- The paper defines Agentic Service-Oriented Computing as a discipline for building goal-directed, tool-using agents into composable, governable service ecosystems through contracts, harnesses, and oversight.
- The paper proposes an agent harness and delegation contract to control permissions, tools, memory, provenance, escalation, revocation, and accountability across five levels of agent autonomy.
- The paper establishes six engineering principles and a research agenda spanning interoperability, lifecycle management, security, observability, responsibility allocation, and Agentic QoS metrics such as factual reliability and goal fidelity.
The inflection point and the engineering deficit
This manifesto, authored by a group of senior researchers spanning Macquarie University, IBM Research, Dublin City University, University of Trento, TU Wien, University of Virginia, BNBU, and the University of Sydney (2607.12619), argues that LLM-powered agents have transformed software from deterministic request-response components into goal-directed, tool-using computational actors, while the surrounding engineering discipline has failed to keep pace. The authors' central claim is deliberately provocative: current agentic AI is "repeating the mistakes of pre-SOA distributed computing," assembling impressive capabilities without the contracts, QoS accountability, lifecycle management, and governance infrastructure that made distributed systems dependable. They contend that these are precisely the problems the Service-Oriented Computing (SOC) community has studied for over two decades, and that the community must now supply the "conceptual and engineering spine" for agentic AI.
The paper makes four contributions: a formal definition of Agentic Service-Oriented Computing (ASOC); a tripartite framing (agents-as-services, services orchestrated by agents, governed agent-service ecosystems); six normative engineering principles; and a five-dimensional research agenda. It is explicitly positioned as complementary to Deng et al.'s survey of Agentic Services Computing (Deng et al., 29 Sep 2025), which provides a lifecycle-oriented paradigmatic framework covering 200+ works; this manifesto instead offers prescriptive doctrine, a reference architecture, and defined technical objects (delegation contract, agent harness, agentic service ecosystem) that Deng et al. do not provide.
Inherited foundations from SOC
The manifesto grounds its argument in seven SOC pillars—service contracts, publish-find-bind discovery, composition and orchestration, QoS/SLAs, lifecycle engineering, governance, and monitoring/auditability—and specifies how each must be transformed. Contracts become agentic capability and delegation contracts carrying goal types, uncertainty characteristics, and revocability conditions. Discovery shifts to goal-level capability matching rather than typed interfaces. Composition becomes runtime, agent-assisted orchestration under formal constraints, extending eFlow's adaptive composition [ref3], Self-SERV's declarative provisioning [ref4], BPEL4WS [ref5], and McIlraith and Son's planning-based semantic composition [ref6]. QoS extends Zeng et al.'s composite quality-driven selection [ref7] with factual accuracy, goal fidelity, and trust-calibrated SLAs—a property set the authors observe is "almost entirely absent" from current agentic AI engineering. Lifecycle discipline builds on SODDM [ref20], and observability extends protocol-model derivation from interaction logs [ref27] to full reasoning-to-action provenance.
Two properties distinguish agentic services from conventional ones: goal-directedness (an under-specified goal replaces a fully specified request, introducing indirection with major implications for verification and accountability) and emergence (system behaviour arising from agent interactions unpredictably from individual specifications). The authors concede explicitly that SOC provides "important but insufficient" foundations for managing emergence.
Core concepts and reference architecture
The formal definition centres ASOC on agents reasoning, planning, invoking tools, and acting on behalf of humans or organisations under explicit constraints of trust, cybersecurity, compliance, performance, and accountability. Its most consequential construct is the agent harness: a runtime governance wrapper mediating goals, permissions, tools, memory, policies, execution traces, and escalation pathways. The authors state boldly that the harness is "to ASOC what the service contract was to SOA, what the container runtime was to cloud-native microservices," and distil the core engineering object as:
Agentic Service = Agent + Service Contract + Harness + Governance Metadata
The implication is that an agent becomes deployable not when it reasons well but when its reasoning is contractually bounded, logged, traceable, and revocable. A five-level delegation taxonomy (L0 advisory through L4 high-consequence autonomy) maps each autonomy level to minimum control requirements, from provenance alone up to certification, audit, and liability models. The six-layer reference stack places the harness at layer 3 as the flagship mechanism, with Governance/Observability and Security/Trust as cross-cutting planes.
