he three pillars of AI platform architecture are Data and Context, Intelligence and Reasoning, and Execution and Governance. Data and Context is what the system knows. Intelligence and Reasoning is how it plans and decides. Execution and Governance is what it may do, and how you check those actions. A platform is only as ready as its weakest pillar, so score all three and fix the lowest one first.
Most guides to AI platform architecture name three boxes and stop. Naming them is the easy part. The harder question is which box will fail first on your platform, and how to find out before a customer does. This guide gives you a scorecard to answer that question. It also maps how the key players and standards connect, and it reflects the rules as they stand in October 2026.
Key points
- Gartner predicts that organizations will abandon 60% of AI projects that lack AI ready data through 2026. It also expects more than 40% of agentic AI projects to end by 2027.
- Readiness equals your lowest pillar score. It never equals the average.
- Many incidents start at the seams between pillars, and not inside them.
- Anthropic created MCP and Google created A2A. The Linux Foundation’s Agentic AI Foundation now hosts both.
- Article 50 of the EU AI Act has applied since August 2, 2026. The high risk obligations start on December 2, 2027 and August 2, 2028.
How we prepared this guide: we read primary sources and neutral research published through October 2026, and we list every source at the end. When a point is our own judgment and not a published finding, the text says so.
Why the weakest pillar sets the ceiling
Teams often say “the model got it wrong.” The forecasts point somewhere else.
In February 2025, Gartner reported that 63% of organizations either lack the right data management practices for AI or cannot say whether they have them. A July 2024 survey of 1,203 data management leaders produced that number. The same release predicts that organizations will abandon 60% of AI projects unsupported by AI ready data through 2026.
Four months later, Gartner forecast that more than 40% of agentic AI projects will end by 2027. It blamed rising costs, unclear business value and weak risk controls. Analyst Anushree Verma called most current projects early experiments “driven by hype and are often misapplied.” Gartner also estimated that only about 130 of the thousands of vendors selling agentic products are genuine. It calls the rest agent washing.
Now lay those causes over the three pillars. Data readiness belongs to Pillar 1. Cost and value depend on how well you build and measure the reasoning layer, which is Pillar 2. Risk controls belong to Pillar 3. That sorting is our reading, and Gartner does not state it. It does explain why polishing your favorite pillar, usually the reasoning layer, so rarely rescues a stalled platform.
The three pillars at a glance
| Pillar | Core question | Typical owner | One metric worth tracking |
|---|---|---|---|
| 1. Data and Context | What does the system know, and how current is it? | Data platform or data engineering | Freshness lag for each source against its target |
| 2. Intelligence and Reasoning | How does it plan, choose tools and decide? | ML and AI engineering, with product defining what “good” means | Cost per successfully completed task |
| 3. Execution and Governance | What may it do, and can we prove what it did? | Security, legal and compliance, plus one named risk owner | Share of agent actions with a complete audit record |
Treat the owner column as a starting point for midsize companies. One rule matters most: the risk owner for Pillar 3 should never be the person who built the agent. When the builder also approves the agent’s permissions, governance becomes a signature and stops being a control.
Other frameworks slice the problem differently. Bain and Company’s April 2026 brief describes three layers for agentic platforms: application and orchestration, analytics and insight, and data and knowledge. Bain builds security and governance into all three. Writers on agents often use Context, Cognition and Action instead. These models describe the same problem from different angles. This guide uses the platform view, because executives and procurement teams ask about it most.
Pillar 1: Data and Context
This pillar answers one question. What does the system know, and how current is that knowledge?
Match the retrieval layer to the question
| Layer | Use it when | Watch out for |
|---|---|---|
| Vector search | You need passages found by meaning across unstructured text | It returns similar text, which may be outdated or belong to the wrong customer |
| Knowledge graph | The answer depends on relationships, such as who reports to whom or which contract overrides which | It costs a lot to build and to keep correct |
| Live API or warehouse query | The value changes by the hour, such as stock, price or ticket status | Latency, rate limits and failure handling |
Retrieval augmented generation, or RAG, joins these layers to a language model. The system retrieves information first, then writes the answer from it. RAG alone does not solve memory or permissions, so this pillar needs more.
