<!-- Canonical: https://lucioduran.com/topics/ai-agents
Language: en
Content-SHA256: c7dc65be14e70a5373d52d702e29451fdb9a8fff3388226840475ab08a9aa297
-->

# AI agent architecture

An agent using tools needs an execution system around its model. This selection brings together my public work on permissions, recovery, protocols and observability: components that make it possible to inspect what happened when a task changes state or fails.

By [Lucio Durán](<https://lucioduran.com/>) · Uruguay

## Which decision are you making?

### Before enabling a write

Define which identity authorizes the action, which resource it may change and which budget it consumes. Agent Tool Capabilities implements permissions and revocation; Agent Policy State Machine explores authorization transitions.

### When a response is lost

Preserve the operation’s identity and check its effects before retrying. Agent Replay Runtime supports studying recovery after real process crashes and cases that must stop.

### When integrating tools

Separate the protocol contract from application permissions. MCP Contract Harness checks message exchange; the sandbox and tracing projects examine isolation and execution evidence.

## Projects and evidence

Each project page provides code, environment details, published results and limitations. The experiments describe those configurations; they do not establish results in client systems.

- ### [Agent Replay Runtime](<https://lucioduran.com/projects/agent-replay-runtime>)

  Durable tool execution with event replay, idempotency keys and recovery after real process crashes. Includes effect traces and cases that stop instead of retrying automatically.

  Python · License: MIT

  [Read the project](<https://lucioduran.com/projects/agent-replay-runtime>) · [Repository](<https://github.com/lucioduran/agent-replay-runtime>)
- ### [Agent Tool Capabilities](<https://lucioduran.com/projects/agent-tool-capabilities>)

  Tool authorization by argument, resource, expiry and atomic call and byte budgets, with verifiable denial and revocation records.

  Python · License: MIT

  [Read the project](<https://lucioduran.com/projects/agent-tool-capabilities>) · [Repository](<https://github.com/lucioduran/agent-tool-capabilities>) · [Release v1.0.0](<https://github.com/lucioduran/agent-tool-capabilities/releases/tag/v1.0.0>)
- ### [Agent Policy State Machine](<https://lucioduran.com/projects/agent-policy-state-machine>)

  An executable authorization state machine with finite TLA+ safety checks, compensation and replay of the actual TLC transition graph.

  Python · License: MIT

  [Read the project](<https://lucioduran.com/projects/agent-policy-state-machine>) · [Repository](<https://github.com/lucioduran/agent-policy-state-machine>) · [Release v0.1.0](<https://github.com/lucioduran/agent-policy-state-machine/releases/tag/v0.1.0>)
- ### [Agent Sandbox Boundaries](<https://lucioduran.com/projects/agent-sandbox-boundaries>)

  An ephemeral Wasmtime runner that makes CPU, wall-time, guest-memory, filesystem and network capability limits observable.

  Python · License: MIT

  [Read the project](<https://lucioduran.com/projects/agent-sandbox-boundaries>) · [Repository](<https://github.com/lucioduran/agent-sandbox-boundaries>) · [Release v0.1.0](<https://github.com/lucioduran/agent-sandbox-boundaries/releases/tag/v0.1.0>)
- ### [MCP Contract Harness](<https://lucioduran.com/projects/mcp-contract-harness>)

  Read-only MCP server and independent clients for checking stdio negotiation, pagination, errors and cancellation, with actual wire messages and reproducible reports.

  Python / JavaScript · License: MIT

  [Read the project](<https://lucioduran.com/projects/mcp-contract-harness>) · [Repository](<https://github.com/lucioduran/mcp-contract-harness>)
- ### [Agent Trace Observability](<https://lucioduran.com/projects/agent-trace-observability>)

  OpenTelemetry instrumentation for an owned local agent pipeline with bounded, allowlisted exports and tested exclusion of sensitive payloads.

  Python · License: MIT

  [Read the project](<https://lucioduran.com/projects/agent-trace-observability>) · [Repository](<https://github.com/lucioduran/agent-trace-observability>) · [Release v0.1.0](<https://github.com/lucioduran/agent-trace-observability/releases/tag/v0.1.0>)

## Architecture and methodology reading

- ### [Agents that write to production: authorization, idempotency, and reconciliation](<https://lucioduran.com/blog/agent-tool-execution-authorization-idempotency-reconciliation>)

  An execution design for tools with real effects: identity outside the prompt, immutable actions, concurrency control, and recovery when a timeout leaves the result uncertain.
- ### [Recursive agents: external context, budgets, and evidence that survives delegation](<https://lucioduran.com/blog/recursive-agent-harnesses-context-budgets-provenance>)

  From Recursive Language Models to Recursive Agent Harnesses: designing delegation over large corpora with evidence contracts, global limits, and an evaluation that justifies the complexity.