Towards a Trustworthy and Governable Internet of Agentics: An Architectural Perspective on Protocols, Systems, and Services
Organizations: Microsoft Corporation. · Department of Computer Science and Engineering at the University of Bologna.
Abstract
Large language model applications are increasingly being organized as tool-using and multi-agent workflows rather than as isolated chat interfaces. This perspective paper examines the architectural problem that follows from that shift: agents may reason, invoke tools, and delegate work, but dependable deployment still requires interoperability across frameworks, runtimes, data boundaries, and organizational control domains. We study this problem through the lens of the Internet of Agentics (IoA), an emerging service-computing view in which heterogeneous agents are treated as governable service participants rather than only as stand-alone model endpoints. The paper organizes the landscape as a three-layer progression: from today's fragmented agent ecosystem, to interoperable agents, and ultimately to trustworthy and governable autonomy. First, it examines the protocol stack centered on the Agentic AI Foundation, including MCP for agent--tool interaction; A2A for agent--agent coordination; AGENTS.md and Skills-style procedural manifests; and discovery, transport, and trust mechanisms such as AGNTCY and SLIM. Second, it reviews the systems abstractions that make agents deployable as service components, including logical agent architectures, orchestration patterns, gateways, registries, runtime control loops, and hardware-aware inference infrastructure. Third, it situates these developments within services computing, arguing that agentic systems reinterpret classical concerns from SOA and microservices---discovery, composition, governance, pricing, and trust---at the level of cognitive capabilities rather than deterministic functions.
Figures & tables
| Paper | Primary Focus | Protocol Coverage | Systems Coverage | Services Coverage |
|---|---|---|---|---|
| Masterman et al. [ 18 ] | Survey of emerging AI-agent architectures | None | Reasoning, planning, tool calling, and agent communication | Limited |
| Guo et al. [ 2 ] | Survey of LLM-based multi-agent collaboration | Minimal | Collaboration patterns, benchmarks, and challenges | Limited |
| Yan et al. [ 35 ] | Survey of communication-centric LLM-MAS review | Discusses communication protocols conceptually | Communication mechanisms, negotiation, scalability, and security | Limited |
| Mohammadi et al. [ 36 ] | Survey of evaluation and benchmarking of LLM agents | None | Evaluation objectives, benchmarks, metrics, and tooling | Enterprise evaluation concerns |
| ASC survey [ 15 ] | Survey of agentic services computing | Brief MCP/A2A discussion | Focus on software rather than software-hardware synergy | Lifecycle framework and service view |
| This paper | Integrative architectural perspective on IoA across protocols, systems, and services | Detailed MCP, A2A, ACP, Agent Cards, AGENTS.md, and AGNTCY/SLIM | Runtime control, orchestration, gateways, registries, and hardware-aware implementation | SOA mapping, domains, governance, and trustworthy autonomy |
| Dimension | MCP [ 13 , 34 ] | Claude Skills / Agent Skills [ 24 , 39 ] |
|---|---|---|
| Core goal | Capability exposure | Reusable procedural knowledge |
| Mechanism | Protocol interface | SKILL.md packages, Markdown, scripts, and assets |
| Primary value | Reusable tool access | Safer, more consistent method execution |
| Main limit | Weak built-in governance | Weak cross-vendor standardization and validation |
| Protocol Family | Primary Role | Strength | Main Open Issue |
|---|---|---|---|
| MCP [ 13 , 34 ] | Agent–tool and agent–data integration | Reduces bespoke adapters through standardized capability exposure | Fine-grained authorization and trust remain runtime-dependent |
| A2A [ 14 , 22 ] | Agent–agent delegation and coordination | Supports stateful, asynchronous multi-agent workflows | Opaque execution complicates diagnosis, auditing, and liability |
| AGENTS.md / procedural manifests [ 23 , 24 , 39 ] | Local governance and method guidance | Binds agent behavior to project and organizational policy | Lacks a universal cross-vendor operational model |
