Memory, harnesses, evals, and the two protocols that connect everything.
The vocabulary of agentic AI settled fast. A year ago most of these nine ideas were blog posts and experiments. Today they are specifications, benchmarks, and line items in enterprise architecture reviews. This piece takes each one, says what it actually does, and points at the primary source that established it. Where the evidence is thin or contested, it says so.
Every claim about a concept is linked to its source and dated. The notes marked In the appliance describe what the lowtouch.ai appliance packages, and are our own product positioning rather than independent findings.
Memory and state
Agents remember.
Context is finite, and it degrades before it runs out. Anthropic's context engineering guidance, published in September 2025, describes context rot: as tokens accumulate, recall of anything inside the window gets worse, so context has to be treated as a budget rather than a bucket. Three techniques address it. Compaction summarises a conversation and restarts the window from the summary. In Claude Code it keeps architectural decisions, unresolved bugs, and the five most recently accessed files while discarding raw tool output. Structured note-taking writes state to files outside the window, so it survives a reset. Sub-agents keep the detailed work in their own windows entirely.
The failure mode is quieter than running out of room. Compaction makes irreversible choices about what to keep, and Anthropic notes in its managed agents post that it is hard to know which tokens later turns will need. A recent preprint, Slipstream, reports that production systems trigger compaction well before the window is full to stay ahead of context rot. Once a bad summary is written, everything compacted from it inherits the error.
In the appliance: Session state and durable memory are configured per agent, inside your perimeter. No memory layer to build or host.
Orchestration
Controls who does what.
Orchestration is the routing layer: which model, which tool, which sub-agent, in what order, and who signs off. The pattern that has held up is a lead agent holding a high-level plan while sub-agents do the deep work on clean context windows and return only a condensed result, often one to two thousand tokens against tens of thousands consumed. Anthropic reports this beat single-agent systems substantially on complex research tasks, in its multi-agent research write-up.
Long-running work needed protocol support, and it arrived. The November 2025 MCP release added tasks, an abstraction with explicit states of working, input required, completed, failed, and cancelled, so a client can poll a job that runs for minutes or hours and fetch the result later. The same release allowed sampling with tools, which lets a server run its own agent loop rather than pushing that complexity onto every client.
In the appliance: Routing, delegation, and human sign-off gates are configuration. Critical actions stop for approval by default.
Retrieval augmented generation
Fetch, inject, generate.
RAG grounds a model in your data by retrieving passages and putting them in the prompt. The 2025 shift was to let the agent decide the retrieval, not a fixed pipeline. The agentic RAG survey, published in January 2025, frames it as embedding reflection, planning, and tool use into the retrieval loop. A follow-up survey splits the field into predefined reasoning, where methods such as ReAct and Self-Ask interleave retrieval with generation on a fixed schedule, and agentic reasoning, where the model decides when, what, and how to retrieve.
Enterprise practice diverges from the research on one point. A 2024 RAG survey, revised through 2026, observes that industrial deployments increasingly emphasise governed retrieval through permissioned connectors rather than open web browsing, because the value is consulting proprietary knowledge with provenance and updating it without retraining. Iterative retrieval also costs more. Whether it is worth it is still an open question in the literature.
In the appliance: Point an agent at policies, runbooks, and record systems. Indexing, retrieval, and access control run inside your environment. Nothing is sent out for embedding.
The harness
What makes a model actually do things.
Anthropic's working definition of an agent is short: a model autonomously using tools in a loop. The harness is everything around that loop. It injects context, holds the tool contracts, decides what to persist to disk or git, and runs compaction when the window fills. Most of what people call agent quality is harness quality. One recurring failure is the tool surface: Anthropic names bloated tool sets as a common problem, on the grounds that if a human engineer cannot say which tool applies in a given situation, the model will not do better.
For work that outlives a single context window, Anthropic's harness post describes a shift-work pattern: an initializer agent sets up the environment once, then each session makes incremental progress and leaves artifacts for the next one. The caution in the same body of work is worth repeating. A harness encodes assumptions about what the model cannot do alone, and those assumptions go stale as models improve, so scaffolding built for last year's model can be actively holding this year's back.
