Agentic AI and multi-agent architecture

Containment is a primary control plane: isolate package registries, stop unnecessary egress and use ephemeral credentials.

A supervisor alone is not enough: deterministic policy enforcement, capability-scoped credentials, action budgets and independent monitors must sit outside the model's reasoning loop.

Separate execution from judgement: higher-risk actions need a policy engine or human approval.

Audit the full trajectory: prompts, tool calls, state transitions, retrieved data, credential use and approvals must be logged. For recovery, memory and checkpoints should live in integrity-protected, versioned stores.

The AWS monday.com case supports the coordinator-plus-specialists pattern; the OpenAI incident shows that resource and network policy must be enforced outside the orchestration layer too.