Essay · June 17, 2026
From Prototype to Production
A leader's blueprint for the agentic enterprise — with an update from where my thinking is now.
I wrote a five-part series in December 2025 on what it would take to move agentic systems from demo to durable production. I want to bring that series together as a single piece, and I want to do something else with it that the original posts did not: I want to revise it in public, where my own thinking has moved.
The throughline of the original series, and the throughline I am keeping here, is borrowed from legitimacy theory. An agent only earns its place inside an enterprise when it is seen as legitimate — technically (regulative), pragmatically (it works), cognitively (it makes sense to the people using it), and morally (it acts in ways the organization can defend). Each of the five sections below maps to one of those forms of legitimacy. The order is the order I would still build in.
The update comes at the end. I will say up front what it amounts to: the adoption equation for agentic AI is not the same as the one for generative AI, and I think most of us — including me, in December — were carrying assumptions over that did not survive the crossing.
Part 1. Defining the agent
We cannot manage what we cannot define. Before we get to strategy, we need a usable taxonomy for what an agent actually is. The version I keep returning to has three components.
Perception. An agent receives information from its environment — user commands, processed sensor inputs, contextual signals from connected systems. This is the part that sounds simple and is not, because the quality of perception bounds everything downstream.
Reasoning. The agent's LLM core processes what it perceives and decides what to do about it. Chain-of-thought prompting and the surrounding techniques are the part that has improved most visibly over the last eighteen months. The reasoning step is also where most of the safety-relevant judgment lives, which matters for everything that follows.
Action. This is what separates an agent from a chatbot. A true agent executes — sends a command to a vehicle's controller, performs a task inside an enterprise application, modifies a record of consequence. The action layer is the part most demos understate and most production deployments discover the hard way.
This three-part definition is also the foundation for what I would call regulative legitimacy: the system adheres to logical rules and predefined safety standards, in a way the organization can articulate to itself and to its regulators. The question I would ask any leader is whether their AI strategy is defined by impressive LLM output or by agentic action that drives measurable business value. Those are different bets.
Part 2. Solving the integration bottleneck
A real agent does not just reason. It acts. And integration is the silent killer of AI return on investment.
You can have the most capable reasoning engine in the industry, but if it cannot securely connect to your CRM, your ERP, your internal APIs — it is an expensive chatbot. It lacks what legitimacy theory calls pragmatic legitimacy: the ability to deliver tangible, useful value to the people whose work it is supposed to change.
The old way of solving this was building brittle point-to-point integrations for every tool. The N-to-M problem — every model connecting to every tool through custom code — is unscalable and produces the kind of technical debt that swallows AI programs whole.
The standardized integration layer the industry has coalesced around is the Model Context Protocol. Think of MCP as the USB-C for AI applications: an open standard for how AI models connect to data and tools. It lets an agent discover available tools dynamically without custom code for each one; it provides a universal way to feed business context to the model; and most importantly, it decouples reasoning from execution — the brain (the LLM) from the hands (the tools). When you want to upgrade your model, you do not rebuild your integration stack.
The takeaway from December still stands: if your AI strategy does not include a standardized integration protocol, you are not building an agentic workforce. You are building a fleet of isolated silos.
Part 3. Personalization at scale
Now that the agent can act, the question becomes whether anyone wants to use it.
A generic, one-size-fits-all assistant is doomed in the enterprise. Users do not want to repeat themselves across every session, and they do not want to deal with an agent that has amnesia between conversations. To drive advocacy across a workforce, an agent needs cognitive legitimacy — it has to make sense to the user and feel like a natural extension of how they already work.
The mechanism is context engineering: the deliberate design of the information environment the agent sees. This is more than prompting. It is a multi-layered memory architecture.
Short-term working memory. The agent holds context within a single conversation. Context summarization compresses prior messages into concise summaries that let long interactions stay coherent without blowing up token costs or latency.
Long-term episodic memory. A persistent record of past interactions, preferences, user-specific facts. This is where personalization actually lives, and it is what moves an agent from reactive tool to proactive partner.
Strategic context placement. Research on the "needle in a haystack" problem shows that where you place information in the prompt matters. Critical instructions have to be positioned deliberately, or the model will quietly ignore them due to recency decay.