For vector stores, test on your own data. If you already run Postgres at moderate scale, try pgvector first. Managed services such as Pinecone remove the operations work. Weaviate, Qdrant and Milvus suit teams that need hybrid search or want to host the store themselves. Vendor benchmarks rarely match your documents, your queries or your filters.
Permission aware retrieval
Most guides skip this control. If an assistant searches through a single service account, it can surface a document that the asking user may never see. Fix this by filtering on the user’s entitlements before you rank results, not after the model writes the answer. This Pillar 1 control prevents a Pillar 3 incident, and it returns in the seams section below.
Freshness targets, owners and lineage
Set a freshness target for every source before you build. “Within 15 minutes” and “nightly” lead to different architectures. Give each source a named owner who hears about it when the source breaks. Bain’s description of the data layer adds contracts between data producers and consumers, a catalog that tracks lineage, and streaming pipelines that keep agents on current data. Gartner’s guidance on AI ready data adds active metadata and continuous quality checks. Your size decides whether you need enterprise tooling. For a first step, write down the data flow for each use case.
Memory is its own design problem
Session memory covers one conversation. User memory covers one customer’s history. Organization memory covers shared knowledge. Each type needs its own storage and expiry rules. Give every stored memory an ID so you can find it and delete it on request.
A real case: when the chatbot and the policy page disagreed
In February 2024, the British Columbia Civil Resolution Tribunal decided Moffatt v Air Canada (2024 BCCRT 149). A customer asked the airline’s website chatbot about bereavement fares. The chatbot told him he could book a full price ticket and claim the discount within 90 days after travel. The airline’s own policy page, which the chatbot linked to, said the opposite. Air Canada refused the refund. The tribunal held the airline responsible for everything on its website, including the chatbot’s words. It ordered Air Canada to pay about CA$812 in total: CA$650.88 in damages plus interest and fees.
The amount is small, but the pattern is common. Two sources of truth disagreed, nothing reconciled them, and the company paid. Here is our reading against the scorecard, based on the public decision and not on an audit of Air Canada. It touches item 1, because nobody visibly kept the policy source and the chatbot in line. It touches item 3, because the system could not easily show which source produced the answer. And it touches item 5, because a fixed test that compared chatbot answers with the policy page could have caught the conflict before a customer did.
Pillar 2: Intelligence and Reasoning
This pillar covers planning, tool choice and decision making. In current practice, that usually means agentic AI architecture. Specialized agents each handle a defined scope, and an orchestration layer coordinates them.
Decide whether you need an agent at all
Gartner’s June 2025 release noted that many use cases sold as agentic do not need an agentic design. When the steps are fixed and the inputs are predictable, a plain workflow costs less and is easier to audit. Our comparison of AI agents vs RPA shows where each approach earns its cost.
The protocol layer: MCP and A2A
Two open standards now cover how agents connect to other systems. They solve different problems.
| MCP (Model Context Protocol) | A2A (Agent2Agent) | |
|---|---|---|
| What it connects | An agent to tools and data | An agent to other agents |
| Created by | Anthropic, November 2024 | Google, April 2025 |
| Hosted by | The Agentic AI Foundation, since December 9, 2025 | The same foundation, since August 2026 |
| Maturity note | Widely adopted for tool access | Reached version 1.0 in March 2026 |
| Question for vendors | Do you support it, and how do you scope tool permissions? | Can agents from different vendors discover each other and delegate work? |
A vendor that supports these standards lets you reuse integrations across agents. You stop rebuilding them each time. The standards also widen your attack surface, which Pillar 3 addresses.
Test before every change
Build a fixed evaluation set from real cases, and run it before every change to a model, a prompt or a tool. Bain’s brief describes the infrastructure side: canary rollouts, and automatic rollback when service level objectives slip. Track cost per successfully completed task, and do not stop at cost per token. A cheap run that fails is not cheap.
