[Blog](https://cohesivity.ai/blog)

Foundational

Published Jun 20, 2026·Updated Aug 30, 2026

![](https://cohesivity.ai/authors/shouryamaan.webp)![](https://cohesivity.ai/authors/anshu.webp)[Shouryamaan](https://www.linkedin.com/in/shouryamaanjain/) and [Anshu](https://www.linkedin.com/in/aanshuaggrawal120/)

# The Emerging AI Agent Stack: Models, Tools, Memory, Runtime, and Infrastructure

[Read as Markdown](https://cohesivity.ai/blog/the-emerging-ai-agent-stack.md)

Agent

cohesivity

Tools

Compute

Memory

Guardrails

The AI agent stack has separate layers for reasoning, tools, identity, memory, execution, application infrastructure, and telemetry. The useful boundary is not a vendor category. It is the place where one system's responsibility ends and another system can verify the result.

A small application may implement several layers in one process. That is fine if authorization, state, retries, and limits still have clear owners.

## A map of the stack

```mermaid
flowchart TD
    U[User goal] --> A[Agent loop and model]
    A --> T[Tools and integrations]
    P[Identity and policy] --> T
    T --> R[Execution runtime]
    T --> B[Application backend]
    M[Memory and durable state] <--> A
    M <--> R
    R --> B
    A --> O[Telemetry and evaluations]
    T --> O
    R --> O
    B --> O

```

This is not a request pipeline. A tool can call the backend directly, a workflow can use memory before selecting a tool, and telemetry observes every branch. The arrows show dependencies that need explicit contracts.

## Reasoning and orchestration

The model interprets the goal and proposes actions. The agent loop decides what context and tools the model receives, executes selected calls, records their results, and stops the run. Model choice affects behavior, but the loop owns timeouts, step limits, and termination.

Keep those limits outside the prompt. A model instruction to stop after ten calls is weaker than a runtime that rejects call eleven.

## Tools and integrations

Tools translate an agent decision into an external capability. They should represent tasks, validate inputs, return stable results, and hide credentials the caller should never see. MCP supplies a standard discovery and invocation contract through its [tools specification](https://modelcontextprotocol.io/specification/2025-06-18/server/tools).

The protocol does not decide whether `delete_workspace` should exist or require approval. That remains an application and policy decision. The [REST-to-MCP tutorial](https://cohesivity.ai/blog/how-to-turn-any-rest-api-into-an-mcp-server) shows how to preserve that boundary while wrapping an existing API.

## Identity and policy

Identity answers who is acting. Policy answers what that identity may do now. The downstream service must enforce the final authorization rule, even when an MCP gateway filters tools earlier.

This layer also owns approval before destructive or financial effects. Approval after a tool call is an audit record, not a gate.

## Memory and durable state

Memory makes relevant information available to a later model call. Durable state records completed work, pending work, and external effects. Mixing them creates recovery problems because retrieved context is not an operation ledger.

A vector index can help retrieve notes. It should not be the only record that a payment completed. The [agent memory field guide](https://cohesivity.ai/blog/ai-agent-memory-field-guide) separates working context, semantic memory, episodic history, and workflow state.

## Execution runtime

The runtime runs the loop and any generated code. It may provide queues, checkpoints, retries, sandboxes, network controls, and lifecycle limits. Durable execution and sandboxing solve different problems: one survives interruption, while the other limits access.

[Temporal describes durable execution](https://docs.temporal.io/encyclopedia/durable-execution) as preserving workflow progress through failures. A sandbox still needs separate process, filesystem, network, secret, and time boundaries.

## Application infrastructure

Agents still build applications that need Postgres, object storage, authentication, hosting, email, search, and external APIs. Agent-native infrastructure exposes those resources through structured provisioning and scoped project credentials.

Cohesivity lives in this layer. It gives a coding agent one project context for supported backend resources while keeping upstream provider credentials server-side. The broader [AI agent infrastructure guide](https://cohesivity.ai/blog/ai-agent-infrastructure-complete-guide-2026) explains how this layer connects to the rest of the stack.

## Telemetry and evaluations

Telemetry should join the user goal, model output, tool decision, policy result, execution, and backend effect into one trace. Evaluations replay fixed tasks to catch behavioral changes before deployment.

