Agent Patterns

Agent patterns

Eight shapes. Most of what you are asked to build is one of them.

---

Nobody builds fifty agents

They build the same three agents seventeen times, with different data, under different names, by different teams who never met.

The tell is a maintenance number. When a platform team is patching the same citation bug in nine codebases, those nine were never nine things.

A pattern is not a template you copy. It is the answer to what shape is this, asked before anyone opens an editor, so that the risk tier, the guardrails and the review path come attached rather than being invented per build.

The eight

A · Retrieval. The librarian.

Answers a question using a body of knowledge it does not own.

Query, retrieve, generate, cite. The citation is not decoration. An answer without a source is an assertion, and an assertion is what this pattern exists to avoid.

Where the risk sits: usually read-only, so low. The exposure is confident wrongness rather than damage.

The pitfall: no fallback. A retrieval agent that cannot say I do not have information on that will invent something instead.

B · Transactional. The clerk.

Executes one defined action against one system.

Receive, validate, execute, confirm. The whole pattern lives or dies on the validation step, because the model decides whether to act and the wrapper decides what acting means.

Where the risk sits: it writes. Tier depends entirely on what it writes to.

The pitfall: open-ended tool access. Scope this to specific named actions or it stops being this pattern.

C · Orchestrator. The manager.

Breaks a goal into sub-tasks and routes each to something that can do it.

Analyse, decompose, delegate, synthesise. The interesting failure is not any one sub-task. It is state: knowing which of the six steps completed when step four fails.

Where the risk sits: it inherits the highest tier of anything it can call. An orchestrator with one wire-transfer tool in reach is a wire-transfer agent.

The pitfall: treating decomposition as the hard part. Recovery is the hard part.

D · Supervisor. The auditor.

Evaluates another agent's output against policy before it goes anywhere.

Produce, evaluate, approve or reject or escalate. This is the judge, and it is the pattern most often skipped because it appears to add latency rather than value.

Where the risk sits: high, and in an unusual way. A supervisor that is wrong is worse than no supervisor, because it converts an unchecked output into a checked one.

The pitfall: the supervisor cannot be weaker than the worker. A cheap judge over an expensive worker is theatre, and it is the most common way this pattern is deployed.

E · Workflow. The follower.

Runs a multi-step process with branches and state.

Trigger, step, branch, step, complete. This is where human approval gates actually live, because a gate is a step and a step needs somewhere to wait.

Where the risk sits: it varies by step, which is the point. One workflow can hold a read-only lookup and an irreversible payment.

The pitfall: tiering the workflow instead of the steps.

F · Analyst. The data scientist.

Turns a question into a query, runs it, and explains the answer.

Question, generate query, execute, present, explain. The explanation is the deliverable. A number without a reading is a number somebody will misread.

Where the risk sits: read-only, but pointed at the data most likely to contain things people should not see.

The pitfall: full query access. Whitelist the operations. An analyst agent should not be able to drop anything.

G · Generator. The creative.

Drafts something a human will then own.

Brief, generate, refine, deliver. Everything this pattern produces is a draft, including the things that look finished.

Where the risk sits: almost entirely in the audience. Internal drafts are low. Anything that reaches a customer is not.

The pitfall: a review gate that exists in the process document and not in the interface.

H · Guardian. The bouncer.

Scans what goes in and what comes out, and blocks what should not pass.

Input, scan, allow or block or redact, log. This one is different from the other seven: it is not a thing you build to do work. It is the thing the other seven run behind.

Where the risk sits: it has no tier, because it is the tier mechanism.

The pitfall: deploying it once, centrally, as a policy. It is a sidecar. Every agent gets one or the ones without one are the ones that matter.

How to pick

Three questions, in order, and the first answer that fits wins.

1 · Does it act on the world, or only describe it? Describe only, and you are in A, F or G. Acts, and you are in B, C or E.

2 · Is it one action, or several with state between them? One is B. Several is E. Several, decided at runtime rather than in advance, is C.

3 · Is its job to check something else? Then it is D, and D is the pattern people discover they needed after an incident.

H is not on that list because H is not a choice. Every deployed agent has a Guardian in front of it or it is unguarded, and unguarded is a decision somebody should have made on purpose.

What a pattern buys you

The pattern is the second field on the Agent Card, and it is doing work.

Pattern	Default tier	The guardrail it needs first
A · Retrieval	1	A fallback that admits ignorance
B · Transactional	2 to 3	Input validation in the wrapper, not the prompt
C · Orchestrator	inherited	A state store that survives a failed step
D · Supervisor	3	A model at least as strong as the one it judges
E · Workflow	per step	Approval gates as first-class steps
F · Analyst	1 to 2	Whitelisted operations, read replica only
G · Generator	2 to 3	Review before anything external
H · Guardian	not applicable	Deployment as a sidecar, per agent

Naming the pattern at intake means the tier, the guardrail and the review path arrive together.

Naming it after the build means arguing about all three while someone waits to ship.

Three things this is not

Not the same as an Application Mode. The mode says what kind of work the AI is doing: task automation, decision augmentation, artifact generation, agent orchestration. The pattern says what shape the system is. A DECIDING mode agent can be pattern A or pattern F, and the governance differs.

Not the same as the RAG patterns. The repository's advanced patterns doc names nine retrieval techniques, several of which are also called patterns. Those live inside pattern A. Different altitude, different taxonomy, same word.

Not a capability list. Classification, reasoning and research are things an agent does. They are not shapes an agent is. If the card wants to record them, they want their own field.

_{From the practice canon. Developed through client delivery and refined in collaboration; the frameworks stated here are the author's own.}