AgentSys: Scalable Multi-Agent Architecture

• AgentSys is a conceptual umbrella for scalable multi-agent architectures that integrate reasoning, orchestration, and stateful execution.
• It distinguishes between agent definitions and instances, employing staged orchestration to manage workflows and maintain persistent state.
• It emphasizes robust identity, discovery, security, and governance, leveraging cryptographic verification and policy controls for auditable operations.

Across the surveyed literature, the term AgentSys appears chiefly as an umbrella descriptor—such as an “AgentSys-style architecture,” an “AgentSys-like environment,” or a broader “AgentSys landscape”—rather than as the title of a single normative specification. In that usage, it denotes the systems layer that makes agents operational at scale: execution substrates for non-deterministic and stateful workloads, declarative definitions of agents and their surrounding harnesses, identity and discovery mechanisms, governance and policy controls, and domain-specific multi-agent workflows that translate high-level goals into auditable action (Benkovich et al., 26 May 2026, Mittal et al., 29 Apr 2026, Kampik et al., 2020). AgentSys, in this sense, is less a single framework than a family of architectural concerns about how agents are defined, coordinated, secured, discovered, observed, and embedded into scientific or enterprise processes.

1. Conceptual scope and relation to agentic AI

The most general theoretical account in the surveyed material argues that agentic AI becomes meaningfully agentic only when adaptive, data-driven behavior is complemented by explicit models of reasoning, communication, coordination, and governance. The relevant foundations are identified as BDI architectures, communication protocols such as KQML and FIPA-ACL, mechanism design, multi-agent planning, negotiation, norms, institutions, trust, reputation, social choice, game theory, and theory of mind. This position treats LLM-based systems as incomplete unless they are embedded in structures that make commitments, roles, interaction semantics, and accountability explicit (Dignum et al., 21 Nov 2025).

This framing clarifies why AgentSys cannot be reduced to prompt engineering or tool invocation. Some works emphasize the internal deliberation loop. JS-son, for example, presents a lean JavaScript library for reasoning-loop agents, supporting BDI reasoning loops as well as belief-plan, belief-desire-plan, and belief-intention-plan variants, with Agent and Environment as the two core abstractions (Kampik et al., 2020). Other works emphasize infrastructure. The technical note on agent development toolkits argues that large-scale realization of agent applications requires robust infrastructure for development, deployment, interoperability, communication, mobility, and security, comparing Aglet, Voyager, JADE, Anchor, and Zeus along precisely those dimensions (Singh et al., 2011).

Taken together, these works situate AgentSys between two poles. At one pole are lightweight reasoning libraries that organize local autonomy. At the other are full platforms and protocol stacks that manage discovery, identity, security, orchestration, and lifecycle. A plausible implication is that AgentSys names the integration of these layers rather than any one of them in isolation.

2. Architectural primitives: agents, groups, orchestrators, and runtime state

A recurring AgentSys primitive is the separation between reusable specification and concrete execution. Agyn formalizes this distinction as the difference between an agent definition and an agent instance. A definition contains the prompt, tools, secret bindings, resource limits, policies, container image, and runtime harness; an instance is a concrete execution bound to a particular user and task, typically a conversational thread. The same definition can therefore spawn many isolated, stateful, short-lived instances concurrently (Benkovich et al., 26 May 2026). AaaS-AN expresses related ideas through the RGPS model. It defines agent knowledge as

$A=\{A^n,A^d,A^p,A^i,A^o,A^c\}$

and an agent group as

$G=\{G^n,G^d,G^p,G^i,G^o,G^A\},$

with both individual agents and agent groups treated as vertexes in a dynamic Agent Network (Zhu et al., 13 May 2025).

