TL;DR: Enterprises are deploying hundreds of AI agents across their operations — but most lack a systematic way to govern, secure, and orchestrate them. Recently I have published a milestone update to the ArcKit open-source project: PR #626. The ArcKit Agent Architecture overlay, implemented in this Arckit Agent-Architecture plugin brings Enterprise Architecture methodology to AI agent programmes, providing inventory, design, governance, security, and maturity assessment workflows.

The Big Picture: AI Agents Going Mainstream

In 2026, AI agents have moved from experiment to production. Financial services run autonomous compliance checkers. Healthcare organisations deploy triage agents. Government agencies use research and analysis agents for policy development. Manufacturing companies orchestrate entire supply chains through agent networks.

The numbers tell the story:

  • Adoption rate: According to 2025/2026 market data, approximately 70% of Fortune 500 firms have active deployments or pilots of autonomous agentic AI platforms to combat operational complexity. (Source: SNS Insider / Enterprise Agentic AI Report)
  • Scale: Large enterprises typically run 50-200+ agents across their organisation
  • Complexity: Agents range from simple task automation to multi-agent swarms coordinating across business units

The challenge is no longer building agents — it’s managing them at scale.

The Problem: Too Many Agents, Too Little Coordination

Here’s what happens when organisations scale agents without a governance framework:

Symptom Root Cause Impact
Agent Sprawl Shadow AI agents — teams build agents independently 100+ agents with no inventory, no visibility
Duplicate Effort Multiple teams solving the same problem Wasted investment, conflicting outputs
Security Gaps No standardised security review for agents Data exposure, compliance violations
Integration Chaos Agents can’t communicate or share context Siloed automation, missed opportunities
Compliance Risk No oversight model or audit trail Regulatory penalties, board-level scrutiny

The fundamental issue: Organisations treat agents as individual projects rather than as a programme that needs architecture, governance, and lifecycle management.

Enterprise Architecture (EA)

EA, leveraging established frameworks like TOGAF ADM, brings the necessary discipline to AI agent programs by enforcing structured planning, strategic traceability, clear governance, and full lifecycle management. However, because traditional EA wasn’t built for autonomous systems, it must be adapted with agent-specific approaches—including tailored design patterns, risk-calibrated oversight, seamless integration protocols, robust security against modern AI threats, and maturity models—to effectively govern and scale enterprise AI deployments.

The Solution: ArcKit Agent Architecture Overlay

The ArcKit Agent Architecture plugin bridges EA methodology with AI agent governance. It provides six slash commands and a six-phase build recipe:

Six Core Commands

Command Doc Type Purpose
/arckit:agent-inventory AAGI Catalog all agents with capabilities, security classification, and oversight levels
/arckit:agent-design AAGR Design agent architecture — patterns, tool contracts, memory, orchestration, guardrails
/arckit:agent-governance AAOV Establish oversight models, approval workflows, audit requirements, compliance mapping
/arckit:agent-integration AAIN Design agent-to-agent integration, tool contracts, and orchestration patterns
/arckit:agent-security AASE Harden agent security — sandboxing, permission models, threat assessment
/arckit:agent-maturity AAMT Assess and track agent programme maturity with continuous improvement metrics

Six-Phase Recipe

inventory → design → governance → integration → security → maturity

Each phase produces traceable artefacts that feed into the next. No silos, no duplication.

How to Use the Plugin

Installation (local)

git clone https://github.com/terrygzhou/arc-kit/tree/main
cd arc-kit

claude --plugin-dir ./plugins/arckit-agent-architecture

Workflow

Step 1: Inventory Your Agents

/arckit:agent-inventory Catalog all AI agents in the data processing pipeline

Produces a master register: agent IDs, owners, risk/oversight tiers, capability matrices, and dependency maps.

Step 2: Design New Agent Architecture

/arckit:agent-design research-agent

Generates architecture specs: pattern selection (single/chain/multi/hierarchical), component diagrams, tool contracts, memory layers, and orchestration logic.

Step 3: Establish Governance

/arckit:agent-governance research-agent

Creates oversight framework: HITL/HOTL/AWA tiers, approval SLAs, audit cadence (weekly/monthly/quarterly), KPIs, and compliance mapping (UK/EU/NIST).

Step 4: Design Integration

/arckit:agent-integration

Plans agent communication: integration patterns (MCP/REST/events), shared contracts/memory, orchestration frameworks, and retry strategies.

Step 5: Harden Security

/arckit:agent-security

Secures against threats: sandbox isolation, least-privilege permissions, threat modeling (injection/exfiltration), and guardrail configuration.

Step 6: Measure Maturity

/arckit:agent-maturity

Assesses programme health: cross-dimensional scoring, improvement roadmaps, industry benchmarking, and continuous tracking.

Next Steps

  • Install the ArcKit Agent Architecture overlay: claude plugin install arckit arckit-agent-architecture
  • Start with /arckit:agent-inventory to catalogue your current agent landscape
  • Follow the six-phase recipe: inventory → design → governance → integration → security → maturity
  • Pair with the ArcKit TOGAF ADM overlay (arckit-togaf-adm) for full Enterprise Architecture coverage

Real-World Example: MagicDelivery’s Agent Programme

Context: MagicDelivery MagicDelivery Repo is transforming a 10,000-staff organisation with hundreds of AI agents across operations.

Challenge

MagicDelivery needed to govern agents spanning:

  • Research agents for policy analysis
  • Compliance checkers for regulatory mapping
  • Workflow orchestrators for cross-functional processes
  • Security auditors for vulnerability assessment

Outcome: Agent Architecture (6 artefacts)

Outcome

Artefact Description
AGT-INV Agent Inventory (8 agent types)
AGT-DES Agent Design (architecture, patterns, orchestration)
AGT-INT Agent Integration (multi-agent, cross-domain)
AGT-GOV Agent Governance (guardrails, oversight, compliance)
AGT-SEC Agent Security (controls, sandboxing, privacy)
AGT-MAT Agent Maturity Assessment

Approach

  1. Inventory (/arckit:agent-inventory): Catalogued all agents with ownership, risk levels, and deployment status
  2. Design (/arckit:agent-design): Architected each agent’s tool contracts, memory architecture, and guardrails
  3. Governance (/arckit:agent-governance): Established three-tier oversight model mapped to UK AI Playbook requirements
  4. Integration (/arckit:agent-integration): Connected agents through shared MCP servers and event buses
  5. Security (/arckit:agent-security): Implemented sandbox boundaries, permission models, and injection prevention
  6. Maturity (/arckit:agent-maturity): Established baseline metrics and improvement roadmap

Key Takeaways

  1. Inventory first: You can’t govern what you can’t see. Start with /arckit:agent-inventory
  2. Architecture over ad-hoc: Design agents systematically using proven patterns
  3. Governance is non-negotiable: Oversight models, audit trails, and compliance mapping are table stakes
  4. Security by design: Build guardrails into agent architecture, not as an afterthought
  5. Measure to improve: Maturity models track progress and guide investment
  6. Traceability matters: Every agent decision links to business strategy and requirements

“The difference between an agent programme that scales and one that collapses is not technology — it’s architecture.”

References

Tags: #AI #Agents #EnterpriseArchitecture #Governance #ArcKit #AgentArchitecture