The Deep Pattern Catalogue
61 composable patterns, each treated as a reusable primitive: context, forces, solution, applicability, anti-patterns, consequences, and the standards it helps satisfy.
Listen to this page
Ninety-One Patterns Powering Agentic AI
This page is the full encyclopedia for 61 AI agent patterns. Unlike the quicker Field Guide, every pattern here gets the complete picture: why it exists, what problems it solves, how to build it, when not to use it, and which laws or safety rules it helps you follow.
This level of detail matters most when you are actually building or checking an AI agent for real use, especially one that touches people's money, data, or safety — that is when guesswork is not good enough. Use the filters below to narrow all 61 patterns down by principle or tier, search by keyword, or just click any card to open its full page.
61 patterns
Autonomy Tier Classification
Classify every agent by the reversibility and blast radius of the actions it may take, and bound its permissions accordingly.
Action Envelope Enforcement
Enforce, at runtime, the tier-declared boundary of what the agent is permitted to do — before the action reaches the target system.
Declared Purpose & Out-of-Scope Register
Every agent has a written, versioned statement of its intended purpose, the user populations it serves, and the actions it must never take.
Goal Drift Detection
Detect at runtime when the agent is pursuing a goal that has silently diverged from its declared purpose.
Policy-as-Code for Agents
Express organisational policy as executable, versioned, tested code that the runtime enforces — not prose in a governance PDF.
Decision Record & Audit Ledger
For every material agent decision, emit an immutable, structured record sufficient to reconstruct the reasoning after the fact.
Structured Perception Interface
Transform raw environmental input into structured representations before the reasoning layer sees them.
Act–Observe Closure
Every action produces a structured observation that closes the loop back to the agent's reasoning — not a fire-and-forget invocation.
Observation Normalisation
Normalise observations from heterogeneous tools into a uniform shape the agent can reason over without tool-specific logic.
ReAct (Reason–Act Interleaving)
Externalise the agent's reasoning by alternating visible thought steps with tool actions, so each decision leaves an inspectable trace.
Plan-and-Execute (ReWOO)
Generate a complete plan up front, then execute steps, rather than deciding the next action after each observation.
Reflection (Self-Critique)
After producing an output, the agent explicitly critiques its own work against defined criteria and revises before returning.
Short-Term Working Memory
Hold the current task's context — the active turn, recent observations, scratch reasoning — in a bounded window that is cheap to read and replace.
Long-Term Episodic & Semantic Memory
Persist what the agent learned from past tasks in stratified stores: episodic (what happened), semantic (what is true), procedural (how to do things).
Memory Poisoning Defence
Prevent adversarial or low-quality inputs from corrupting long-term memory where they later influence reasoning.
Typed Tool Catalog
Every tool the agent can call has a strict, versioned schema for inputs and outputs. No free-form calls.
Tool-Catalog Indexing (Retrieval over Tools)
When the tool catalog is large, retrieve a small, relevant subset before presenting to the agent — do not dump the full catalog into every prompt.
Sandboxed Tool Execution
Execute tool calls inside an isolation boundary so that misbehaviour, side effects, and errors are contained.
Tool Whitelisting & Credential Scoping
An agent may only invoke explicitly whitelisted tools, and each tool holds only the credentials it needs for its declared scope.
Hierarchical Task Decomposition
Break a complex goal into a hierarchy of sub-tasks that individually fit within the agent's reliable reasoning horizon.
Tree-of-Thoughts / Multi-Path Exploration
For problems with branching decisions, explore multiple reasoning paths and evaluate — do not commit to the first viable path.
Task Prioritisation & Budget Control
Explicitly score, order, and budget sub-tasks so the agent spends resources where they produce the most value.
Retrieval-Augmented Generation
Ground the agent's reasoning in retrieved, cited sources rather than parametric memory — especially for domain-specific or time-sensitive facts.
Citation-Grounded Output
Every factual claim in the agent's output is tied to a retrieved source, and ungrounded claims are flagged or removed.
Agentic RAG
Treat retrieval itself as an agent loop — the agent decides what to retrieve, critiques results, and re-queries — rather than a single upfront fetch.
Standardised Inter-Agent Protocol
Use open, interoperable protocols (Agent-to-Agent / A2A, Model Context Protocol / MCP) for communication between agents and between agents and tools — not bespoke glue.
Agent-as-Tool (Sub-Agent Invocation)
Expose specialised agents to other agents as tools — with the same typed-contract discipline as any other tool.
Prompt Chaining (Sequential Workflow)
Decompose a task into a fixed sequence of LLM calls, each operating on the previous output, with programmatic gates between steps.
