop at a time (ReAct-style). Both count as planning if the next step is proposed, not hardcoded forever.

Action#

Action is the side effect: API call, DB write, email send, browser click. Actions must pass through typed tools you allowlist. If the model can invent endpoints, you do not have an agent. You have an exploit path.

State#

State is what survives a step: conversation, tool traces, intermediate artifacts, memory writes. Without state, every retry is amnesia. With unbounded state, every retry is a dumpster fire of tokens.

Bounds#

Bounds are the adult supervision: max steps, max spend, allowlists, schema validators, human gates on irreversible tools, forced exits (complete, clarify, escalate, budget_exhausted). Bounds are not optional polish. They are how agentic systems stay operable.

How the parts fit in one loop#

A useful mental model:

The model proposes. The harness disposes. That split is the architecture. Collapse it — let the model “just call whatever” — and you will debug ghosts.

from dataclasses import dataclass
from typing import Literal

Exit = Literal["complete", "clarify", "escalate", "budget_stop"]

@dataclass
class Step:
    observation: str
    decision: str
    tool: str | None
    result: str | None

def run_agent(goal: str, perceive, reason_plan, act, verify, max_steps: int = 8) -> Exit:
    trail: list[Step] = []
    for _ in range(max_steps):
        obs = perceive(goal, trail)
        decision = reason_plan(obs)  # structured: tool | finish | ask | escalate
        if decision.kind == "finish":
            return "complete"
        if decision.kind == "ask":
            return "clarify"
        if decision.kind == "escalate":
            return "escalate"
        result = act(decision.tool, decision.args)
        ok = verify(result)
        trail.append(Step(obs, decision.kind, decision.tool, result if ok else None))
        if not ok and decision.retries_left == 0:
            return "escalate"
    return "budget_stop"

That sketch is intentionally boring. Boring is how you keep anatomy visible in code review.

What is not a part (but gets sold as one)#

Multi-agent can be real. It still needs the same six parts per specialist, plus a contract for handoffs. Adding personas does not replace perception quality or tool allowlists.

Failure modes by part#

• Perception fails → confident answers on the wrong evidence
• Reasoning fails → coherent nonsense; validators catch some of it
• Planning fails → thrash, loops, or plans that ignore budgets
• Action fails → real-world damage (double refunds, bad writes)
• State fails → lost context or poisoned memory
• Bounds fail → cost spikes and silent partial work

Map incidents to a part. “The model hallucinated” is a lazy postmortem. “Perception packed stale policy; action wrote before verify” is operable.

What to build first#

If you are standing up agentic capability, order investment like this:

1. Action allowlist + schemas — stop inventing tools
2. Bounds + exits — stop infinite loops
3. Perception packing — stop garbage-in
4. State and traces — stop flying blind
5. Richer planning / multi-agent — only after the above are boring

Teams that start with multi-agent theatre and skip bounds rebuild the same incident twice.

Anatomy in the design review#

Bring a one-pager, not a framework war. For each AI feature that claims agency, fill:

If a cell is blank, either assign it or demote the feature name. Reviewers should argue about the blank cells, not about whether LangGraph is “more agentic” than a hand-rolled loop.

A second pass belongs to security: for every write tool, name the injection path (untrusted email, uploaded PDF, web page) and the control (allowlist, argument validation, human gate). Anatomy without that pass is a coloring book.

Anti-patterns that break anatomy#

• God perception — dump the whole ticket history every turn; reasoning drowns
• Plan theatre — beautiful plans the executor ignores when a tool fails
• Shadow actions — model prints “I refunded you” while no tool ran (or the opposite)
• Memory as junk drawer — state writes without schema or TTL
• Bound washing — max_iterations=50 with no exit semantics, then blame the model

Call these out in PR templates. Anatomy only helps if people can name the break.

Summary#

An agentic AI system has anatomy: perception, reasoning, planning, action, state, and bounds, wired in a loop where the model proposes the next step and your runtime enforces reality. That is how agentic architecture stays an engineering discipline instead of a slide title.