Also on Medium ↗, with a short post on LinkedIn ↗
Around the year 110, the emperor Trajan sent Pliny the Younger to govern Bithynia, a province on the southern shore of the Black Sea whose cities had run their finances into the ground. A letter from Bithynia took weeks to reach Rome and the answer took weeks more, so Pliny travelled with the emperor's written instructions, the mandata, and wrote home whenever they ran out. More than a hundred letters between the two men survive, Trajan's replies included, and they read like the operating log of a delegation program.
When fire gutted Nicomedia, Pliny asked permission to form a fire brigade of no more than 150 men. Trajan refused, because associations in that province had a habit of turning into political clubs. Later Pliny asked what to do about a cracked and unfinished theatre at Nicaea, and Trajan sent the decision back: Pliny was the best judge, and it would be enough to be told which plan he adopted.
Our word mandate comes from those instructions, by way of the Latin mandare, usually traced to putting something into another person's hand. Set Trajan's system beside an enterprise AI program and you can match it line for line. The mandata work as a delegation contract and the provincial law as a constraint model, while the letters and the audited city accounts form an audit trail and the questions sent to Rome trace an escalation path.
Enterprises have started hiring a new kind of operator. AI agents decide and act inside systems that move money and sign off on commitments, they answer in milliseconds, and plenty of organizations govern them more loosely than Trajan governed a province by post.
Building agents has turned into engineering work of its own, split into thirteen disciplines by my count. The market has settled on names for seven of them, all concerned with what an agent can do. The remaining six decide whether anyone can trust it, and scaled programs stall there, mostly because nobody owns them.
Engineering split once before, over 66 years
London got its Institution of Civil Engineers in 1818. American civil engineers organized in 1852, the mechanical engineers broke away in 1880 and the electrical engineers followed four years later. Each split came once a technology such as steam or electricity had grown too consequential to leave to the craftsmen next door, and the whole sequence took 66 years.
AI engineering is running the same split about eighteen times faster. Prompt engineering became a craft in the months after ChatGPT launched at the end of 2022. Context engineering got its name in June 2025, when Shopify's Tobi Lütke and Andrej Karpathy both argued it fit the work better, and Anthropic shipped Agent Skills that October. Harness engineering arrived in February 2026 through an OpenAI essay, Mitchell Hashimoto's advice to "engineer the harness" and Birgitta Böckeler's analysis on martinfowler.com, and a month later LangChain boiled the idea down to Agent = Model + Harness. By mid-2026 people were writing about agentic memory and loop engineering, and in August the AI Daily Brief devoted an episode to graph engineering, the seventh new vocabulary in 3.7 years.
Token-maxxing, the habit of treating token consumption as a status metric with company leaderboards to match, rose and collapsed within a few months, and it failed what I call the double-click test. Unpack a term that deserves to last and you find mechanisms and failure modes underneath. Several of the surviving terms come from vendors selling into the category they named, which deserves a raised eyebrow, and each has an ancestor. Context engineering descends from information retrieval, harness engineering from control theory, memory engineering from knowledge management and graph engineering from workflow orchestration.
The names still matter, because a name decides what gets a budget and an owner. Nineteenth-century engineers built curricula and licensing alongside their new titles, and AI's disciplines are arriving before any of that exists. Until the institutions catch up, every enterprise has to build its own.
Thirteen disciplines in four layers, all reporting to one control plane
Seven buzzwords on a list tell you little until you can see what depends on what, so I sort the thirteen into four layers. The bottom one deals with a single agent: its instructions, what it sees and remembers, the expertise it carries and the environment it runs in. One level up sits the work, meaning how an agent keeps going until a task is done and how a group of agents coordinates. The third layer governs autonomy and covers evaluation, delegation, constraint, recovery and the economics of an agent's thinking. At the top is the operating model for a workforce that is part human.
Every discipline reports into a control plane, the layer that knows which agents exist, what each may touch and spend, and what happened when something went wrong.
The layers describe dependency, and a real program works on all four at once. Weakness lower down shows up as a mysterious failure higher up. A team of agents that keeps contradicting itself traces back to context nobody curated, and a governance crisis traces back to a delegation nobody wrote down.
Take an agent that handles customer refunds. Its brief tells it when to approve and when to hand a case to a person, with an example of each (prompt), and it sees the order and the refund policy and nothing else (context). It remembers past disputes with the same customer along with where each memory came from (memory). Before paying out it runs the checks an experienced colleague would run, such as the carrier scan and the fraud score (skill), and every action it takes lands in a log (harness). A failed lookup gets two retries before the case goes to a person (loop), and anything that smells of fraud passes to a separate fraud agent (graph).
