A vendor-neutral reference architecture for enterprise agents: NKK's nine-layer stack, a pattern-selection matrix, a blast-radius gate, and the evidence on reliability, state, control and cost.
Written for: CIOs, chief architects, heads of AI, platform and security leads
12 chapters, 64 cited sources, 30 models and charts. The first 2 chapters are open; the rest unlock with the form.
Deloitte: share reporting a mature governance model for agentic AI (the base differs between its article and press release)
frontier models breached at least once in a red-teaming competition of more than 250,000 attempts
A single prompt and response, possibly with retrieval. Code decides what happens next.
Several model calls and tools in a path fixed by code: chains, routing, parallel branches, evaluator loops.
One model loop chooses tools and order within a bounded toolset, with exit conditions and an iteration cap.
A lead agent decomposes work and delegates to workers with their own context, then synthesises.
Peers hand off, negotiate or delegate across teams or organisations, possibly over A2A.
NKK's position is that the binding constraint on enterprise agents is increasingly what surrounds the model: nothing outside it limits what it can do, remember, spend or touch. Measured capability is rising fast: the 2026 AI Index summary reports real-world task success rising from 20% to 77.3% on one benchmark [1]. Control is not keeping pace. In Deloitte's survey of 3,235 leaders, 21% reported a mature governance model for agentic AI, although the base differs between Deloitte's article and its press release [2]. A red-teaming competition of more than 250,000 attempts found a successful attack against every one of the 13 frontier models it tested [3].
Our thesis is minimum viable agency: give each system the least autonomy, tool reach and authority that the task needs, and enforce those limits in deterministic layers outside the model. This paper turns that idea into a vendor-neutral reference architecture. It introduces six NKK models: the Autonomy Ladder, the Nine-Layer Reference Stack, the Control-Fit Matrix, the Blast-Radius Gate, the Reliability Loop and the Cost-per-Successful-Task Ladder. They are NKK's opinion, built on cited vendor, standards and academic material. They are not validated by outcome data.
The evidence is uneven, and we say where. The best-known multi-agent gain is a vendor-internal result [4]. NIST has announced agent standards work but has not finalised an agent standard [5][6]. The MCP specification changed materially in July 2026 [7]. Read every figure as dated 13 October 2026.
Three bodies of evidence point the same way. Capability is improving. Control is lagging. And the obvious fix, adding more agents, is not reliably better.
Deloitte: share reporting a mature governance model for agentic AI (the base differs between its article and press release)
frontier models breached at least once in a red-teaming competition of more than 250,000 attempts
Capability. The Stanford figure comes from a single benchmark, and the same page says AI still lags in tasks such as managing multiple-step planning [1]. It tells us agents are getting more useful. It does not tell us that a given enterprise workflow is reliable.
Control. Deloitte reports that 74% of respondents expect their companies to use agents at least moderately by 2027, and that 21% report a mature governance model [2]. These answer two different questions, and the base for the 21% differs between Deloitte's article and its press release, which says "only 21% of those companies" planning to deploy [8]. The gap is real, but its size is uncertain. On security, the UK NCSC argues that language models "simply do not enforce a security boundary between instructions and data inside a prompt" and that it is "very possible that prompt injection attacks may never be totally mitigated" [9]. The competition, which drew more than 400 participants, found that robustness "did not correlate uniformly with model capability" [3]. A stronger model is not a substitute for a boundary.
Coordination. A failure analysis of multi-agent systems reports that their "performance gains on popular benchmarks are often minimal" [10]. A controlled study of 260 configurations found results ranging from +80.8% (centralized coordination on decomposable financial reasoning) to -70.0% (independent coordination on sequential planning) against a single agent [11]. Architecture, not agent count, decides the outcome.
The implication is that capability is rented from model providers, while control is the part you own. Forrester predicts that vendor fragmentation will push a majority of enterprises towards composable agent architectures [12]. That is a forecast, not measured adoption, but it matches the direction of travel. OWASP gives the design instinct a name:
“Agents amplify existing vulnerabilities. We expand on the concepts of Least-Privilege and Excessive Agency by citing Least-Agency. This captures our advice to organizations to avoid unnecessary autonomy; deploying agentic behavior where it is not needed expands the attack surface without adding value.”
