Murphy’s Guide to Enterprise Agentic Architecture

The control is present and the record is being kept. What is missing is a measurement that would show it has stopped working.

• AP-01The gate that only logs

  You’d see

  A required checkpoint exists, fires on every relevant action, and produces an artifact.

  You’ll fix

  Anchor each checkpoint to its specification and measure its blocking rate, not its completion rate.

• AP-04Trust earned by interaction history

  You’d see

  A counterparty is trusted because of accumulated history: months of correspondence, reliable prior dealings, responsiveness, detailed personal knowledge.

  You’ll fix

  Record how each significant trust relationship was established.

• AP-05Evidence you were shown, not sampled

  You’d see

  "Legal already signed off." "Everyone on the team is doing it this way." An approach that arrives exactly when it is needed, from someone who turns out to share your background, with a track record you can personally verify.

  You’ll fix

  Require cited consensus to trace to primary sources; treat unverifiable approval citations as unconfirmed.

• AP-09Precedent as permission

  You’d see

  "We've done this before" is a sufficient argument. Overrides exist for emergencies and are used weekly.

  You’ll fix

  Anchor normative boundaries to canonical text and treat precedent citation as a reason for more scrutiny, not less.

• AP-15Provenance gaps treated as omissions

  You’d see

  An artifact's origin is partially unknown and that is tolerated as untidy record-keeping.

  You’ll fix

  Require end-to-end provenance chains on high-consequence artifacts and treat unclaimable gaps as defects.

• AP-16Decisions that cannot be replayed

  You’d see

  Logs record what was decided, not what the decision saw: no inputs, no retrieved context, no model state, no versions.

  You’ll fix

  Make replay-readiness a service objective for high-consequence actions, logging inputs, context, retrieved evidence, and model state.

• AP-17Authority without an expiry

  You’d see

  Approvals, consents, attestations, and risk assessments are granted once and remain in force.

  You’ll fix

  Require effective-date attestation on authority-bearing artifacts and verify freshness against authoritative publication at decision time.

There is a decision point, and it accepts whatever arrives. The fix is a machine-checkable condition it must satisfy first.

• AP-02Approval without deliberation

  You’d see

  "Approve" is whatever the approval surface accepts. Two hundred changes in one dialog.

  You’ll fix

  Put validity predicates on approval events: human identity, context actually presented, decision freshness, ordering before the action, and a minimum review interval for high-consequence items.

• AP-06Definitions with no test set

  You’d see

  Terms that gate behavior — "high-risk," "routine," "sensitive," "approved-pattern" — are defined in prose and interpreted at runtime.

  You’ll fix

  Keep frozen edge-case sets for every high-criticality predicate and replay them on a schedule and after any change to surrounding guidance.

• AP-11Memory with no admission test

  You’d see

  Things a system learned in a session become things it knows.

  You’ll fix

  Make promotion criteria machine-checkable predicates and reject promotions that fail them.

• AP-12The proxy replaced the objective

  You’d see

  Performance is defined by a metric, satisfaction, or approval.

  You’ll fix

  Codify the full constraint set as separate checkable predicates per authorized objective, and verify actions against all of them rather than the headline measure.

• AP-14Evidence typed but never weighed

  You’d see

  Requirements specify what kind of evidence is needed, not how strong it must be.

  You’ll fix

  Codify required evidence type and minimum strength per claim class, and reject below-threshold claims rather than accepting them with a note.

• AP-19The rules about the rules are unversioned

  You’d see

  Policies are version-controlled. The definition of what counts as a policy is not.

  You’ll fix

  Version-control meta-predicates separately from the artifacts they classify, require elevated governance for changes to them, and replay current artifact-class membership against the prior predicate after any change.

The failure is in where a line was drawn, or in two things sharing one channel that should not. Moving it is an architectural change.

• AP-03Identity inherited from the channel

  You’d see

  The action is attributed to whoever owns the session, the token, or the email thread.

  You’ll fix

  Bind identity per action, not per session, with an attestation the channel cannot forge.

• AP-07Authority boundaries that live only in prose

  You’d see

  Who may act on what is described in policy documents and org charts.

  You’ll fix

  Maintain the authority graph with explicit jurisdictional edges.

• AP-08Delegation that does not narrow

  You’d see

  Authority is passed along a chain — user to agent, agent to sub-agent, service to service — and each hop re-asserts a claim rather than carrying the original grant.

  You’ll fix

  Make delegation scope-narrowing-only, each hop a strict subset.

• AP-10One channel for data and control

  You’d see

  Retrieved documents, tool results, user content, and system instructions all arrive as text in the same context, distinguished by position and convention rather than by an unforgeable tag.

  You’ll fix

  Tag every context token with source and trust attestation, gate instruction-following on that tag, and sandbox retrieved content away from the instruction channel.

• AP-18No line between proposing and doing

  You’d see

  Proposals, hypotheticals, drafts, and simulations are represented the same way as decisions and actions.

  You’ll fix

  Require modal-state tagging on artifacts crossing the planner/executor boundary and gate tool execution on the declared state.

Every element passes review on its own terms and the arrangement still fails. No local repair reaches these; the composition is the defect.

• AP-13Every step authorized, no path reviewed

  You’d see

  An agent runs a long loop, decomposing an instruction into sub-goals and acting on each.

  You’ll fix

  Mandate periodic global-state checks inside long loops and express founding constraints as trajectory-level predicates, not step-level ones.

• AP-21Nobody owns the composite outcome

  You’d see

  Several components or agents each do their part correctly and a bad outcome emerges from the combination.

  You’ll fix

  Make implicit shared-frame assumptions explicit cross-component contracts and verify them at runtime.

• AP-22Independent checks that are not independent

  You’d see

  A second opinion is required and obtained. The reviewers share training, priors, source material, or model lineage.

  You’ll fix

  Require periodic independent re-interpretation of consequential artifacts by reviewers with no access to prior labels, and treat low variance as a monoculture signal rather than a quality signal.

• AP-20Controls that only tighten

  You’d see

  Every incident adds a control. No process removes one.

  You’ll fix

  Sunset incident-time hardening by default and require a positive decision to make it permanent.