I have read a lot of agent architecture content over the last two years, and almost all of it is about the same layer: how the agent thinks.
Prompt chaining, routing, orchestrator-workers, evaluator-optimizer, ReAct, plan-and- execute.
That layer is genuinely well served, and I am not going to add to it.
Here is the uncomfortable thing I keep running into instead.
The incidents I have seen and reviewed did not come from picking the wrong orchestration pattern.
They came from an agent that was allowed to do something nobody had decided it could do.
A support agent with read access to the orders database escalating from to , because a customer wrote "I was double-charged, sort it out." A contractor asking a policy chatbot about executive severance and getting a correct, well-cited answer from a document they were never permitted to see.
An accounts-payable agent paying a $4,200 invoice, getting killed mid-run by a pod eviction, and paying it again on the retry.
None of those is a reasoning failure.
In every case the model did something defensible.
They are architecture failures, and they all live in the two layers underneath the framework.
TL;DR An AI agent has three layers, and most content covers only the first: Layer Decides Examples Well covered?
Framework how the agent thinks LangGraph, CrewAI, Agent Framework Yes — go read Anthropic and Gulli Harness how the agent acts the loop, budgets, sandboxing, compaction, retries Barely Governance what the agent is allowed to do policy, identity, approval, audit, redaction Barely, and usually as vendor marketing Agent = Model + Harness.
The model proposes; the harness disposes.
A tool call is a request, not an action, and everything that makes it safe to honour lives outside the model.
This series is 18 patterns for those two layers, each one backed by code that runs, with the failure it prevents included as a program you can execute.
The code is at github.com/shashikanth-gs/agent-harness-patterns — 314 tests, runs offline with no API keys.
The framework layer is not the problem I want to be specific about what I am not claiming, because "frameworks don't matter" is the kind of statement that gets quoted without its qualifier.
The framework layer is well covered, and you should read that work.
Anthropic's Building Effective Agents is the best short treatment of the workflow patterns — prompt chaining, routing, parallelisation, orchestrator-workers, evaluator-optimizer — and its central advice ("use the simplest thing that works, add agentic behaviour only when it pays") is correct and widely ignored.
Antonio Gulli's Agentic Design Patterns catalogues 21 patterns with runnable code across LangChain, CrewAI, and Google ADK.
Between them, that layer has a canon.
What I am claiming is narrower and, I think, harder to argue with: your choice between LangGraph and CrewAI will not determine whether you have an incident.
Your answer to "who decided this agent could issue refunds, and what stops it issuing one it shouldn't?" will.
I tested this claim rather than asserting it.
Every pattern in this series is written as a plain-Python hook, then mounted — unchanged — on both LangGraph and Microsoft Agent Framework, with tests asserting the denial messages come out byte-for-byte identical because they come from the same code.
That is in the adapters article.
The patterns port.
The framework is plumbing.
What a harness actually is The LLM is a reasoning engine.
It reads text and produces text, including text that says "call with these arguments." It cannot execute anything.
Everything between that proposal and a refund actually reaching a customer's card is the harness: Those five seams are the whole architecture.
Every pattern in this series mounts on one or two of them: Seam What mounts there context compaction, memory injection, budget checks output guardrails, citation verification privilege broker, approval gate, identity, budgets, sandboxing — returns ALLOW / DENY / PAUSE redaction, untrust