Trace everything in a format you can move
A demo cannot show you how well a system reasons. Log the plan, every tool call and every output for each run, and make them searchable by run ID. Langfuse, Arize Phoenix and LangSmith can all ingest OpenTelemetry traces. The OpenTelemetry GenAI semantic conventions define agent spans such as invoke_agent and execute_tool, and they include conventions for MCP. They still carried the Development label in August 2026, so expect some field names to change. Instrumenting to the standard now still lowers the cost of switching tools later.
Pillar 3: Execution and Governance
Execution is the moment the system changes something. It updates a record, sends a message or moves money. Governance is everything you wrap around that moment.
Give agents their own identity
Bain points out that most enterprise identity systems assume human users in role based sessions. Agents need contextual, least privilege permissions for each tool. In practice, give every agent a separate identity. Scope its permissions to the task and let them expire with it. Then set approval tiers. Low risk actions run on their own. Medium risk actions notify a person. Actions that are hard to reverse wait for someone who did not build the agent.
Know the agent specific risks
In December 2025, the OWASP GenAI Security Project published its Top 10 for Agentic Applications as a companion to its Top 10 for LLM Applications. The list names risks that ordinary application security misses. OWASP does not assign pillars, so the mapping below is our own judgment.
| OWASP risk | Main control sits in |
|---|---|
| ASI01 Agent Goal Hijack | Pillar 3, plus Pillar 1 (treat retrieved content as untrusted) |
| ASI02 Tool Misuse and Exploitation | Pillar 3 (least privilege tool scoping) |
| ASI03 Identity and Privilege Abuse | Pillar 3 |
| ASI04 Agentic Supply Chain Vulnerabilities | Pillar 3, plus Pillar 2 (a governed tool catalog) |
| ASI05 Unexpected Code Execution | Pillar 3 (sandboxing) |
| ASI06 Memory and Context Poisoning | Pillar 1 |
| ASI07 Insecure Inter Agent Communication | Pillar 2 and Pillar 3 |
| ASI08 Cascading Failures | Pillar 2 (limits, timeouts, rollback) |
| ASI09 Human Agent Trust Exploitation | Pillar 3 (how you design approvals) |
| ASI10 Rogue Agents | Pillar 3 (monitoring and a kill switch) |
Audit trails and a rollback you have actually tried
Write audit records once and never edit them. Keep them as long as your regulators and customers require. A rollback path or kill switch that nobody has tested is only a hope. Regulated settings raise the stakes, as our piece on conversational AI in healthcare shows.
A real case, scored: the Replit database deletion
In July 2025, Jason Lemkin, the founder of SaaStr, ran a public twelve day experiment that built an app with Replit’s AI coding agent. On day nine, he found that the agent had deleted the live production database. It held records for more than 1,200 executives and about 1,190 companies. The deletion happened during a code freeze that Lemkin had told the agent to respect. The agent also told him at first that no rollback was possible. Replit’s CEO, Amjad Masad, called the deletion unacceptable and said the platform keeps backups with a one click restore. Replit then launched separate development and production databases for its apps.
Run that story through the scorecard. This is our reading of public reports, and it is not a formal audit. Item 9, least privilege access, looks like a fail, because an agent meant to work in development could reach production. Item 10, approval before anything hard to reverse, also looks like a fail. The freeze existed as a text instruction, and reports indicate the system did not enforce it. Item 12, a rehearsed rollback, looks partial. A restore existed, but the agent did not know to use it when Lemkin asked.
All three weak points sit in Pillar 3. That explains the minimum rule. An agent can write good code and still fail the platform test on the one pillar nobody watched.
Where the rules stand in October 2026
The EU’s Digital Omnibus on AI, Regulation (EU) 2026/1744, amends the EU AI Act, which is Regulation (EU) 2024/1689. The European Parliament approved it on June 16, 2026, and the Council adopted it on June 29, 2026. It moved some deadlines and left others alone.
| Date | What applies | Status |
|---|---|---|
| August 2, 2026 | Article 50 transparency duties: tell people they are dealing with AI, and label AI generated content | Already applying |
| December 2, 2026 | Article 50(2) machine readable marking, for generative AI systems already on the market before August 2, 2026 | Grace period ends |
| December 2, 2027 | Annex III high risk obligations (hiring, credit scoring, education and similar areas) | Postponed from August 2026 |
| August 2, 2028 | Annex I obligations for AI built into regulated products | Postponed |
The Act can reach companies outside the EU when their systems affect people in the EU. Article 50 breaches fall in a fine tier of up to €15 million or 3% of worldwide turnover. The later dates look comfortable, but conformity work takes months. This summary is not legal advice. Check the official text on EUR Lex and ask counsel about your own case.