Another recurrent primitive is staged orchestration. MDAgent decomposes end-to-end molecular dynamics research into four roles: a research/planning agent, an MD execution agent, a reporting/analysis agent, and a review/supervision agent. Its workflow is formalized through structured artifacts such as literature_plan, md_execution, report, and report_review, and the review agent can return required_repairs and next_stage_focus before downstream execution proceeds (Ma et al., 18 Apr 2026). DarkAgents adopts an orchestrator plus specialized sub-agents, each required to emit both a Markdown report and a fixed-schema JSON handoff, with pauses for human review after each step unless fully autonomous execution is requested (Lucente et al., 9 Jun 2026). OptAgent organizes its agentic layer hierarchically into a concierge agent, an orchestrator agent, and 11 specialist agents operating through 72 MCP tools (Jiang et al., 27 Jan 2026).

These systems also treat state as a first-class runtime concern. Agyn characterizes its model as “ephemeral compute with durable state”: agent pods are spawned on signal, kept alive while active, and reclaimed when idle, while persistent volumes and thread context preserve continuity across cold starts (Benkovich et al., 26 May 2026). AaaS-AN’s Execution Graph likewise handles context management, task state tracking, and isolated yet selectively shared execution state across distributed agent services (Zhu et al., 13 May 2025). This suggests that AgentSys architectures are defined as much by their state model and handoff discipline as by their LLM components.

3. Identity, naming, discovery, and interoperability

A major AgentSys theme is that agents must be discoverable and identifiable independently of transient topology. The ANS proof-of-concept frames this need as a gap in four areas at once: uniform discovery, cryptographic authentication, capability attestation, and enforceable policy controls. Its naming grammar,

Protocol://AgentID.Capability.Provider.v[Version].Extension

maps an agent name to identity, protocol, capability, provider, version, environment, and policy context, while Kubernetes-native CRDs, admission controllers, Istio integration, and OPA-based policy enforcement turn that naming scheme into a trust layer rather than a simple directory (Mittal et al., 29 Apr 2026).

The agent:// URI scheme provides a more formal topology-independent construction:

agent://trust-root/capability-path/agent-id[?query][#fragment]

Its central design separates identity, capability, location, and trust. Discovery is performed through DHT key derivation,

$$key = \text{SHA256}(\text{canonical}(trust\_root) \ \| "/" \| \text{canonical}(cap\_path)),$$

and capability authorization is bound cryptographically through PASETO v4.public attestations, with coverage defined as

$$\text{covered}(path, caps) := \ \exists c \in caps: path.\text{starts\_with}(c).$$

The reported evaluation gives 100% coverage and 0% collision on 369 production tools, F1 = 1.0 across 10,000 agents for discovery precision, and all operations under 5 microseconds (Rodriguez, 21 Jan 2026).

ANP generalizes identity and discovery into a three-layer protocol architecture: an Identity and Secure Communication Layer, a Meta-Protocol Negotiation Layer, and an Application Protocol Layer containing Agent Description Protocol and Agent Discovery Protocol. It relies on W3C DID, proposes did:wba, supports end-to-end encryption through DID key pairs and ECDHE, and treats agent description as a machine-readable “business card” published on existing web infrastructure (Chang et al., 18 Jul 2025). AaaS-AN adds service registration, service discovery, and interoperability protocols on top of agent groups treated as service units (Zhu et al., 13 May 2025).

The common direction is clear. AgentSys work consistently replaces hardcoded endpoint references with names, capabilities, attestations, and policy scopes that are machine-readable and, in some cases, cryptographically verifiable.

4. Security, governance, and observability

Security-oriented AgentSys research assumes that agents are powerful, stateful, and frequently privileged, but not inherently trustworthy. Agyn therefore grounds its platform in zero trust and least privilege. Its main agent process runs in a separate container from MCP sidecars; filesystems and process trees are isolated; secrets are injected only into the container that needs them, usually the sidecar; each agent receives its own X.509 identity at spawn; network access is mediated through OpenZiti with mTLS and ABAC; and higher-level permissions are handled through OpenFGA with roles such as owner, maintainer, and participant (Benkovich et al., 26 May 2026). ANS follows a related pattern through DIDs, VCs, OPA, admission control, Istio mTLS, and the trust chain

Root CA → Int. CA → Agent Cert. → Capability Proof

while explicitly distinguishing what is demonstrated in its Kubernetes proof of concept from roadmap-level zero-knowledge capability claims (Mittal et al., 29 Apr 2026).