Engineer context well and you move past single-turn transactions into continuous, personalized relationships with users. That is how initial skepticism turns into advocacy. Without it, your agent is a stranger your employees have to re-introduce themselves to every day.
Part 4. Establishing trust
Now you have an agent that can reason, act, and remember. Here is the question that keeps General Counsel and CISOs up at night: how do you know it will not do something stupid, illegal, or catastrophic?
In the world of autonomous agents, trust is not a soft skill. It is an engineering constraint. Without moral legitimacy — the system acts in ways the organization can defend — and without continued cognitive legitimacy — its actions make sense to the people watching it — the agent will never leave the sandbox.
Defining agent quality goes beyond accuracy. A serious enterprise agent has to be evaluated across multiple dimensions.
Safety and adversarial testing. You cannot discover vulnerabilities by chatting with the system. You need agentic red teaming — adversarial testing designed to manipulate the agent into betraying its purpose, revealing personal data, or executing unauthorized commands. This is stress-testing for autonomous systems, and most enterprises are under-investing in it.
Transparency and explainability. Trust hinges on the why. When an agent denies a loan, reroutes a supply chain, or flags a transaction, it has to be able to provide a clear and auditable explanation. This is essential for regulatory compliance and for the human-in-the-loop collaboration the next section depends on.
Reliability and guardrails. An agent needs strict operational boundaries — the technical metrics like latency and error rates, and also business-logic guardrails. Does it follow enterprise policy? Does it require human review for high-stakes decisions? What does it do when it is uncertain?
The takeaway: trust is engineered, not assumed. A robust quality framework is the only way to move from hoping your AI is safe to proving it.
Part 5. The operational playbook
You have built an agent that can reason, act, remember, and be trusted. Now comes the hard part: running it at scale without it falling over or bankrupting you.
Moving from a controlled prototype to a production environment requires a different discipline than traditional MLOps. We need LLMOps for agents — a practice built for non-deterministic, autonomous systems.
Observability, not just monitoring. Traditional dashboards tell you if the system is down. Agent observability tells you why it made a bad decision. You need to trace the full chain — input, prompt, reasoning, tool call, output — and track new metrics: token usage, latency per step, tool error rates, frequency of human handoff.
A deliberate human-in-the-loop strategy. Autonomy is not binary. You do not flip a switch. A robust operating model designs human-in-the-loop workflows deliberately — the agent handles routine work, escalates low-confidence or high-risk decisions to a human expert. This is not a failure of the AI. It is a design feature for safety and reliability.
Cost and performance discipline. Agents are expensive. Every reasoning step and tool call consumes tokens. Production deployments need prompt optimization, response caching, right-sized model selection — a smaller, faster model for simple routing, the larger one for the steps that justify it.
A successful prototype proves technical feasibility. A successful operational playbook proves business viability. Without it, your agent is an experiment that never delivers sustained competitive advantage.
What I would update from December
That is the blueprint I would still build to. The five parts still hold, and I would still order them the way they are ordered above. But I want to be honest about two things that have changed since December, because one of them is technical and the other is conceptual, and the conceptual one matters more.
MCP went from "promising standard" to default infrastructure
When I called MCP the "USB-C for AI" in December, it was a bet on where the industry was heading. That bet resolved fast. On December 9, 2025, Anthropic donated MCP to the newly formed Agentic AI Foundation under the Linux Foundation, with OpenAI and Block as co-founders and AWS, Google, Microsoft, Cloudflare, and Bloomberg joining as supporting members. The significance is not the governance trivia. The significance is that fiercely competing AI vendors agreed to collaborate on the infrastructure layer while competing on the model layer. That is the same pattern that made Linux, Kubernetes, and OpenTelemetry win.
The adoption numbers back it up. The Python and TypeScript SDKs reached roughly 97 million monthly downloads by March 2026, up from about 100,000 in the first month after launch — roughly 970-fold growth in 18 months. That is a velocity comparable to the foundational developer protocols, except faster.
Two practical implications for anyone building today.
The spec is being rebuilt for production scale. The original protocol's stateful sessions fought with load balancers in exactly the way you would expect them to. The MCP 2026-07-28 release candidate — locked May 21, 2026, with the final spec scheduled for July 28, 2026 — is the largest revision since launch. A stateless core that runs on ordinary HTTP infrastructure. An Extensions framework. A Tasks extension for long-running work. MCP Apps for server-rendered interactive UIs. Authorization that aligns more cleanly with OAuth and OpenID Connect. If you are running MCP in production today and you have not started planning for that migration, July arrives faster than it looks.