Leaving that agent running overnight takes a second set of commitments. Somebody re-scores two hundred of its past cases every week against human decisions (evaluation). It may refund up to $250 on its own, under authority that gets reviewed every quarter and can be revoked at once (delegation). The payment system refuses any refund to a card other than the one charged (constraint), and when that system goes down the cases wait in a queue with none lost (recovery). Routine cases run on a small model and anything above $1,000 goes to a larger one (economics), while a named process owner answers for the results (organization).
The capability layers have names and most of the attention
Layer one: the agent
Prompt engineering has shrunk from the whole system to one component, and the shrinking made it more important. Every skill file and every delegation contract contains an instruction that has to be unambiguous and testable, so the craft has moved from clever chat openers to specification writing. A good instruction for an autonomous step reads like a statement of work for a contractor you will never meet. Left alone, prompts suffer from instruction rot, as months of patches pile exceptions on top of each other until nobody can predict what the agent will do.
Context engineering decides what the model sees before each step. If the model is a processor, the context window is its working memory, and good memory management has always meant loading the right working set. In 2025 Chroma tested 18 frontier models and found that every one grew less reliable as its input grew, long before the window was full, which turned curation into a discipline. The failure here is what I call the omnibus window, where everything gets pasted in on the theory that more context means more safety.
Memory engineering earns its own seat because it covers what the system knows across months, a different problem from what the agent sees in the moment. Engineered memory keeps what expensive reasoning produced and serves it cheaply afterwards, with observations filed apart from decisions. Cost per task falls as usage grows, which makes memory the first asset in the agent stack that compounds. Its failure mode is an attic of unpruned entries handing out stale answers with full confidence, and a stale answer does more damage than an empty memory, which at least forces the agent to reason afresh.
Skill engineering packages expertise. A tool lets an agent query invoice history, and a skill tells it how an experienced collector uses that query: check the price against the contract, flag duplicates before issuing a credit, never read intent into a late payment and escalate anything above $10,000. Organizations run on sentences of the form when X happens, experience checks Y before Z, and skills make those sentences machine-readable. Unmanaged, they sprawl into hundreds of overlapping files with no owner, and the cure looks like a library with a librarian in charge.
Harness engineering covers everything wrapped around the model, from instructions and tools to permissions, tests and logs. Guides shape behavior before the agent acts and sensors check the work afterwards. LangChain held its model fixed and lifted its coding agent from 52.8% to 66.5% on Terminal-Bench 2.0 by changing the harness alone. Can Bölük swapped a single editing tool and improved 14 of 16 models by an average of 15 points without retraining any of them. Much of the recent progress in agents comes from the engineering around the model.
Layer two: the work
Loop engineering moves iteration into the system. The agent plans and acts, checks its output against a definition of done, and tries again until the checks pass or the attempt budget runs out. Everything depends on that definition. An instruction like "keep improving the proposal" sends an agent round in circles. A good loop objective reads like a test suite: requirements covered, pricing reconciled, clauses checked, citations verified and a human sign-off before anything leaves the building. An agent can be trusted with as much autonomy as its definition of done can be checked.
Graph engineering coordinates many agents through two graphs with separate lifecycles. The org graph is standing structure, an org chart for agents in which each node carries its own mandate, tools, memory and budget. A work graph gets assembled for one objective and dissolved once that objective is met, and governing the two the same way produces paralysis or chaos depending on which way you get it wrong. The classic failure is a committee of agents, with nodes added because adding an agent is easier than deciding who is responsible, until latency and disagreement eat the value. People built committees like that for a century before agents came along.
The trust layer gets tested the day something breaks
In 1956 the British cybernetician W. Ross Ashby stated a law that belongs above the door of every agent program: only variety can absorb variety. A controller has to be at least as varied as the system it controls. A thermostat can run a room because a room does one thing, and a workforce of agents does thousands, producing probabilistic output and interacting with other agents in ways nobody designed.
Layer three is where an organization builds matching variety on the control side, through five disciplines that rarely appear on a conference stage. Skimp on them and Ashby collects the debt with interest. Gartner expects more than 40% of agentic AI projects to be cancelled by the end of 2027, and the reasons it gives, from runaway cost to risk controls too weak to trust, all live here.