Routing (Classification-Dispatch)
Classify the input first, then dispatch to a specialist prompt or agent — rather than asking one generalist to handle every case.
Parallelisation (Sectioning & Voting)
Run multiple LLM calls concurrently — either on independent sub-tasks (sectioning) or the same task multiple times (voting) — then aggregate.
Orchestrator–Workers
A central orchestrator agent plans and delegates to specialised worker agents (or tools), then composes their outputs.
Evaluator–Optimiser Loop
Separate the generator from the evaluator: one agent produces, another critiques against criteria, and the loop iterates until quality is met.
Hierarchical (Supervisor) Topology
Organise multi-agent systems as hierarchies — supervisors delegate to sub-supervisors or specialists — mirroring effective human organisational structures.
Swarm / Decentralised Topology
Let autonomous peer agents communicate directly, negotiate roles dynamically, and solve problems through emergent coordination — when the problem structure favours it.
Approval Gate for Irreversible Actions
Require explicit human approval before the agent executes actions that are irreversible, high-value, or externally visible.
Automation Bias Countermeasures
Design the HITL surface to resist automation bias — the human tendency to over-trust an automated system that has performed well historically.
Escalation & Handoff to Human
When the agent detects it is out of scope, uncertain, or blocked, it hands off to a human with a structured briefing — not a dead-end apology.
Span-Level Tracing of Agent Execution
Capture every reasoning step, tool call, and decision as a span in a distributed trace — not just the final output.
Live Telemetry & Anomaly Detection
Detect abnormal agent behaviour at runtime — not in post-hoc audits — and surface alerts to the right operator.
Lineage & Explainability Artefacts
For every output consumed downstream, produce a lineage artefact: what was retrieved, what tools ran, which model version, what policies evaluated.
Prompt Injection Defence (Layered)
Defend against prompt injection — direct and indirect — with layered controls at input, context-assembly, and output boundaries.
Output Filtering & PII Redaction
Before an agent's output leaves the trust boundary, scan and redact for sensitive data, policy violations, and disallowed content.
Topic Confinement
Restrict the agent's conversational and functional scope to its declared domain — a banking agent refuses to write code; a code assistant refuses to give medical advice.
Kill-Switch & Emergency Stop
Provide a reliable, immediate mechanism to halt an agent or fleet of agents — without graceful shutdown dependencies.
Offline Evaluation Suite (Golden Set)
Maintain a versioned suite of tests — prompts, expected behaviours, edge cases, adversarial inputs — that the agent must pass before any deployment.
Red-Teaming & Adversarial Evaluation
Actively attack the agent before deployment — injection, jailbreak, manipulation, data exfiltration — and remediate what is found.
Human Spot-Check Sampling
In addition to automated evaluation, sample a small fraction of live agent outputs for human review on a rolling basis.
Bounded Iteration & Budget Caps
Every agent loop has explicit limits — max iterations, max tokens, max wall-time, max spend — beyond which it stops and escalates.
Retry with Backoff & Circuit Breaking
Handle transient tool failures with bounded retries and backoff; break the circuit when a tool is persistently unhealthy.
Graceful Degradation Path
When the primary pathway fails, the agent falls back to a reduced-capability alternative rather than returning nothing.
Unique Agent Identity
Every agent has a unique, verifiable identity distinct from its developer, its user, and its supervising agents — used for authentication, authorisation, and audit.
Least-Privilege Scoping
Each agent holds only the permissions required for its declared tasks — nothing more.
Agent Sprawl & Shadow-Agent Detection
Maintain a canonical inventory of all deployed agents and detect shadow, orphaned, or duplicate agents in the portfolio.
Safe Decommissioning
Retire agents in a controlled way that preserves audit trail, revokes permissions, and handles downstream dependencies.
User-Intent Clarification
When a user's request is ambiguous or underspecified, the agent asks a focused clarifying question before acting — rather than guessing.
Reasoning-Chain Inspection
Make the agent's reasoning trace inspectable by humans — reviewers, auditors, and end users — not just by machines.
Threat Modelling at Design Time
Before the agent is built, enumerate the attacker, attack surface, and likely attack paths — and design defences accordingly.
Retrieval Ranking & Relevance Control
Rank retrieved memories and context by relevance and freshness before presenting to the reasoner — not just top-K by cosine similarity.
Tool-Output Validation
Validate tool outputs against schema and semantic expectations before the agent acts on them — tools can return malformed, stale, or adversarial data.
Online A/B & Shadow Evaluation
Compare agent variants in production using A/B, shadow, or canary deployments with statistical rigour — not anecdotes or vibe-checks.
Delegation-Chain Tracking
When an agent invokes another agent, maintain an auditable chain-of-delegation that preserves the original principal and intermediate authority.