Agentic engineering
Agentic engineering is not a chatbot project
Agents that take actions in enterprise systems need tools, evals, kill switches, and idempotent writes. Chat UIs are the easy part.
A chatbot answers. An agent acts. The gap between those two sentences is where most enterprise AI programmes go to die.
If the artefact is a box that talks, you have a content problem. If the artefact is a worker that opens a case, posts a journal, or emails a customer, you have a distributed systems problem — with a non-deterministic function in the middle.
The minimum architecture
Every production agent we will put in front of an Australian enterprise has five parts:
- A planner with a bounded job. Not “help the business.” “Prepare a draft refund within policy X.”
- A tool catalog that is actually your APIs — CRM, ERP, ticketing, document store — with scopes, not a kitchen sink.
- Memory that is boring. Retrieval over your corpus, not a mystery brain. Retention aligned to APP.
- A human gate for irreversible writes. The gate is a product surface, not a footnote.
- Evals. Offline cases from last quarter’s work. Online traces. A budget.
Skip any one of those and you are running a demo on a longer leash.
Idempotency is not optional
Language models retry. Users click twice. Queues redeliver. If your “create opportunity” tool is not idempotent, you will create three opportunities and a reconciliation project.
Treat tool calls like you treat payment webhooks. Idempotency keys, exactly-once effects even if the message is at-least-once, and a dead-letter path a human can drain.
Permissions are the product
The scary version of an agent is not that it hallucinates a paragraph. It is that it calls updateAccount with a token that can see the whole org. Map tools to the same RBAC you already failed to finish for the API programme. Agents inherit that mess. They do not forgive it.
What we refuse to build
- Agents with production write access and no eval harness.
- Agents whose only interface is Slack, with no audit.
- Agents that wrap a vendor UI instead of your systems of record.
If that sounds conservative, good. Conservatism is how you still have a brand after the first bad write-back.
Chat is a skin. Agentic engineering is the rest of the iceberg.