In the appliance: The harness is the product. Context assembly, tool contracts, loop control, and compaction ship configured and get updated as models change.
Evals
Score the outputs, and the path to them.
Scoring the final answer is not enough for a multi-step agent. Current practice, summarised in a June 2026 review of agent evaluation, separates outcome metrics from trajectory metrics, which check tool choice, argument correctness, and recovery, and from system metrics such as tokens, latency, and cost. The serious benchmarks verify by execution rather than by text: tau-bench inspects the resulting database state, SWE-bench runs the test suite. Reliability is reported two ways, and the difference matters: pass@k asks whether one of k attempts succeeded, pass^k whether all of them did.
The judge is the weak link. Surveys of the LLM-as-judge literature identify position, verbosity, and self-enhancement bias, and note that judges can be fooled by surface-level text changes. One 2026 benchmark paper reviews that evidence and validates its own ensemble judge against human labels rather than trusting it outright. Treat the sharper numbers with care. A widely cited figure, that 48 of 58 traces with perfect outcome rewards still contained a procedural violation, comes from a secondary account of the AgentPex work from April 2026, and we have not verified it against the primary paper. The direction it points is well supported even if that ratio is not.
In the appliance: Every action is logged with the reasoning that led to it, so trajectories are reviewable. Outcome-based contracts force the metric to be agreed before deployment.
Model Context Protocol
Standard plug for tools and data.
MCP standardises the connection between an agent and a tool or data source, so an integration is written once and works in any client. It went from an Anthropic open source release in November 2024 to the default answer to that problem in a year. By its first anniversary the registry held close to two thousand server entries, up 407 percent from the September 2025 launch batch, maintained by 58 maintainers and a contributor community of more than 2,900. The project is now hosted under the Linux Foundation.
The November 2025 specification is mostly enterprise plumbing, which is a good sign for a protocol. Dynamic client registration, long the biggest authorization complaint, gained an alternative in URL-based client identity metadata documents. URL mode elicitation sends a user into a proper browser OAuth flow so API keys never pass through the client. Authorization extensions cover machine-to-machine credentials and enterprise identity provider policy, including single sign-on across authorized servers.
In the appliance: Connectors to existing applications, APIs, and databases are exposed over MCP, with credentials held in your environment and per-agent scoping.
Skills
Reusable agent capabilities, written in prose.
A skill is a folder with a markdown file. Two frontmatter fields are required, a name and a description, and the body is plain instructions, optionally alongside scripts and reference files. Loading happens in three tiers, which is the whole trick: name and description at startup, roughly a hundred tokens each, the full body only when a task matches, and deeper files only when the task demands them. The specification calls this progressive disclosure, and it is why an agent can carry dozens of capabilities without paying for them.
Anthropic released the format as an open standard on 18 December 2025 and adoption was immediate across OpenAI's Codex CLI, Gemini CLI, GitHub Copilot, and Cursor, as traced in a March 2026 analysis and in an academic survey of the paradigm. The consequence that matters commercially is who can write one. If MCP is the wiring, a skill is the procedure, and a procedure in plain English can be authored and reviewed by the person who owns the process. The survey also flags the security question that follows: an instruction file that an agent will execute is an attack surface, and skills need the same review discipline as code.
In the appliance: This is the no-code surface. A process owner describes the procedure, the appliance versions it, scopes its tools, and keeps it reviewable.
Agent2Agent
Agents talk to agents.
A2A does for agent-to-agent delegation what MCP does for tools. An agent publishes an Agent Card, a metadata document describing its capabilities, skills, and endpoints, and other agents use it to discover and delegate work over ordinary web transports, with JSON-RPC over HTTPS as the primary binding and gRPC and REST alongside it. Google released it in April 2025 and handed it to the Linux Foundation that June. Agents coordinate without sharing internal memory, which is the property that makes cross-vendor work possible at all.
