Traditional threat modeling frameworks (STRIDE and similar) mostly transfer to agentic systems, plus a category of threat specific to a system that reasons and acts rather than just processes requests deterministically.

Closing out a month of daily posts on agent infrastructure by assembling every piece — context, MCP, memory, A2A, structured outputs, the gateway — into one reference architecture diagram.

Context, memory, and protocols only matter if the calls flowing across them are reliable. Closing this series with the contract layer — schema validation, retry-on-malformed, and testing the boundary between agents and tools like any other API.

Multi-region deployment is standard practice for traditional web services. For an agentic system, it interacts with vector indexes, memory stores, and LLM provider availability in ways that need their own specific design.

An agent that calls real external APIs needs real credentials somewhere in its execution path, and the model itself should never be one of the places those credentials pass through.

The earlier rate-limiting post covered fairness across teams. This closes the loop for the gateway architecture — fairness needs to account for agents within a team too, not just team-level boundaries."

Auth, rate limiting, observability, and circuit breaking have all been covered separately across this series as individual concerns. An agent gateway is where they converge into one enforced layer instead of being reimplemented per tool server."

Most A2A discussion assumes a clean delegation — one agent asks, another does it. Real cross-agent interactions often need actual negotiation, when the first request isn't something the receiving agent can fully satisfy as asked.

The LangSmith tracing post from earlier in this blog covered agent-framework-level observability. MCP introduces its own boundary that needs its own tracing discipline, since a call now crosses a protocol and often an organizational line.

MCP solves how an agent talks to tools. Agent2Agent (A2A) solves a different problem — how independently built agents, possibly from different vendors, talk to each other. Here's how it works and where it actually shows up in production.