Journey / 43 exchanges

A small request. A complete system.

A customer wants to change the delivery address on an order that has already been paid for. Follow the request from channel to record, through every control that makes the result defensible.

User or upstream system → Experience & Interaction

A customer asks to change the delivery address on an order that has already been paid for.

What’s happening technically

Exchange: task arrives on a channel
Carries: The task itself, plus the identity and entitlements of whoever is asking.
Contract: Authenticated channel session or API credential.
Watch: Under-specified intent with no path to ask a clarifying question · Service-account identity that erases whose entitlements apply

Experience & Interaction → AI Gateway

The request is attached to the customer, organisation, channel, and current session.

What’s happening technically

Exchange: session and tenant context
Carries: The normalised request with session and tenant context attached.
Contract: Internal request envelope: tenant, session, channel, modality.
Watch: Tenant inferred from the session rather than asserted explicitly

AI Gateway → Security, Safety & Guardrails

Before any model is called, the request is screened for hostile instructions and sensitive data.

What’s happening technically

Exchange: screen before spending a token
Carries: The request, on its way to be screened before anything is spent.
Contract: Synchronous guardrail call at the gateway edge, fail-closed.
Watch: Fail-open behaviour when the guardrail service is slow or unavailable · Screening treated as sufficient because it happened at the edge

Security, Safety & Guardrails → AI Gateway

A narrowly scoped agent identity is allowed to continue inside the customer’s entitlements.

What’s happening technically

Exchange: cleared · scoped agent identity
Carries: Clearance, plus a short-lived credential scoped to this task for the agent that will act.
Contract: Just-in-time credential bound to this task and this trace ID.
Watch: Long-lived credentials issued because short-lived ones were inconvenient · Scope granted for the whole session rather than the specific action

AI Gateway → Orchestration & Durable Execution

The task begins with an explicit cost, time, and step budget.

What’s happening technically

Exchange: plan, inside this budget
Carries: The cleared task and the budget ceiling it must complete within.
Contract: Budget envelope plus step and termination limits, attached to the trace.
Watch: A budget checked only at ingress, so an expensive loop is discovered too late

Orchestration & Durable Execution → Domain & Semantic

The system resolves what “delivery address” and “paid order” mean in this business.

What’s happening technically

Exchange: what do these terms mean?
Carries: The planned sub-task, in whatever words the user and planner used.
Contract: Task description plus the entities and metrics it mentions.
Watch: Skipping grounding entirely and retrieving on raw user phrasing

Domain & Semantic → Orchestration & Durable Execution

The task now uses the same entities and rules as the order system.

What’s happening technically

Exchange: resolved entities and metrics
Carries: The same request, now unambiguous: resolved entities, agreed metric definitions, applicable rules.
Contract: Defined query — the terms mean what the warehouse thinks they mean.
Watch: Definitions resolved but not carried through, so retrieval falls back to keywords

Orchestration & Durable Execution → Retrieval & Context Engineering

Only the context required for this decision is assembled.

What’s happening technically

Exchange: assemble context for this step
Carries: A request for the evidence this reasoning step needs, with a token budget attached.
Contract: Context request bounded by budget and by the acting identity.
Watch: No budget passed, so retrieval optimises for recall and the context window pays for it

Retrieval & Context Engineering → Data Integration & Provenance

The order record is requested under the customer’s own entitlements.

What’s happening technically

Exchange: governed rows and columns
Carries: A query against systems of record, evaluated for the identity the agent acts under.
Contract: Data contract plus row and column policy for the acting identity.
Watch: Entitlements applied at query time but lost once results enter the context window

Data Integration & Provenance → Retrieval & Context Engineering

Governed data arrives with lineage showing where every fact came from.

What’s happening technically

Exchange: data with lineage and entitlements
Carries: Governed rows and columns, with lineage events emitted and freshness guaranteed by contract.
Contract: Data plus provenance; anything stale or out of contract is refused rather than returned quietly.
Watch: Stale sources answering confidently because freshness is not enforced · Lineage dropped, so an incorrect answer cannot be traced

Retrieval & Context Engineering → Memory & State

The system checks whether this customer or order has relevant prior history.