Evaluation engineering takes on the hardest problem in autonomy, which is knowing the work is good without a person inspecting every output. It starts with a machine-readable definition of success. Deterministic checks go first wherever someone can write the rule, and AI judges handle the qualities that resist rules once they've been calibrated against human ratings. The field has a name for this work, "evals", and few organizations give it a budget line or a veto. I ran 216,000 jailbreak attempts across 108 guardrail configurations in my own lab, and the setups that looked robust under casual probing turned out to be a different list from the ones that survived a systematic attack. A test suite that has never blocked a release is a sign of evaluation theater.
Delegation engineering writes authority down. "You may recommend a refund" gives an agent nothing to work with. A contract reads differently: refunds under $250 at 98% confidence with fraud checks passing, authority reviewed quarterly and revocable at once. Scope, thresholds, escalation, duration and revocation belong in versioned mandates that an accountable owner signs and the harness enforces, well away from any policy PDF. This is where AI engineering meets the law of agency. In 2024 a Canadian tribunal held an airline liable for what its chatbot told a grieving customer and dismissed the argument that the bot answered for its own words. The natural design is graduated autonomy, moving from recommending to acting with approval, then to acting and reporting, and finally to acting alone, with each rung earned on evidence the way a new hire earns signing authority. Trajan put Pliny on the third rung when he asked only to hear which plan the governor had chosen.
Constraint engineering changes what gets specified. Traditional software scripts a path, and agents make that approach too expensive, so the specification describes the permissible world and the agent moves freely inside it. Typical rules keep data inside its region and hold payments above a threshold for approval. Hard rules compile into infrastructure while softer preferences ride in the agent's instructions, and someone has to write down which is which, because the worst incidents happen where a preference was mistaken for a wall. I call that failure the paper fence: boundaries that exist in documents and nowhere in the running system. The craft borrows its habits from safety engineering.
Recovery engineering designs for the bad day, when a system vanishes halfway through a task or a payment succeeds while its confirmation fails. The toolkit exists, from compensating actions for every consequential step to kill switches that work, quarantine for agents behaving oddly and a fallback to plain rules when the model is unavailable. Rehearsal is the step that gets skipped. A workforce that has never had its model provider switched off in a drill will find out how it recovers in production, at the least convenient hour available.
Economic engineering puts a price on the thinking. The value and risk of a task set its intelligence budget. A $50 decision gets a small model and a single pass, and a $50 million decision justifies several models, independent verification, simulation and senior review. Matching the two takes metering per agent and per outcome, with routing policies reviewed the way procurement reviews a contract. IDC expects 70% of top AI-driven enterprises to route work dynamically across models by 2028. Cloud spending went through the same adolescence before FinOps arrived, and agents spend faster because they don't wait to be asked.
The operating model trails behind, and value collects in the control plane
Layer four: the enterprise
Organizational engineering is the least developed part of this map, because it is the hardest and demos are easier to build. The open questions are plain enough to write down: which decisions move to agents, how span of control works for four people and forty agents, where accountability sits when a work graph spanning departments misfires and what happens to careers when the junior work that trains every profession runs on the org graph.
Some contours are visible. Process owners turn into graph owners and carry more responsibility than before. New roles are hardening, and each one renovates an existing craft: harness engineers come out of platform engineering, skill librarians out of knowledge management, evaluation leads out of QA and mandate owners out of risk and compliance, with agent economists emerging from FinOps. Audit picks up a technical arm that reads evidence trails the way auditors read ledgers.
I hold my answers loosely on the rest. Nobody knows the stable ratio of people to agents in a given function or how often mandates should be renegotiated as models improve, and performance reviews will need a new yardstick once a person's contribution is measured in judgment density.
The control plane
Past a few dozen agents, someone has to decide every day who may create an agent, what it may see and spend, who overrides whom and how anyone reconstructs why something happened. The AI control plane makes those calls. It registers every agent, skill, tool and mandate, holds constraints and mandates as code, keeps the evidence, meters the cost and runs each agent's lifecycle from creation to retirement. Risk, finance, security and the business look in from one side, and the engineered systems plug in from the other.
My claim is that durable enterprise AI value concentrates in the plane. Models keep converging and getting cheaper, and harnesses and skills are designed to move between them. The plane fills up with mandates, constraints, evidence and cost history that belong to one enterprise, and that record compounds without porting anywhere else.
The last platform era gave this position to identity and the directory, the system that knew who everyone was and what they could touch. This era's directory lists agents next to people and puts a price on what they think.
