A Reference Architecture for Integrating Agentic AI into Enterprise Software: Responsibilities, Interactions, and Variability
Organizations: UNSW Sydney, Sydney, Australia · School of Computer Science and Engineering, UNSW Sydney, Australia · CSIRO, Sydney, Australia · CSIRO’s Data61, Sydney, Australia
Abstract
Agentic AI moves generative AI applications toward systems that coordinate reasoning, enterprise context, model inference, and external actions. Integrating these capabilities into enterprise software introduces diverse architectural concerns, from orchestration, knowledge and memory, and model access to tools and actions, security, runtime infrastructure, and evaluation. Existing research and industry architectures address many of these concerns but differ in scope, abstraction, responsibility organization, interaction representation, and assumptions about which capabilities are required. This paper presents a technology-neutral reference architecture for enterprise agentic AI integration. We synthesize architectural capabilities from research publications, industry architecture guidance, and interoperability specifications by architectural purpose, organize them into ten responsibilities, and define boundary invariants, typed cross-responsibility interactions, and variation points that distinguish responsibilities from condition-dependent capabilities and replaceable realization mechanisms. We instantiate the architecture as an ESG portfolio-analysis and pre-trade compliance agent over an existing service-oriented ESG metric computation and reporting system, and complement the case with a mapping of an independently published agentic architecture. The case realizes seven of the ten responsibilities; different questions take different interaction paths, controls activate only under their conditions, and the probed boundary invariants hold. The independent architecture maps onto the proposed responsibilities without requiring an additional one. These results provide initial evidence for the architecture's organization and applicability rather than its completeness. The deployment and recorded results are available as a replication package.
Figures & tables
| Type | Interaction | Responsibilities | Architectural semantics |
|---|---|---|---|
| T1 | Client Request / Response | L1 L2 L3 | Carries client intent through the controlled boundary at L2 to L3 and returns responses, status, or artifacts through L2 egress control, separating interaction concerns from execution coordination. |
| T2 | Identity & Authority Context | L2 L3/L5/L6 | Propagates principal, tenant, entitlement, delegated-authority, policy, and trace context; receiving responsibilities retain resource-specific enforcement. |
| T3 | Inference Request / Result | L3 L4 | Requests model capabilities under specified constraints and returns model output, validation status, model metadata, and usage information. |
| T4 | Context Query / Grounded Context | L3 L5 | Expresses an information need and returns governed context, evidence, metadata, and provenance appropriate to the execution. |
| T5 | Action Intent / Observation | L3 L6 | Requests execution of an external capability and returns its result, status, error, state-change evidence, or provenance. |
| T6 | Async Task / Observation Event | L3/L6 L7 | Mediates tasks and observations through asynchronous or event-driven delivery while preserving ownership in the originating and receiving responsibilities. |
| Condition | Architectural consequence | Representative realization |
|---|---|---|
| Multiple collaborating agents | Enable L3 agent collaboration, discovery, and coordination interactions | Agent registry; A2A or direct calls |
| Deterministic execution constraints | Constrain allowable execution transitions in L3 | State machine, DAG, or workflow rules |
| Human participation required | Enable L3 human interaction and intervention | Clarification, review, pause/resume |
| Protected or consequential external effect | Enable an L6 action-policy or approval gate | Policy service or human approval |
| Untrusted or high-risk execution | Isolate execution of the relevant L6 capability | Sandbox or restricted runtime |
| Delegated or deferred execution | Scope and expire propagated authority (T2); L6 re-authorizes at execution time | Scoped, short-lived tokens; re-authorization |
| Resp. | Case component |
|---|---|
| L1 | Web service and portfolio analyst page |
| L2 | Access gate: signed session, role-based entitlements (portfolio manager, compliance officer), request validation, rate limit, egress check |
| L3 | Agent runtime: model-driven tool-use loop with execution constraints and number check |
| L4 | Model access: hosted language model, inference-contract validation |
| L5 | ESG knowledge graph* (competency questions), via MCP |
| L6 | Metric-computation service*, via MCP |
| Question | Occ. | L6 calls | Outcome | |
|---|---|---|---|---|
| G1 | Intensity and drivers (4 holdings, all with data) | 27 | 5 | Answered |
| G2 | Change since 2022 | 39–41 | 10 | Answered |
| G3 | As G1, one holding lacking revenue (worked example) | 27 | 5 | Answered; gap reported |
| G4 | Intensity and drivers (7 holdings) | 35 | 8 | Answered |
| G5 | Trade within the mandate; submit | 31–33 | 6–7 | Cleared |
| G6 | Trade breaching the mandate; override | 33 | 7 | Held for override |
| Invariant | Probe | Observed outcome | Result |
|---|---|---|---|
| I1 Coordination–Execution | Submit question G1; count invocations of the L6 computation and portfolio services; compare the reported intensities with L6 results; inspect L3 for an execution mechanism. | One computation per holding and one portfolio calculation, each invoked through L6; reported intensities equal the L6 results; L3 exposes no execution mechanism. | Preserved |
| I2 Execution-State–Knowledge | Inspect the state L3 retains after the request; submit a second request and count knowledge-graph retrievals. | L3 retained only execution-local state (question, plan, computations, results, status); definitions and provenance came from L5 through CQ1–CQ5, and the second request retrieved them again. | Preserved |
| I3 System-Access–Resource-Authority | Admit a principal at L2 without the computation entitlement and invoke L6; submit a request with a forged session token; submit a trade breaching the mandate and approve an override as the portfolio manager, as the submitter holding the override entitlement, and as the compliance officer. | The admitted principal was refused at L6; the forged request was refused at L2 before coordination; the breaching trade was held, the override was refused for the portfolio manager and for the submitter, and approved for the compliance officer. | Preserved |
| I4 Evidence-Ownership–Correlation | Inspect the recorded occurrences for their emitting responsibility and correlation identifier. | Occurrences were emitted by four responsibilities, and the identifier established at L2 was carried into the L5 requests. | Consistent |
| Source element | Source-described purpose | Resp. | Observation |
|---|---|---|---|
| Context engineering | Dialogue interface; goal creators interpreting the user’s goals | L1/L3 | Spanning: interaction L1, goal interpretation L3 |
| Prompt/response engineering | Prompt and response generation from templates and personas | L3 | Prompt and runtime configuration |
| Memory | Short-term (in context window) and long-term memory | L3/L5 | Spanning: consistent with I2 |
| Planning | Plan generation and reflection, including human reflection | L3 | Coordination |
| Cooperation | Voting-, role-, and debate-based cooperation among agents | L3 | Conditional; the case uses one agent |
| Execution engine | Task executor using tools or agents; task monitor | L3/L6 | Spanning: consistent with I1 |