Designing API Programs for AI Agents with Architecture as Code
This article from Morgan Stanley explores rethinking API programs to support AI agents, integrating the Model Context Protocol (MCP) with an "Architecture as Code" approach using CALM. It highlights the challenges and architectural shifts needed to enable secure, governed, and scalable API platforms for agentic workflows, focusing on automated governance through deployment gates and zero-downtime upgrades.
Read original on InfoQ ArchitectureThe Shift to APIs for AI Agents
The rapid emergence of AI agents and Large Language Models (LLMs) is fundamentally changing how API programs are designed and managed. Traditionally, APIs served human developers and applications. Now, the focus shifts to enabling AI agents to discover, invoke, and validate tools and data programmatically. This necessitates a rethinking of API governance, security, and deployment strategies to support the unique interaction patterns and scale requirements of agentic workflows.
Model Context Protocol (MCP)
The Model Context Protocol (MCP) is introduced as an open protocol for connecting LLM-based applications to tools and data. Unlike traditional OpenAPI specifications, which describe API capabilities, MCP focuses on defining "tools" as structured operations to perform tasks, along with reusable "prompts" (parameterized instructions) and "resources" (documents/data) to provide context for agents. The protocol itself is a simple client-server interaction, but the complexity arises in how agents orchestrate these tools, especially as the number of available tools grows, leading to overlapping definitions and increased token costs.
MCP Challenges and Gateway Evolution
As the number of tools for AI agents grows, issues like tool selection ambiguity and increased operational costs due to verbose interactions (token usage) become prominent. This drives the need for specialized gateways and control planes that understand and manage agent-specific interaction logic, blurring the traditional line where API gateways were strictly protocol-agnostic.
Architecture as Code with CALM
To address the challenges of modernizing API programs for AI agents, Morgan Stanley leverages an "Architecture as Code" approach using CALM (Continuous Architecture Lifecycle Management), an open-source project from FINOS. CALM provides a core modeling language (JSON schema for boxes and arrows), a CLI, and a powerful patterns mechanism. This enables organizations to define architectural patterns and enforce guardrails, facilitating rapid and consistent deployment of APIs and infrastructure across diverse use cases.
- Core Model: A JSON schema for modeling architectural components and their relationships, supporting typed information beyond basic C4 models.
- CLI Tooling: For interacting with CALM definitions and deployments.
- Patterns: Reusable architectural blueprints that enforce guardrails and streamline deployments, ensuring consistency and adherence to best practices. Morgan Stanley has deployed over 110 APIs using a few core patterns.
- CALM Hub: An open-source "Artifactory for architectures" for managing and discovering architectural patterns and controls.
Automated Governance and Scalability
A critical aspect of supporting enterprise-grade AI and agentic workflows is robust governance and control. The integration of CALM with deployment gates enables automated enforcement of architectural, security, and operational policies. This "architecture-driven deployment" ensures that APIs for agents are deployed safely, consistently, and with zero-downtime upgrade capabilities, which is essential for scaling complex enterprise AI initiatives. This approach emphasizes baked-in security and automated compliance from the outset, rather than as an afterthought.