Two questions, not one blueprint
Most writing about where AI agent architecture ends up by 2035 is a single-track story dressed as engineering foresight. One version has the field converging quickly on a handful of textbook patterns — a generalist agent here, an orchestrator delegating to specialist workers there — the way earlier software eras converged on structured programming and then on service-oriented architecture. Another has the field staying as fragmented as it is today, with every serious team running its own bespoke stack of prompts, tools, and control flow, because agent tasks are too heterogeneous for one shape to fit them all. Both are coherent. Neither is more than a preference dressed as a forecast, because the evidence available in August 2026 does not discriminate between them.
The honest alternative is scenario analysis, with a specific discipline: name the smallest number of drivers that are both consequential and genuinely uncertain, cross them, state the mechanism behind each resulting cell, and commit in advance to the observations that would identify which cell the field is in and the observations that would rule a cell out. Done properly it produces no favourite — that is the intended output, not a failure to reach one.
This article uses two axes. Axis A asks whether AI agent architecture converges on a small number of standardized reference patterns for how an agent plans, delegates, and calls tools, or continues to fragment across many incompatible frameworks and topologies as task diversity and capability both keep growing. Axis B asks whether agent reliability becomes a formally specified, certifiable property — backed by a trusted assurance-level regime the way adjacent safety-critical software already has one — or remains fundamentally empirical: measured through benchmarks, red-teaming, and best-effort human review, without a certifiable guarantee behind any single deployment. Two frequently asked related questions, whether multi-agent systems become the default topology and whether human-approval checkpoints become automated and statistical rather than a hard requirement, are treated below as consequences of these two axes rather than independent drivers, a reduction argued for explicitly rather than assumed.
The documented present
Fact. A real, if partial, attempt at a shared pattern vocabulary already exists, from a single vendor rather than the industry. Anthropic’s engineering guidance distinguishes workflows, where code predetermines the path through model and tool calls, from agents, where the model dynamically directs its own process, and names five recurring workflow patterns — prompt chaining, routing, parallelization, orchestrator-workers, and evaluator-optimizer — before describing open-ended agents as a further, riskier step. The same guidance recommends starting with the simplest pattern that works, because added autonomy trades latency and cost for flexibility and creates room for compounding error [1]. This is evidence that a small taxonomy is possible and useful. It is not evidence that the industry has adopted it as a standard; it is one influential lab’s own house vocabulary.
Fact. Independent multi-agent frameworks already implement one of those named shapes — orchestrator-workers — in mutually incompatible ways. AutoGen, published by a Microsoft-led team, lets developers build applications from customizable, conversable agents that coordinate through natural-language and code-based conversation, combining LLMs, human input, and tools in configurable patterns [3]. AutoGen’s own conversation-centric mechanism for coordinating agents is a different design decision from Anthropic’s orchestrator-worker description, even though both are describable, at a distance, as “one agent delegating to several.” Convergence on a name is not the same as convergence on an implementation, and this gap between shared vocabulary and incompatible mechanism recurs throughout the evidence below.
Fact. The research literature has already produced synthesis attempts broad enough to imply the opposite of convergence. A widely cited survey of LLM-based autonomous agents proposes a unified construction framework spanning perception, memory, planning, and action components, explicitly built to encompass “a majority of the previous work” because so many differently named, differently structured systems had already been published by the time the survey was written [2]. A synthesis paper of that scope is itself evidence for fragmentation at the implementation layer: it exists because no single architecture had already absorbed the others, and abstracting a unifying framework after the fact is a different achievement from the field choosing one architecture going forward.
Fact. Where standardization has happened concretely, it has happened at the interface layer, not the decision-loop layer. The Model Context Protocol defines how hosts, clients, and servers exchange context, resources, prompts, and tools over JSON-RPC, giving agent applications a shared way to discover and call external capabilities regardless of which model or orchestration logic sits behind the call [4]. This is a genuine, live standardization signal. It says nothing about whether the reasoning and delegation loop that decides which tool to call, and when, converges on a shared shape — the question Axis A is actually asking.
Fact. Formal verification of agent behavior exists, but as a narrow, per-domain demonstration rather than a general practice. VeriGuard synthesizes a behavioral policy for an agent, formally verifies that policy against a specification through testing and proof together, and then runs as a runtime monitor that checks each proposed action against the pre-verified policy before allowing it to execute [5]. The mechanism is real and the guarantee it produces is a genuine formal one, not a benchmark score. It is also scoped to whatever policy and specification were built for that domain; nothing in the published method claims a general, domain-independent certification of an agent’s overall reliability.
Fact. Certifiable, levels-based regimes for safety-relevant software already exist in adjacent engineering fields, established well before agents, and give Axis B’s certified branch a concrete precedent rather than a hypothetical one. DO-178C, jointly maintained by RTCA and EUROCAE, is the standard aviation authorities including the FAA and EASA use to approve commercial airborne software, defining five Design Assurance Levels from A (catastrophic failure consequence) down to E (no safety effect), each specifying a different number of verification objectives a development process must satisfy [6]. IEC 61508 plays the equivalent role across process, machinery, rail, and other industries through four Safety Integrity Levels, and has already spawned sector-specific derivatives — ISO 26262 for automotive, IEC 61511 for process industries — rather than remaining one document applied identically everywhere [7]. Neither standard was built for AI agents. Both establish that a levels-based, third-party-certifiable regime is a known engineering solution once software reliability becomes safety-critical, and that such regimes tend to specialize by domain rather than unify across all of them.