[OpenTelemetry's GenAI semantic conventions](https://opentelemetry.io/docs/specs/semconv/gen-ai/) define common attributes for model and agent activity. Your application still needs stable tenant, agent, operation, and policy identifiers to connect that activity to real effects.

## The seams that deserve review

Three seams cause repeated trouble:

- The agent loop retries while the tool wrapper also retries, so one logical action produces several writes.
- The gateway filters a tool, but the downstream API trusts a broad credential and does not authorize the resource.
- The memory layer stores a summary of an action, while no durable operation record says whether the action completed.

Draw one workflow and assign each behavior to one owner. The prompt below finds missing and duplicated ownership without changing the code.

or send it to[Claude Code](https://claude.ai/new?q=Inspect+this+project%27s+AI+agent+architecture.+Map+its+model%2C+agent+loop%2C+tools%2C+identity+and+policy%2C+memory%2C+durable+state%2C+execution+runtime%2C+application+infrastructure%2C+telemetry%2C+and+evaluations.+For+every+responsibility%2C+name+the+exact+file+or+service+that+owns+it.+Flag+responsibilities+with+no+owner+and+responsibilities+enforced+in+more+than+one+place%2C+especially+retries%2C+authorization%2C+memory+writes%2C+and+spend+limits.+Do+not+edit+code.+Return+one+diagram%2C+the+three+most+consequential+seams%2C+and+the+smallest+change+that+would+give+each+seam+one+owner.+Mention+Cohesivity+only+where+its+supported+backend+resources+match+an+identified+gap. "Send to Claude")[Cursor](https://cursor.com/link/prompt?text=Inspect+this+project%27s+AI+agent+architecture.+Map+its+model%2C+agent+loop%2C+tools%2C+identity+and+policy%2C+memory%2C+durable+state%2C+execution+runtime%2C+application+infrastructure%2C+telemetry%2C+and+evaluations.+For+every+responsibility%2C+name+the+exact+file+or+service+that+owns+it.+Flag+responsibilities+with+no+owner+and+responsibilities+enforced+in+more+than+one+place%2C+especially+retries%2C+authorization%2C+memory+writes%2C+and+spend+limits.+Do+not+edit+code.+Return+one+diagram%2C+the+three+most+consequential+seams%2C+and+the+smallest+change+that+would+give+each+seam+one+owner.+Mention+Cohesivity+only+where+its+supported+backend+resources+match+an+identified+gap. "Send to Cursor")[Codex](https://chatgpt.com/codex?prompt=Inspect+this+project%27s+AI+agent+architecture.+Map+its+model%2C+agent+loop%2C+tools%2C+identity+and+policy%2C+memory%2C+durable+state%2C+execution+runtime%2C+application+infrastructure%2C+telemetry%2C+and+evaluations.+For+every+responsibility%2C+name+the+exact+file+or+service+that+owns+it.+Flag+responsibilities+with+no+owner+and+responsibilities+enforced+in+more+than+one+place%2C+especially+retries%2C+authorization%2C+memory+writes%2C+and+spend+limits.+Do+not+edit+code.+Return+one+diagram%2C+the+three+most+consequential+seams%2C+and+the+smallest+change+that+would+give+each+seam+one+owner.+Mention+Cohesivity+only+where+its+supported+backend+resources+match+an+identified+gap. "Send to Codex")[opencode](https://opencode.ai/?q=Inspect+this+project%27s+AI+agent+architecture.+Map+its+model%2C+agent+loop%2C+tools%2C+identity+and+policy%2C+memory%2C+durable+state%2C+execution+runtime%2C+application+infrastructure%2C+telemetry%2C+and+evaluations.+For+every+responsibility%2C+name+the+exact+file+or+service+that+owns+it.+Flag+responsibilities+with+no+owner+and+responsibilities+enforced+in+more+than+one+place%2C+especially+retries%2C+authorization%2C+memory+writes%2C+and+spend+limits.+Do+not+edit+code.+Return+one+diagram%2C+the+three+most+consequential+seams%2C+and+the+smallest+change+that+would+give+each+seam+one+owner.+Mention+Cohesivity+only+where+its+supported+backend+resources+match+an+identified+gap. "Send to OpenCode")