What’s happening technically

Exchange: what do we already know?
Carries: A recall request scoped to this tenant and this user.
Contract: Tenant-partitioned lookup; no cross-tenant reads under any circumstances.
Watch: Shared stores with a careless key allowing cross-tenant recall

Memory & State → Retrieval & Context Engineering

Only tenant-safe, relevant memory is returned.

What’s happening technically

Exchange: episodic, semantic, procedural
Carries: Prior episodes, learned facts and the procedures this organisation follows.
Contract: Recall with provenance per fact, so a remembered claim can be checked.
Watch: Recall that is confident and wrong, because nothing scores whether a memory is still true · Memory poisoning surviving indefinitely because nothing expires

Retrieval & Context Engineering → Orchestration & Durable Execution

The usable facts are compacted into a bounded context.

What’s happening technically

Exchange: context inside the token budget
Carries: The assembled context package: evidence, citations, tool definitions, inside the token budget.
Contract: Token-budgeted context with citations preserved.
Watch: Budget exceeded and silently truncated in the middle, where models attend least · Citations dropped during compaction, making the answer unverifiable

Orchestration & Durable Execution → AI Gateway

The orchestrator asks for the next safe action, not a prose answer.

What’s happening technically

Exchange: reason over this context
Carries: The reasoning request — sent through the gateway rather than direct to a provider.
Contract: OpenAI-compatible call; no direct provider access from inside the loop.
Watch: Direct calls that bypass the gateway, erasing quota, cost and policy at once

AI Gateway → Model & Inference

The gateway selects a pinned model tier and records the cost envelope.

What’s happening technically

Exchange: routed, cached, metered
Carries: The call, routed to a model tier, served from cache where possible, and metered.
Contract: Routing decision plus a cost record keyed to the trace.
Watch: Cache keys that omit tenant, leaking one tenant's answer to another

Model & Inference → CORE

The model reasons over the prepared context.

What’s happening technically

Exchange: inference on a pinned model
Carries: The prompt and context, to a version-pinned model.
Contract: Pinned model version with a documented deprecation date.
Watch: Unpinned versions changing behaviour silently between releases

CORE → Model & Inference

The model returns a proposed next action.

What’s happening technically

Exchange: completion
Carries: The completion, with token counts.
Contract: Structured output against the declared schema.
Watch: Prose returned where a schema was expected, then parsed with a regular expression

Model & Inference → Orchestration & Durable Execution

The proposal is checked against a schema before anything can act on it.

What’s happening technically

Exchange: next action, schema-valid
Carries: A structured proposal for the next action — which tool, which arguments, with what confidence.
Contract: Schema-valid structured output, validated before it is scored.
Watch: Schema validity assumed rather than checked · Confidence taken from the model's own words rather than measured

Orchestration & Durable Execution → Governance, Oversight & AgentOps

The address change is scored for impact, reversibility, sensitivity, and confidence.

What’s happening technically

Exchange: score against autonomy policy
Carries: The proposed action, for scoring against the autonomy policy.
Contract: Policy-as-code evaluated per action, not per session.
Watch: The gate placed after execution, which makes it a log rather than a control

Governance, Oversight & AgentOps → Experience & Interaction

Because the order is paid, the workflow pauses at a durable approval checkpoint.

What’s happening technically

Exchange: approval at a durable checkpoint
Carries: An approval request, with the action and the evidence behind it, paused at a durable checkpoint.
Contract: The task waits without holding resources and resumes from the snapshot.
Watch: A reviewer shown the action but not the evidence · Approval fatigue from too many low-stakes interruptions

Experience & Interaction → Governance, Oversight & AgentOps

An authorised person approves or rejects the change with the evidence in view.

What’s happening technically

Exchange: human decision
Carries: The human decision, recorded against the trace with the approver identity.
Contract: Decision written to the audit trail before execution resumes.
Watch: Resumption that replays side effects already executed before the pause

Governance, Oversight & AgentOps → Orchestration & Durable Execution

The decision is recorded and the workflow resumes without losing state.

What’s happening technically

Exchange: proceed unattended, logged
Carries: Permission to proceed unattended, because the action is reversible and low impact.
Contract: Recorded policy decision carried on the trace.
Watch: Approval granted for a class of actions rather than this action

Orchestration & Durable Execution → Tool, Skill & Sandbox

A typed address-change operation is prepared for execution.