Agent-Sentry addresses security from the perspective of execution provenance. It learns benign, ambiguous, and adversarial functionality graphs from agent traces, distinguishing retrieval tools from action tools and inspecting both control-flow relations and argument provenance. At runtime, benign-only paths are allowed, attack-only paths are blocked, and ambiguous or unseen paths are handed to an intent-alignment judge that sees only trusted inputs. On Agent-Sentry Bench with 100% trace coverage, it reports average utility success of 94.61% and average ASR of 9.46%; on AgentDojo it reports utility 76.30%, ASR 3.70%, and 7.89 s latency (Sequeira et al., 24 Mar 2026).

ADR treats enterprise observability as the critical missing layer for MCP-based agents. Its ADR Sensor reconstructs prompts, reasoning traces, MCP tool invocations, and environment context from local endpoint artifacts; its Detector uses a two-tier design with lightweight triage followed by context-aware reasoning against source code, threat intelligence, and policy stores; and its Explorer performs offline evolutionary red teaming using the fitness function

$F = \varepsilon \times \sigma \times \tau^{\alpha}$

with $\alpha = 1.2$, under the convergence condition

$\rho \times \mu < 1.0.$

Deployed at Uber for over ten months, ADR reached over 7,200 unique hosts and processed over 10,000 agent sessions daily. On ADR-Bench it achieved precision 1.000, recall 0.667, F1 0.800, and TP/FP 28/0 (Li et al., 17 May 2026).

Governance is not limited to security telemetry. LiaisonAgent introduces a hybrid planning architecture in which deterministic pre-steps and post-steps are reserved for compliance-critical actions, while the dynamic middle of the investigation uses a ReAct-style loop with state-persistent task management. Its reported weighted-average tool-calling Final Success Rate is 97.8%, risk judgment accuracy is 95%, and manual investigation overhead is reduced by 92.7% (Tang et al., 27 Feb 2026). In AgentSys terms, this is governance embedded directly into workflow planning rather than bolted on after execution.

5. Domain-specific AgentSys realizations

Several surveyed systems instantiate AgentSys principles in scientific and industrial domains where the workflow itself is the object of automation. MDAgent treats molecular dynamics as a chained research process rather than a script-running problem. Its “Skill and Memory” mechanism stores reusable “case cards” and “skill cards” containing planning logic, key parameters, analytical focus, workflow rules, quality checkpoints, and repair strategies, enabling transfer “without retraining.” On ten benchmark tasks, average core quality rises from 67.00 for Single-Agent LLM to 87.92 for Full MDAgent + CBL. In the independent TMEM16F/XKR8 case, the review agent assigns plan quality 92/100, execution blueprint quality 84/100, report quality 87/100, and transfer quality 94/100 (Ma et al., 18 Apr 2026).

DarkAgents applies analogous ideas to theoretical astroparticle physics. It combines LLM reasoning and code generation with deterministic human-written physics code, uses an orchestrator plus proposal, librarian, critic, fopt, pta, constraint, prior, and report sub-agents, and produces three principal outputs: best-fit values of model parameters, existing experimental and observational constraints, and an audit report of assumptions and priors. In its DarkAgent-PT implementation, it is reported to reject an invalid sound-wave GW template in a strongly supercooled regime and instead select the dissipative bulk-flow template, leading to novel fits and the identification of inconsistencies in some fits in the literature (Lucente et al., 9 Jun 2026).