How the taxonomy holds up
Software engineers will say this is their discipline with new labels. The skeleton is familiar, and the material behaves differently, because software assumes determinism and agents are probabilistic components whose capability shifts with every model release. Reinforced concrete needed its own engineering even though iron and concrete had both been around for centuries.
Process specialists will see business process management in a new costume. BPM put the intelligence in the process and treated each step as plumbing. With agents the intelligence sits in the steps, so the process turns into the constraint around them, and running agents through the BPM playbook teaches that lesson in production.
Skeptics will call the vocabulary marketing, and sometimes they are right, which is what the double-click test is for. Thirteen will not survive either. The names will consolidate as the work compounds, the same way bridge inspectors kept inspecting bridges after their job titles changed, so it makes sense to plan the capability and hold the labels loosely.
Security people will ask where their discipline went, and they have a point. Security runs through all thirteen disciplines the way safety runs through civil engineering, and agents raise the stakes because they act on what they read. Prompt injection, meaning hostile instructions hidden in an email or a web page, tops OWASP's 2025 list of risks for LLM applications. The defenses sit in different layers. Context engineering treats retrieved content as data, the harness and the mandate keep permissions narrow and credentials short-lived, and constraints stop data from leaving where it shouldn't. The control plane gives every agent an identity and an owner, evaluation red-teams the arrangement before an attacker does, and recovery holds the kill switch.
Two candidates were folded into existing disciplines: observability became the sensor half of the harness and the evidence function of the control plane, and identity became the substrate of delegation and constraint. Every discipline is anchored to an artifact a team can build without outside help, and wherever a distinction changes no decision it should collapse into its neighbor.
A map earns its keep by changing routes
Start with a diagnostic that takes an afternoon. Go through the thirteen disciplines and check whether each has a named owner and a working artifact. The gaps form the roadmap, and I expect most of them to sit in layer three.
Then sequence by evidence and promote autonomy the way you promote people. Pick processes whose outcomes you can check and write the definition of done before you build the agent. Let the agent recommend while the evaluation suite collects evidence, and move it up a rung once the evidence clears the bar. Failing programs run the same stack in reverse, granting autonomy on the strength of a demo and bolting evaluation on after the first incident, which is the expensive direction.
Ninety days is enough to earn the first promotion. In the first month, list every agent in use with its owner and monthly spend, and run the diagnostic to pick your two processes. The second month goes to writing definitions of done and building evaluation suites from past cases and known incidents. In the third, promote one agent one rung on evidence and rehearse a failure by switching off the model provider for an afternoon, with a mandate registry and per-outcome metering in place before either. Staff the work by renovating roles you already have, since strong platform, QA, risk and FinOps people pick up the missing method faster than the hiring market can deliver new ones.
Trajan never saw most of the decisions Pliny made in his name. He governed them anyway, through instructions and provincial law and a steady traffic of letters, because when an operator sits beyond your reach the mandate does the managing. Pliny's questions needed weeks to reach Rome. Your agents answer before you finish typing the question, and the mandates they work under deserve at least the care Trajan put into his.
Sources
- Gartner, Over 40% of agentic AI projects will be canceled by end of 2027, 25 June 2025
- IDC FutureScape 2026 AI predictions, 70% of top AI-driven enterprises routing across models by 2028, November 2025
- Chroma Research, Context Rot, 2025 (18 models)
- LangChain, Improving Deep Agents with harness engineering, 17 February 2026
- LangChain, The Anatomy of an Agent Harness, 10 March 2026
- Can Bölük, The Harness Problem, 12 February 2026
- Birgitta Böckeler, Harness Engineering, martinfowler.com, 17 February 2026
- InfoQ, OpenAI's harness engineering, February 2026
- LeadDev, The tokenmaxxing hype didn't last long, 2026
- The AI Daily Brief, What the Heck is Graph Engineering?, 10 August 2026
- OWASP, Top 10 for LLM Applications, 2025 (LLM01: prompt injection)
- British Columbia Civil Resolution Tribunal, decision 2024 BCCRT 149, February 2024
- W. Ross Ashby, An Introduction to Cybernetics, 1956
- Pliny the Younger, Letters, Book 10, correspondence with Trajan, c. 109 to 111 AD (Fordham Ancient History Sourcebook; on the Nicomedia fire brigade, Copenhagen Associations database)
Also on Medium ↗, with a short post on LinkedIn ↗