Security has become a first-class concern. With universal adoption came universal problems. The MCP ecosystem has seen real vulnerabilities surface — tool poisoning, prompt injection through tool metadata, schema drift — and the NSA published a security advisory on MCP earlier this year. The registry, approval, and audit layer I would have treated as optional eighteen months ago is now table stakes before granting any agent write access. The point is not that MCP is unsafe; it is that, like every other piece of critical infrastructure before it, the security posture has to scale alongside the adoption.
The agentic adoption equation is different from the GenAI one
This is the more important update, and this is where my thinking has actually moved.
When I wrote the December series, I was carrying adoption-and-advocacy logic over from generative AI. I now think that was a mistake. Agentic AI changes the trust calculus in kind, not just in degree.
The cleanest way I can frame the shift: GenAI carried the risk of saying; agentic AI carries the risk of doing. A hallucinating GenAI assistant produces a wrong sentence — annoying, sometimes costly, but contained. An agent with tools and autonomy produces a wrong action. A sent email. A moved dollar. A changed record. A rerouted supply chain. The blast radius of an error is categorically larger than it was for the systems we were studying eighteen months ago, and that reshapes what drives adoption.
A few consequences follow, each of which I am committing to as a working position rather than as a finished argument.
Reliability displaces capability as the adoption driver. In the GenAI era, advocacy tracked how impressive the output felt. In the agentic era, employees integrate AI deeply into their workflows when they trust the system's reliability — not its eloquence. Trust has become the rate-limiter on value capture. The organizations realizing superior returns from agentic AI are consistently the ones with the highest maturity in responsible-AI practice. That is the empirical pattern I would not have predicted in December.
The autonomy paradox sharpens. My dissertation found that requiring constant human oversight is negatively associated with advocacy intention. That finding takes on a different meaning here. Users do not advocate for an agent they have to babysit. But the cost of removing oversight is much higher than it was for GenAI, because the failure mode is action rather than text. The design problem of the agentic era is calibrating autonomy: enough to be worth advocating for, bounded enough to be safe. Human-in-the-loop is not a training-wheels phase you eventually outgrow. It is a permanent architectural dial, and the question is where to set it for which class of decision.
The risk profile, not the productivity case, is what is stalling scale. The productivity argument for agentic AI is largely settled now. Early adopters consistently report higher returns than broad GenAI deployments delivered. What is slowing enterprise scale is the governance gap. The surveys keep producing the same anxieties: a large share of executives lack a formal plan for supervising agents, a meaningful fraction admit they could not immediately pull the plug on a rogue one, and security and risk concerns rank as the top barrier to scaling. The detail in those surveys that I find most telling is the share of employees who admit to actively undermining their company's AI strategy. Advocacy can go negative, and internal trust is something you earn, not something you assume.
The upshot is that every section of the blueprint above still holds, but the weighting has changed. In a GenAI world, Parts 1 through 3 — define it, connect it, personalize it — did most of the work of driving adoption. In the agentic world, Parts 4 and 5 — trust and operations — are where adoption is won or lost. The integration is solved. The personalization is solved. What is left is the hard, unglamorous discipline of proving that an autonomous system is safe enough to let act on your behalf.
The bottom line
A true agent is defined by perception, reasoning, and action. Connecting it through a standardized protocol gives it pragmatic value. Engineering its memory makes it legitimate to users. Rigorous evaluation makes it legitimate to risk owners. An operational playbook makes it viable for the business. That five-part architecture is the same one I would build to today.
What has changed is the bar. In the agentic era, the winners will not be the ones with the most capable agents. They will be the ones who can prove their agents are trustworthy, and who have built the operational discipline to keep them that way at scale.
This is a working draft. The argument is offered in good faith and is genuinely held but provisionally so — I expect to revise it as the data come in, and I would value being pushed on any part of it.
On the Seam: Working Drafts is a personal publication. The views expressed are my own and do not represent the views of my employer or any organization I am affiliated with. No client, customer, or proprietary information appears in this writing.