Architecting for Agentic AI: Rethinking Well-Architected Frameworks

Traditional Well-Architected Frameworks (WAF) assume a predictable execution path where the call graph of a system can be fully diagrammed and understood before deployment. This allows for clear projections of TPS, identification of failure modes, and estimation of system stress. However, agentic AI introduces a fundamental shift in this paradigm, making it difficult to pre-configure execution paths.

The Architectural Shift with Agentic AI

Unlike traditional ML models that act as components with fixed inputs and outputs, agentic AI systems involve models making dynamic decisions. A single request can lead to a variable number of model calls, memory retrievals, and tool invocations, with the model deciding the next step at each iteration. This means the call graph is constructed at runtime, not entirely known in advance, which significantly impacts design review processes.

Operational Excellence in Agentic Systems

Achieving operational excellence in agentic AI requires new practices beyond traditional metrics like availability and latency. It's crucial to monitor the *behavioral integrity* of the agent, as its decision quality can degrade without impacting traditional system health indicators. This necessitates a focus on:

• Prompt Lifecycle Management: Treat prompts like code, using version control, deployment pipelines, golden dataset evaluations, and rollback strategies. The OpenTelemetry GenAI semantic conventions are vital for instrumenting reasoning processes.
• Reasoning Instrumentation: Adopt OpenTelemetry's GenAI semantic conventions to trace every step of an agent's reasoning chain. This enables rapid debugging and understanding of "why" an agent behaved a certain way, rather than reconstructing from fragmented logs.
• Human-in-the-Loop Review: For critical workflows (e.g., healthcare), maintain human oversight where agents propose actions that clinicians confirm, logging all inputs, outputs, context, and reasoning.
• Canary Deployments: Implement canaries with known test cases to validate that agents continue to make correct decisions after changes.

Security Considerations: The Agent as a New Principal

Agentic AI introduces a new type of security principal that interprets untrusted natural language, making it vulnerable to misuse of legitimate permissions (e.g., jailbreaking). The "lethal trifecta"—an agent with access to private data, exposure to untrusted content, and external communication capability—must be avoided through careful design.

• Least Agency Principle: Adopt OWASP's concept of "least agency," which extends least privilege by limiting the agent's freedom to act on its access without human verification. Autonomy should be earned, not defaulted.
• Identity and Authorization Boundaries: Each production agent should have its own identity and a narrowly scoped authorization boundary to prevent a single agent from performing conflicting actions (e.g., reading data, recommending, executing, and approving).
• Prompt Injection: Recognize prompt injection as an operational threat, not just a content quality issue, and design defenses accordingly.