Everything that follows applies that advice. Each layer, pattern and gate is a mechanism for granting agency deliberately, and for taking it back when evidence says it was a mistake.
Vendors define the terms differently, which causes avoidable arguments. Anthropic separates workflows, "systems where LLMs and tools are orchestrated through predefined code paths", from agents, where LLMs "dynamically direct their own processes and tool usage" [14]. OpenAI defines an agent as a system that "independently accomplish[es] tasks on your behalf" and excludes simple chatbots, single-turn LLMs and sentiment classifiers [15]. Google and Microsoft describe fixed sequential and parallel pipelines of LLM agents as multi-agent patterns, even though the control flow is deterministic [16][17].
NKK's working rule is to classify by who controls the next step: code or model. OpenAI's Agents SDK documentation makes the same point in operational terms: orchestrating through code "makes tasks more deterministic and predictable, in terms of speed, cost and performance" [18]. Every rung of autonomy trades predictability for flexibility, so each should be earned.
A single prompt and response, possibly with retrieval. Code decides what happens next.
Several model calls and tools in a path fixed by code: chains, routing, parallel branches, evaluator loops.
One model loop chooses tools and order within a bounded toolset, with exit conditions and an iteration cap.
A lead agent decomposes work and delegates to workers with their own context, then synthesises.
Peers hand off, negotiate or delegate across teams or organisations, possibly over A2A.
The ladder echoes guidance from every major source. Anthropic recommends "finding the simplest solution possible, and only increasing complexity when needed" [14]. Microsoft says to "use the lowest level of complexity that reliably meets your requirements" and calls a single agent with tools often the right enterprise default [17]. Google notes that "you don't need an agentic workflow for tasks like summarizing a document" [19]. The Five Eyes joint guidance goes further and asks organisations to consider a full spectrum of solutions for repetitive tasks, including reducing or eliminating low-value processes [20]. The single-agent loop itself descends from ReAct, which interleaves reasoning traces with actions [21].
To apply it, write down the rung for each use case and the evidence that justified it. A move up requires a failed evaluation at the rung below. A move up also adds controls (see the Blast-Radius Gate later). Where it breaks: real systems mix rungs, such as an agent inside a workflow step, and the boundary between L2 and L3 is a matter of degree. Use the ladder to force the conversation, not to settle taxonomy.
| Criterion | Anthropic | OpenAI | Google Cloud | Microsoft |
|---|---|---|---|---|
| L0 Model call | Augmented LLM as the building block | Not an agent by OpenAI's definition | Not an agent pattern | Direct model call |
| L1 Workflow | Prompt chaining, routing, parallelization, evaluator-optimizer | Business workflow encoded in the run loop | Sequential, parallel and loop patterns | Sequential and concurrent orchestration |
| L2 Single agent | Agent | Single agent run loop | Single-agent and ReAct patterns | Single agent with tools |
| L3 Orchestrator-worker | Orchestrator-workers | Manager pattern (agents as tools) | Coordinator and hierarchical decomposition | Within multiagent orchestration |
| L4 Agent network | Not a named pattern | Decentralised handoffs | Swarm | Handoff and group chat |
Every figure and regulatory statement in this piece traces to a numbered source below. Links open the original publisher in a new tab.
MCP and A2A standardise how agents connect, not who may do what. Where the standards and governance stand, what has failed in deployments, and three NKK models for the control plane around them.
Prompt injection remains a residual risk, so agent security is a privilege-and-containment problem. Evidence, controls and three NKK models: a Threat-to-Control Map, Autonomy Tiers and an Agent Identity Stack.
NKK argues that much of RAG's headroom sits upstream of the model; no public source sizes the share. Four principal NKK models for readiness, pattern choice, trust and failure triage, built on cited evidence.