Six principles and the research agenda
The six normative principles—harnessability, composability/interoperability, lifecycle engineering, trustworthiness by design, goal-driven orchestration, and observability/accountability—are each stated with definition, motivation, research questions, and realisation mechanisms. Notably, the manifesto treats responsibility allocation as a first-class engineering concern: when an agentic service causes harm, liability may be distributed across delegating principal, agent provider, model provider, tool provider, orchestrating platform, and deploying organisation, and existing legal frameworks built on traceable causal chains break down. The delegation contract partially addresses this, but the authors acknowledge it does not by itself resolve provider-to-provider boundaries—an open problem requiring formal responsibility-allocation models.
On interoperability, the paper takes a measured position on MCP [ref24] and A2A [ref29]: they are "scaffolds, not foundations," addressing tool access and agent communication respectively but leaving delegation semantics, trust calibration, revocation, and compliance evidence unresolved. A gap analysis maps OpenAPI, AsyncAPI, CloudEvents, OAuth/OIDC, and W3C PROV similarly—each contributes a fragment while critical ASOC concerns remain unaddressed.
Security and evaluation
The ASOC-specific threat model identifies seven threat categories, several of which operate at layers conventional service security does not cover: prompt injection, tool poisoning via malicious tool descriptions, privilege escalation beyond delegated authority, data exfiltration, goal drift, delegation misuse (actions technically permitted by credentials but outside intended scope), and multi-agent cascade failure. The authors state plainly that no mature, standardised countermeasure yet exists for prompt injection at the ASOC level—a significant concession given how central the natural-language interface is to the new attack surface.
The fifth agenda dimension proposes Agentic QoS as a first-class construct extending classical metrics (latency, availability, cost) with agent-specific ones: factual reliability (hallucination rate), goal fidelity, policy compliance rate, uncertainty calibration (expected calibration error), provenance completeness, and human-oversight effectiveness (escalation interception rate). Compositional models for aggregating these across multi-agent pipelines remain a foundational open challenge. Benchmarking and certification are distinguished: the former drives comparative progress, the latter provides the assurance basis regulated domains require before deployment.
Limitations and open questions
As a manifesto, the paper intentionally offers no empirical results, prototypes, or validated metrics; its claims rest on historical analogy and argument rather than measurement. Several assumptions deserve scrutiny. The claim that the Services Computing community should lead rests partly on institutional positioning, and the authors themselves frame it as a claim others may contest. The fragmentation-risk thesis—that without disciplinary leadership the field will recapitulate pre-SOA incompatibility—is asserted by analogy rather than demonstrated. The proposed constructs (delegation contracts, harnesses, provenance graphs, Agentic QoS metrics) are specified only at the level of definitions and indicative measures; formal semantics, verification methods, and validated benchmarks are all left as open research questions, as the authors acknowledge throughout. Whether harness-based governance can enforce policy "without impairing autonomy," and whether fairness or alignment properties can be monitored at scale, remain unresolved even within the paper's own framework.
Conclusion
This manifesto defines ASOC as the engineering discipline required to convert autonomous agent capability into accountable, composable, governable service ecosystems. Its distinctive contributions are the agent harness as the mechanism converting autonomy into governed autonomy, the delegation contract as the formal object bounding authority, and a research agenda that extends twenty-five years of SOC results into the probabilistic, goal-directed setting. It concedes that ASOC will not solve hallucination, alignment, or social governance itself; its role is to supply the structures through which advances in those areas become deployable. The open question the paper leaves the community is concrete: whether contracts, harnesses, Agentic QoS frameworks, and certification schemes can be standardised fast enough to prevent the fragmentation its authors predict.