At the one-year mark, on 9 April 2026, the Linux Foundation reported more than 150 supporting organisations, up from over 50 at launch, 22,000 GitHub stars, SDKs in five languages, and version 1.0 with signed Agent Cards for cryptographic identity and multi-tenancy. Microsoft shipped it in Azure AI Foundry and Copilot Studio, AWS through Bedrock AgentCore Runtime. Named production verticals are supply chain, financial services, insurance, and IT operations. MCP and A2A are explicitly complementary: one connects an agent to tools, the other to peers.
In the appliance: Agents can be published for other systems to call, and can call agents your partners or vendors run, without either side exposing its internals.
Multi-agent systems
Specialists collaborating.
Put the previous eight together and you get a system rather than an assistant: narrow agents with their own tools, memory, and skills, coordinated over a protocol. The Linux Foundation's framing of why this arrived now is worth borrowing. As software systems act more independently, coordination becomes the bottleneck, and a common discovery and messaging model removes it. Anthropic's evidence points the same way for research-shaped work, where parallel exploration by sub-agents outperformed a single agent holding all the state.
The honest caveat is governance. A 2026 analysis of interoperability protocols argues that MCP, A2A, and ACP cannot express governance constraints: A2A answers which agent can handle a task, and none of its four official extensions addresses policy, delegation limits, or accountability. The protocols carry identity and authorization, not permission to act on your behalf under your rules. That gap is currently filled by the platform, or by nobody. For a regulated process, it is the part to specify first.
In the appliance: Governance sits above the protocols: role-based access, human sign-off on critical actions, and a full thought log per agent and per run.
Nine concepts, one appliance
Read the nine together and the build cost is obvious. A team that wants an agent in production needs a memory design, a retrieval layer, a harness, an eval pipeline, two protocol implementations, a skills format, and a governance model on top. Most of that is infrastructure rather than domain work, and none of it is what the business asked for.
The lowtouch.ai appliance ships these nine packaged, deployed inside your own infrastructure, air-gapped where required. What your team supplies is process knowledge: the procedure, the systems to connect, the approvals to enforce, and the outcome to measure. The figures below are our own, published on lowtouch.ai and current as of August 2026.
| Measure |
lowtouch.ai appliance claim |
| Time to production |
4 to 6 weeks, not 6 to 12 months |
| AI engineers required on your side |
Zero |
| Certifications |
ISO 27001 and SOC 2 Type 2 attested |
The concepts are settled enough to standardise on. What is not settled is governance across agent boundaries, and that is the question to put to any vendor, including us.
Sources
- Anthropic, Effective context engineering for AI agents, 29 September 2025.
- Anthropic, Scaling managed agents: decoupling the brain from the hands, 2026.
- Anthropic, Effective harnesses for long-running agents.
- Anthropic, How we built our multi-agent research system.
- MCP core maintainers, One year of MCP: November 2025 spec release, 25 November 2025.
- Linux Foundation, A2A protocol surpasses 150 organizations, 9 April 2026.
- Linux Foundation, Launch of the Agent2Agent protocol project, 23 June 2025.
- Agent Skills, specification overview, 2026.
- SwirlAI, Agent skills: progressive disclosure as a system design pattern, March 2026.
- arXiv 2602.12430, Agent skills for large language models: architecture, acquisition, security, February 2026.
- Singh et al., Agentic retrieval-augmented generation: a survey, arXiv 2501.09136, January 2025.
- Liang et al., Reasoning RAG via system 1 or system 2, IJCNLP Findings 2025.
- arXiv 2407.13193, Retrieval-augmented generation for NLP: a survey, revised 2026.
- arXiv 2605.08580, Slipstream: trajectory-grounded compaction validation, 2026.
- Morph, AI agent evaluation: metrics, frameworks, production failures, June 2026.
- arXiv 2604.16706, Evaluating tool-using language agents: judge reliability, 2026.
- arXiv 2606.31498, Governance gaps in agent interoperability protocols, 2026.
- lowtouch.ai, product claims and certifications, retrieved 10 August 2026.