| AGNTCY / SLIM [ 25 ] | Discovery, routing, identity, secure transport | Provides identity, transport, and policy primitives for inter-organization agent meshes | Specifications and conformance suites are still evolving, with limited independent deployment evidence |
| Dimension | Historical Paradigm | Agentic Equivalent | Key Architectural Shift |
|---|---|---|---|
| Remote Invocation | RPC / gRPC / CORBA | LLM Function Calling | Deterministic coupling semantic intent-based late binding |
| Workflow Orchestration | BPEL / BPMN | Agentic Workflows (ReAct, CoT) | Static finite state machines emergent cognitive loops |
| Interface / Discovery | SOAP / WSDL / UDDI | MCP (JSON-RPC manifests) | Manual WSDL integration LLM-driven autonomous discovery |
| Service Decomposition | REST Microservices | Agentic Microservices | Business logic boundaries cognitive capability boundaries |
| Integration Middleware | Enterprise Service Bus | A2A Protocol | Centralized hub-and-spoke decentralized peer-to-peer |
| Data Representation | XML, JSON (syntactic) | Vector Embeddings (semantic) | Keyword matching geometric similarity in latent space |
| Phase | Purpose | Design |
|---|---|---|
| Design | Define the agentic service contract: task intent, QoS/SLA targets, risk class, approval gates, and value metric. | Translate requirements into systems architecture and services interfaces: MCP tools, A2A boundaries, Agent Cards, AGENTS.md constraints, memory, orchestration, validation, and supervision [ 13 , 14 , 23 ] . |
| Deployment | Instantiate the agentic service for a tenant: permissions, compliance policy, data boundaries, SLA tier, and billing model [ 20 ] . | Bind systems endpoints, schemas, credentials, identity, discovery, and conformance assumptions; configure services routing, retrieval, sandboxing, observability, budgets, and isolation [ 14 , 25 ] . |
| Operation | Run the agentic service under QoS/SLA commitments: bounded delegation, escalation, audit, accountability, and value delivery [ 20 ] . | Coordinate systems state, tool results, artifacts, handoffs, and policy signals across MCP/A2A interfaces; manage services traces, validation, scheduling, latency, cost, and recovery [ 13 , 14 ] . |
| Evolution | Evolve the agentic service contract: update agent capabilities, pricing, compliance evidence, provenance, and trust controls. | Version systems protocols, capability descriptions, Agent Cards, governance files, and Claude Skills; refine services prompts, workflows, caches, evaluation harnesses, and regression tests from incidents [ 24 , 38 , 39 ] . |
| Service | Primary Emphasis | Key Service Implication |
|---|---|---|
| Claude Code [ 56 ] | Composable developer workflow integration | Strong fit for supervised orchestration and iterative validation |
| Goose [ 57 ] | Local-first execution and explicit control | Strong fit for privacy-sensitive deployments with bounded tool access |
| Microsoft 365 Copilot [ 58 , 59 , 60 , 63 ] | Enterprise productivity assistance grounded in Microsoft Graph | Highlights identity-scoped grounding, tenant data boundaries, Purview compliance, auditability, and admin-governed extensibility |
| Claude CoWork [ 61 ] | Enterprise AI coworker for organizational knowledge and shared projects | Highlights collaborative reasoning over governed work context, artifacts, projects, and workspace administration |
| Domain | Agentic Role | Deterministic Service Backbone | Primary Governance Pressure |
|---|---|---|---|
| Enterprise workflows [ 58 , 59 , 60 , 63 ] | Intent translation, knowledge grounding, and exception handling | ERP, Microsoft Graph, document, identity, reporting services | Auditability, policy conformance, and data-governance controls |
| Financial services | Interpretation, triage, analysis synthesis | Execution, accounting, compliance services | Risk controls and regulatory traceability |
| Scientific and engineering workflows [ 14 ] | Evidence gathering and tool chaining | Databases, simulation, build-validation services | Reproducibility and provenance |
| Developer and local automation [ 56 , 57 ] | Repository assistance and local orchestration | File systems, build tools, terminals, OS sandboxes, and schedulers | Containment, privilege protection, and reproducible validation |