Enterprise Agentic Delivery Lifecycle
A reference architecture for governing agents that act: identity, MCP tools, approval gates, and a risk matrix. Built from work on Foreman, RelAI, and public-sector SaaS.
What this is
This is a public reference architecture, not a claim that I run an enterprise agent platform today. I wrote it because the useful question is no longer “can we call an LLM?” It is “how does an organization let agents act without turning every team into a shadow-IT risk?”
Two projects I have already built sit on this map. Foreman is authorized-to-act: local reasoning, Token Vault, step-up for high-consequence phrases. RelAI is agent trust: a registry you can query, pause, or slash. The day job at Tyler is the regulated SaaS backdrop — permissions, search, CI/CD, production support.
ADLC stages
Treat an agent the way you already treat a service that can change production. The stages are the same. The new part is tool access and autonomy.
| Design | Purpose, data class, tools, human gate, owner. If you cannot name the blast radius, it does not get a skill. |
|---|---|
| Build | Versioned prompts, MCP tool schemas, eval fixtures. No standing production secrets in the agent. |
| Test | Prompt injection, tool-abuse cases, permission misses, cost ceilings. Red-team the tools, not just the prose. |
| Approve | Risk-tiered review. Low-risk read tools move fast. Refunds, deploys, IAM, and secrets do not. |
| Deploy | Allowlists, quotas, environment isolation. Rollback is a prompt and skill version, not a hope. |
| Monitor | Trace every tool call: actor, args, outcome, latency, token cost. Incident response has a name on it. |
| Retire | Expire unused skills. Revoke tokens. Keep the audit trail. |
Model and MCP gateway
I would not let every team pin their own model and their own secret. A small gateway keeps the control plane in one place:
- Identity: SSO / OIDC into the agent. Downstream tools get short-lived delegated tokens (Token Vault), not a shared service account.
- Routing: model choice by task and data class. Quotas per team and use case so cost is visible.
- MCP tools: typed schemas, allowlists, and human-in- the-loop for anything that moves money, deploys, or reads secrets.
- Audit: actor, tool, arguments, outcome, cost. If you cannot reconstruct an action, it should not have run.
- Registry: agents, skills, and prompts with owner, version, and certification state. RelAI is the trust-shaped version of this idea.
Risk matrix
Autonomy is not binary. Score the action: how free is the agent, how sensitive is the data, how expensive is a mistake.
| Action | Tier | Gate |
|---|---|---|
| Read-only RAG / internal search | Low | Allowlist + logging |
| Calendar / Slack as the user | Medium | Scoped token, short TTL, audit |
| Deploy, refund, payout | High | Human approve, dual control |
| Secrets or IAM change | High | Deny by default, break-glass only |
Foreman’s step-up on “change order” and “overtime” is the medium/high line in miniature. You do not need a 40-page policy to start. You need one place that can say no, and a log when it says yes.
Cost, without a science project
Token spend is a platform metric, not a surprise invoice. Even a stub dashboard is enough on day one: cost per agent, per team, per use case; cache and cheaper models for low-tier work; hard quotas on high-tier tools. If a skill cannot show value against its spend, retire it.
How I would roll this out
- Inventory what is already in use, including shadow Copilot / Claude Code / Codex.
- Pick two or three pilot teams. Publish the risk matrix. Do not boil the ocean.
- Stand up the gateway and one certified MCP server for a boring, useful tool. Measure cycle time, incidents, and cost.
- Enable, don’t bottleneck: light review for low risk, strict review for money and production change.
The operating sequence is inventory, then a small platform spine, then adoption with metrics. The code you can click today is Foreman and RelAI. The day job is still shipping SaaS that government agencies run in production.