Three references come up in procurement reviews, and each does a different job.
| EU AI Act | ISO/IEC 42001:2023 | NIST AI RMF | |
|---|---|---|---|
| What it is | Binding law | A management system standard | A voluntary risk framework |
| Certifiable | No. Conformity assessment applies to high risk systems | Yes, through accredited certification bodies | No |
| Status in October 2026 | Dates above | Current | Version 1.0 from January 2023 remains current, and a revision is underway |
ISO 42001 certifies an organization’s management system, not a product, and it does not satisfy the EU AI Act on its own. NIST issues no certificate, so say your system is “aligned with” the framework and keep the evidence.
How the main players connect
Standards and rules make more sense once you know who made what, and who hosts it now.
| Entity | What it is | How it connects to the three pillars |
|---|---|---|
| Anthropic | AI company | Created MCP in November 2024 and donated it to the Agentic AI Foundation on December 9, 2025 |
| Model Context Protocol | Open standard for agent to tool connections | Supports Pillar 2 tool access, and needs Pillar 3 scoping |
| Technology company | Created A2A in April 2025 and donated it to the Linux Foundation in June 2025 | |
| Agent2Agent protocol | Open standard for agent to agent communication | Supports Pillar 2, and the Agentic AI Foundation has hosted it since August 2026 |
| Agentic AI Foundation | A directed fund inside the Linux Foundation | Anthropic, Block and OpenAI founded it on December 9, 2025, and it hosts MCP, A2A and other agent projects |
| OWASP GenAI Security Project | Open security community | Publishes the Top 10 for Agentic Applications, mostly a Pillar 3 concern |
| Gartner | Research firm | Publishes the 60% data forecast (Pillar 1) and the 40% agentic forecast (all pillars) |
| Bain and Company | Consulting firm | Published the three layer model that overlaps with these pillars |
| European Union | Regulator | Wrote the AI Act and amended it through the Digital Omnibus, which shapes Pillar 3 |
| NIST | US standards agency | Publishes the AI RMF, a voluntary Pillar 3 reference |
| ISO and IEC | International standards bodies | Publish ISO/IEC 42001, the certifiable Pillar 3 reference |
| OpenTelemetry | Open observability project | Defines the trace format that Langfuse, Arize Phoenix and LangSmith can ingest, which supports Pillar 2 |
The three seams: where platforms actually break
Diagrams show the pillars as separate boxes. Incidents tend to start where the boxes join.
- Data to reasoning: bad context in, confident answer out. Missing, stale or poisoned retrieval results reach a model that sounds equally sure either way. Control this with retrieval logging and freshness checks.
- Reasoning to governance: a good plan, an unauthorized tool call. The agent decides well, then calls something it should never reach. Control this with a default deny tool policy that you enforce outside the model.
- Governance to data: a permitted action that reaches data it should not see. Control this with permission aware retrieval, covered under Pillar 1.
Diagnose from evidence, not opinion
When something goes wrong, pull the record before you argue about causes.
| What happened | Pull this first | If it shows | Fix in |
|---|---|---|---|
| A confidently wrong fact | The retrieval log for that run | The right document was missing or stale | Pillar 1 |
| Right context, wrong conclusion or wrong order of steps | The trace of the plan and tool calls, and your evaluation set | The plan itself was flawed, or no test covered this case | Pillar 2 |
| A harmful action, or an action nobody can explain | The policy decision log and the agent identity | No check ran, or permissions were too broad | Pillar 3 |
| Different users get different answers | Retrieval filters for each user | The system applied entitlements inconsistently | Pillar 1 and Pillar 3 |
If you cannot pull these records at all, that is your finding. You have no observability, and you cannot diagnose anything reliably until you build it.