What’s happening technically

Exchange: execute the typed tool call
Carries: The typed tool call, with validated arguments and an idempotency key.
Contract: Typed contract with declared inputs, outputs and error semantics.
Watch: Arguments validated only in the model's output, not at the tool boundary · Write calls without idempotency keys, so a retry duplicates the effect

Tool, Skill & Sandbox → Infrastructure & Runtime

The operation receives isolation proportional to its blast radius.

What’s happening technically

Exchange: provision an isolated sandbox
Carries: A request for isolation proportionate to the blast radius of this call.
Contract: Default-deny egress, ephemeral filesystem, root dropped, no host secrets inside.
Watch: Generated code executed with no sandbox at all because it was only a read

Infrastructure & Runtime → Tool, Skill & Sandbox

The sandbox becomes ready without receiving ambient credentials.

What’s happening technically

Exchange: microVM, gVisor or Wasm ready
Carries: The sandbox: a microVM at roughly 125–150 ms, an application kernel, or a Wasm runtime under 5 ms.
Contract: Isolation chosen per tool class rather than once for the platform.
Watch: Wasm chosen for its start time where the tool needs native libraries it cannot use

Tool, Skill & Sandbox → ML & Decision Intelligence

A cheaper specialist validates the address and delivery constraints.

What’s happening technically

Exchange: classify, rerank or forecast
Carries: A decision that a classifier, reranker, forecaster or optimiser will answer better.
Contract: Tool contract like any other, with accuracy and drift monitoring attached.
Watch: The LLM path used for a repeated decision a small model already answers better

ML & Decision Intelligence → Tool, Skill & Sandbox

A structured score returns without spending another language-model call.

What’s happening technically

Exchange: score or plan, far cheaper
Carries: A score, ranking or plan, at a fraction of the cost and latency of a language model.
Contract: Deterministic, versioned output with a monitored error rate.
Watch: Drift unmonitored because these models sit outside agent telemetry

Tool, Skill & Sandbox → Protocol & Interoperability

The call crosses the boundary on a versioned standard contract.

What’s happening technically

Exchange: cross on a standard contract
Carries: The call, handed to the protocol layer so the framework on either side stays replaceable.
Contract: Standard contract — MCP, A2A, OpenAPI or AsyncAPI — rather than bespoke glue.
Watch: Bespoke integrations that make the framework expensive to change later

Protocol & Interoperability → Systems of record and peer agents

The order system receives only the scoped operation it knows how to authorise.

What’s happening technically

Exchange: MCP to systems · A2A to peers
Carries: The read or write, executed against the real system under the agent's scoped identity.
Contract: MCP request or A2A task; peer agents negotiate through agent cards and a task lifecycle.
Watch: Third-party MCP servers unsigned, unscanned and unpinned · Insecure inter-agent communication once peers are involved (OWASP ASI07)

Systems of record and peer agents → Protocol & Interoperability

The system of record returns the updated order or a typed failure.

What’s happening technically

Exchange: result or task handle
Carries: The result, an artifact, or a handle to a long-running task.
Contract: Typed response; long-running work returns a task handle rather than blocking.
Watch: Peer agent output trusted as internal data rather than screened as external input

Protocol & Interoperability → Tool, Skill & Sandbox

The response is converted back into the tool contract.

What’s happening technically

Exchange: typed result or typed error
Carries: A typed result or a typed error — never an exception the loop has to interpret from prose.
Contract: Declared error semantics, so failure is a value the planner can reason about.
Watch: Errors flattened into strings, so the planner retries the wrong thing

Tool, Skill & Sandbox → Orchestration & Durable Execution

The result is observed, then the orchestrator decides whether another loop is needed.

What’s happening technically

Exchange: observe, then re-plan
Carries: The outcome of the action, and whatever the system now knows that it did not before.
Contract: Structured result appended to durable state, then re-planned against.
Watch: Looping without progress because nothing measures whether the result advanced the task · Budget consumed by iterations that never converge

Orchestration & Durable Execution → Memory & State

Only durable knowledge that passes the memory-write policy is retained.