OptAgent targets intelligent building operations through a coupled “brain” and “body” architecture: an agentic layer with 11 specialist agents and 72 MCP tools, and the BESTOpt PIML environment spanning building thermal dynamics, HVAC, DERs, and grid interaction. Its benchmark covers about 4000 runs, and the paper reports that centralized two-stage orchestration performs best overall, with tool accuracy 0.69, agent accuracy 0.72, plan accuracy 0.67, and parameter accuracy 0.70. In the representative case study, upgrading HVAC COP to 4.5 and battery capacity to 20 kWh reduces HVAC electricity consumption by 8.4%, eliminates peak grid import, and increases mean SOC from 9.1% to 84.1%; adding pre-cooling lowers temperature standard deviation by 4.4% and increases PV self-consumption by 20.8% (Jiang et al., 27 Jan 2026).

Agentsway translates similar motifs into software engineering methodology. It assigns formal roles to a human orchestrator, Planning Agent, Prompting Agent, Coding Agents, Testing Agents, and Fine-Tuning Agents; centers the lifecycle on retrospective learning; and embeds privacy-by-design and a multi-LLM consortium with a reasoning LLM. In the legal automation use case, the Planning Agent’s Case Summarization Workflow Pitch receives an average rating of 4.7 on a 5-point Likert scale for coherence, correctness, and implementation readiness (Bandara et al., 26 Oct 2025).

These systems do not share a single domain ontology, but they do share a systems pattern: explicit decomposition, structured intermediate artifacts, review or supervision loops, and operational state that persists across multi-step workflows.

6. Lineage, distinctions, and unresolved issues

The historical lineage of AgentSys-like work predates current LLM-based systems. The toolkit survey presents JADE as the most balanced among Aglet, Voyager, JADE, Anchor, and Zeus because it combines open-source availability, Java portability, FIPA compliance, good security, and “not-so-weak” mobility, while Anchor emphasizes strong security through SSL, X.509, and Akenti, and Zeus emphasizes planning and graphical tools but lacks mobility (Singh et al., 2011). JS-son, by contrast, represents a deliberately minimal alternative: a dependency-free reasoning-layer library meant to fit mainstream JavaScript ecosystems rather than replace them with a heavyweight MAS stack (Kampik et al., 2020).

Contemporary work differentiates AgentSys from both tool protocols and agent-construction frameworks. AaaS-AN argues that MCP addresses tool invocation and data exchange but “does not provide collaboration paradigms among agents,” motivating its Role-Goal-Process-Service model, dynamic Agent Network, Service Scheduler, and Execution Graph (Zhu et al., 13 May 2025). Agyn makes a parallel distinction from libraries such as LangGraph, AutoGen, and CrewAI: it is not a framework for constructing agents, but an operational platform that can host agents built with such frameworks or with custom containers (Benkovich et al., 26 May 2026). This distinction corrects a common misconception that “agent system” and “agent framework” are interchangeable.

The surveyed literature also leaves several issues explicitly unresolved. ANS identifies full zero-knowledge capability verification, large-scale federation across clusters, and globally distributed trust synchronization as beyond what its proof of concept demonstrates (Mittal et al., 29 Apr 2026). ANP notes that meta-protocol negotiation is time-consuming and that economic incentives for sharing and selecting consensus protocols remain open (Chang et al., 18 Jul 2025). Agent-Sentry acknowledges that mimicry attacks remain difficult and that periodic graph updating is envisioned but not implemented (Sequeira et al., 24 Mar 2026). LiaisonAgent emphasizes that its evaluation is synthetic and depends on LLM-simulated users and supervisors (Tang et al., 27 Feb 2026). OptAgent argues that static agent pools are insufficient and that future systems must evolve architecture, prompts, policies, and tool schemas through closed-loop feedback (Jiang et al., 27 Jan 2026). DarkAgents reports that literature-search tools can still induce hallucinated references in final reports (Lucente et al., 9 Jun 2026).

What emerges from these works is not a finished canonical architecture, but a convergent research program. AgentSys denotes the attempt to make agents into governed system entities: named and discoverable, policy-bound, auditable, stateful, composable, and embedded in operational environments whose security and lifecycle are engineered rather than assumed.