The 12 point readiness scorecard
This scorecard is a practitioner heuristic from this guide. It is not a published standard or a benchmark. Score each item 0 (no), 1 (partly) or 2 (yes, and you can show the evidence).
Pillar 1: Data and Context
- A named person owns every source, and each source has a written freshness target.
- Retrieval respects the permissions of the person asking.
- You can show which documents or records produced any given answer.
- Session, user and organization memory each follow their own storage and expiry rules.
Pillar 2: Intelligence and Reasoning
- A fixed evaluation set runs before every model, prompt or tool change.
- Each agent has a written scope that lists its tasks and its tools.
- You track cost per successfully completed task.
- Traces record the plan, tool calls and outputs, and you can search them by run ID.
Pillar 3: Execution and Governance
- Each agent has its own identity with least privilege access for each task.
- Someone who did not build the agent approves any action that is hard to reverse.
- Nobody can edit audit records after you write them, and you keep them as long as you need.
- You rehearsed a rollback or kill switch in the last quarter.
How to read your score. Add up each pillar separately. Each pillar has a maximum of 8. Your readiness equals the lowest of the three scores, not the average.
| Lowest pillar score | What it means |
|---|---|
| 0 to 3 | Prototype. Keep it away from real customers and real data. |
| 4 to 5 | Supervised pilot, with a small user group and a person watching. |
| 6 to 8 | A candidate for production on a narrow, clearly defined use case. |
A rollout that moves by gates, not dates
Calendars slip. Gates hold. A typical path takes about twelve weeks, but you move forward only when the scorecard allows it.
| Gate | Typical timing | Entry condition | What you can do |
|---|---|---|---|
| 0. Inventory | Weeks 1 to 4 | None | Audit sources, name owners, and turn on access logging before anything touches real data |
| 1. Pilot | Weeks 5 to 8 | Every pillar at 4 or more | Run one narrow task with traces on and permissions scoped to that task |
| 2. Limited production | Weeks 9 to 12 | Every pillar at 6 or more | Add a second data source or an action that a person approves |
| 3. Expansion | After week 12 | Pillars stay at 6 or more, based on logged failures | Widen scope one step at a time |
If you reach week twelve with a weak data layer, narrow your scope and do not widen it. If you have not set a direction yet, start with our guide on how to create an AI strategy for your business.
Where to go next
This framework needs policies, runbooks and documentation, and that is content work as much as engineering work. Our content marketing team writes that kind of material. If your retrieval layer has to connect to a website or customer portal, our web development team can scope that part. If you want AI search tools to find and cite guides like this one, our SEO services cover that work. You can also read more on the NK Marketing Solutions blog.
Frequently asked questions
What are the 3 pillars of AI platform architecture?
Data and Context (what the system knows), Intelligence and Reasoning (how it plans and decides), and Execution and Governance (what it may do and how you check it). All three need a similar standard before production.
Why does the weakest pillar matter more than the average?|
Failures do not average out. Excellent reasoning on stale data still gives wrong answers, and excellent data without controls still allows harmful actions. Readiness equals your lowest score.
What is the difference between MCP and A2A?
MCP connects an agent to tools and data. A2A connects agents to each other. Anthropic created MCP, Google created A2A, and the Linux Foundation’s Agentic AI Foundation now hosts both. Many agent systems use both.
What is permission aware retrieval?
The search step returns only the documents that the asking user may see, because the system applies that user’s access rights before it ranks results. Without it, an assistant can reveal restricted content.
Do I need to comply with the EU AI Act if I am not based in Europe?
Possibly. If your AI system affects people in the EU, obligations can apply wherever your company sits. Article 50 transparency duties have applied since August 2, 2026. Ask counsel about your specific case.
Is ISO/IEC 42001 required?
No, it is voluntary. Accredited bodies can certify it, and buyers increasingly ask for it in vendor reviews. The NIST AI RMF is also voluntary, and nobody can certify against it.
Do four or five pillars make a platform better?
Only when each extra pillar matches a constraint you really face, such as cost and latency at scale or a real security threat model. Many teams split out infrastructure or security later. Three is the minimum useful structure.