What’s happening technically

Exchange: write back what earns persistence
Carries: The facts, episodes or procedures this task earned the right to persist.
Contract: Write policy decision, with TTL and redaction applied before storage.
Watch: Persisting everything by default, which degrades recall and creates retention liability

Orchestration & Durable Execution → Security, Safety & Guardrails

The final response is validated for schema, policy, and data leakage.

What’s happening technically

Exchange: validate the final output
Carries: The completed result, or the partial result plus the reason the loop stopped.
Contract: Final output with the termination reason attached.
Watch: Partial results presented as complete because the stop reason was dropped

Security, Safety & Guardrails → AI Gateway

A clean, permitted result returns through the gateway.

What’s happening technically

Exchange: schema-valid and policy-clean
Carries: Output that has passed schema and policy validation and been redacted where required.
Contract: Schema-valid, policy-clean payload, or a controlled failure path.
Watch: Validation applied to the final message only, while intermediate steps already acted · Silent redaction that leaves the reader with a misleading answer

AI Gateway → Experience & Interaction

The cost is attributed to the correct tenant and successful task.

What’s happening technically

Exchange: metered and charged to the tenant
Carries: The response, with the token cost of the whole task counted and charged to the tenant.
Contract: Cost record keyed to the same trace ID as the work it paid for.
Watch: Cost aggregated per call rather than per successful task, hiding the real unit economics

Experience & Interaction → User or upstream system

The customer receives the result with provenance and any limitations stated plainly.

What’s happening technically

Exchange: answer, with provenance
Carries: The answer, streamed, with provenance and any refusals or uncertainties stated plainly.
Contract: An answer plus the evidence needed to calibrate trust in it.
Watch: Fluency mistaken for grounding because provenance was not shown · Refusals presented as errors, teaching users to route around the control

Orchestration & Durable Execution → Observability & FinOps

Every hop contributes a correlated span to the same task trace.

What’s happening technically

Exchange: a span for every hop
Carries: A span for every hop in the sequence above, carrying trace, thread and task IDs, the acting identity, the policy decision and the cost. Drawn once here; emitted by every exchange in the diagram.
Contract: OpenTelemetry GenAI semantic conventions; correlation survives queues, handoffs and approval waits.
Watch: Correlation broken at an asynchronous boundary, which makes replay impossible · Instrumentation retrofitted after launch — the most expensive omission in this whole composition

Observability & FinOps → Evaluation & Assurance

The trace becomes an evaluation case the system can replay.

What’s happening technically

Exchange: traces become eval cases
Carries: Production traces converted into evaluation cases, especially the ones that failed.
Contract: Every incident becomes a permanent regression case.
Watch: Incidents closed without a test, so the same failure returns

Evaluation & Assurance → Governance, Oversight & AgentOps

Evaluation evidence informs whether the current release remains admissible.

What’s happening technically

Exchange: evidence for the release gate
Carries: Evidence a release gate can act on: pass rates by scope, variance across runs, attack success rate, cost per successful task.
Contract: Scores published with the harness and judge configuration that produced them.
Watch: A single passing run treated as proof · Judges never calibrated against human graders

Governance, Oversight & AgentOps → Orchestration & Durable Execution

Approved, versioned changes can be deployed back into the execution system.

What’s happening technically

Exchange: redeploy versioned artefacts
Carries: Approved changes — versioned agents, prompts, models, tools and policies — deployed by canary or shadow with rollback ready.
Contract: Registry-tracked change with an owner and a way back.
Watch: Changes applied straight to production because the canary path was never built · Shadow agents outside any registry, so changes cannot be governed at all

Governance, Oversight & AgentOps → Security, Safety & Guardrails

Governance policy is compiled into the guardrails that enforce it on every call.

What’s happening technically

Exchange: policy compiled into enforcement
Carries: Policy authored in governance, compiled into the rules guardrails actually enforce at runtime.
Contract: Policy-as-code, versioned and deployed like any other artefact.
Watch: Written standard and deployed rules drifting apart, which makes the policy decorative

Infrastructure & Runtime → Observability & FinOps

Capacity, availability, and cost close the operational picture.

What’s happening technically

Exchange: capacity, cost and availability
Carries: Platform capacity, cost and availability, so infrastructure economics sit in the same picture as token economics.
Contract: Cost and utilisation records joined to the same tenant and trace dimensions.
Watch: GPU cost and token cost reported separately, so nobody owns cost per successful task