Fact. AI-specific governance infrastructure already exists, but splits between a certifiable management-process standard and a voluntary framework, and neither yet certifies an agent’s decision-time behavior the way DO-178C certifies avionics code. ISO/IEC 42001, published in December 2023, is described by outside auditors as the first AI management-system standard, specifying how an organization establishes, implements, and continually improves the processes it uses to manage AI risk and opportunity; it is explicitly certifiable through accredited third-party audit [8]. NIST’s AI Risk Management Framework, published in January 2023, is deliberately voluntary and organized around four functions — govern, map, measure, manage — offered as a flexible resource rather than a certification target [9]. Both operate at the level of organizational process. Neither issues an assurance level for a specific agent’s specific decision loop the way an aviation Design Assurance Level does for a specific piece of flight software.
Fact. Where reliability is measured today, it is measured empirically, and the empirical picture is not yet a reassuring one. Tau-bench, evaluating agents against realistic tool-use conversations with domain policies to follow, found that leading function-calling agents succeeded on fewer than half of tasks and grew markedly less consistent across repeated trials, motivating the paper’s own reliability metric built specifically because single-run pass rates were misleading [10]. METR’s long-horizon study defines a 50%-task-completion time horizon and reports it roughly doubling every seven months across the tested historical series, a genuine capability trend stated by its own authors as uncertain in how far it generalizes beyond the studied task distribution [11]. Microsoft’s AI Red Team has now published two annual revisions of its taxonomy of failure modes in agentic systems; the second, released in June 2026 after twelve months of red-teaming deployed agentic systems, adds seven further failure categories rather than closing the space the first revision had already mapped [12]. All three are evidence that the field’s current default reliability practice is benchmark-and-red-team, not certification, and that the practice keeps discovering new territory rather than converging toward a settled specification.
Fact. Current binding regulation that touches agent autonomy directly still codifies the human-hard-requirement end of the approval question, not the automated-statistical end. Article 14 of the EU AI Act requires high-risk AI systems to be built so natural persons can effectively oversee them — understand their outputs, detect anomalies, intervene, and halt them — and requires deployers to assign that oversight to competent, authorized people, with an even stricter dual-verification requirement for certain biometric identification uses [13]. Nothing in currently binding law lets a certified statistical error bound substitute for that human role; the requirement is procedural and structural, not a risk calculation an operator can satisfy by other means.
Fact. Market experience with agent deployment already shows a gap between investment and reliable operation wide enough to be a baseline fact for both axes, not just a hype-cycle aside. Gartner’s June 2025 prediction, based on a poll of more than 3,400 organizations, put the share of agentic AI projects that will be canceled by the end of 2027 above 40%, citing escalating cost, unclear business value, and inadequate risk controls, alongside its estimate that only a small fraction of vendors marketing “agentic” products offer genuinely agentic capability [14]. This is a market-adoption fact, not an architecture fact, but it constrains both axes: neither convergence on a reference pattern nor a move toward certified reliability can be read off benchmark curves alone while this much of current deployment is failing for organizational, not architectural, reasons.
Why these two axes, and why multi-agent-by-default and automated approval are not a third and fourth
An axis earns inclusion by being both consequential and genuinely uncertain. Axis A is consequential because its two ends imply different economics for the whole field: convergence means hiring, tooling, debugging practice, and interoperability standards can all be built once and reused, the way MCP already lets any conforming agent reach any conforming tool regardless of orchestration logic [4]; fragmentation means every organization keeps paying an integration and training tax indefinitely. It is uncertain because the evidence points both ways inside the same body of work: Anthropic’s five-pattern vocabulary and the LLM-agent survey’s unifying framework both show real appetite for a shared taxonomy [1, 2], while AutoGen’s incompatible implementation of a topology that vocabulary already names shows that naming something is not the same as standardizing it [3].
Axis B is consequential because it decides whether an organization’s claim that its agent is reliable can be checked by anyone other than the organization making it — the entire distinction between DO-178C’s third-party Design Assurance Levels and IEC 61508’s third-party Safety Integrity Levels on one side [6, 7], and a vendor’s own benchmark chart on the other. It is uncertain because the evidence points both ways in the same period: VeriGuard demonstrates that formal, checkable guarantees for agent actions are technically possible today, not merely aspirational [5], while tau-bench’s sub-50%-success finding and Microsoft’s still-expanding failure taxonomy show the field’s actual current practice has not moved past statistical measurement even for its most scrutinized systems [10, 12].
Whether multi-agent systems become the default topology is not a third axis; it is Axis A asked about one specific candidate pattern rather than the pattern space as a whole. If the field converges (Axis A’s standardizing end), the open question is which shape it converges on — a single capable generalist agent with tools, which is what Anthropic’s own guidance recommends starting from before reaching for anything more elaborate [1], or a delegating cluster of the kind AutoGen and Anthropic’s own orchestrator-worker pattern both describe [3, 1]. If the field fragments (Axis A’s other end), single-agent and multi-agent approaches simply keep coexisting by task, and “multi-agent becomes the default” is not even a coherent claim to evaluate, because there is no default. Treating it as independent would mean re-deriving Axis A under a narrower name.
Whether human-approval checkpoints become automated and statistical is, likewise, mostly a readout of Axis B rather than a genuinely separate question. A useful way to see the dependency is to write the automation decision as a threshold rule. Let
where
Four scenarios toward 2035
Crossing the two axes gives four cells. None is named as the likely outcome; each is named for the instrument in this article’s own room that best captures its logic.
Scenario one: The Reference Stack — patterns converge, reliability is certified
Mechanism. A small vocabulary of topologies — plausibly some descendant of Anthropic’s five workflow patterns plus open-ended agents [1], reinforced by survey-literature synthesis converging on a shared construction framework [2] and by interface-level standardization through MCP removing one whole axis of variation between frameworks [4] — stabilizes as the field’s default working vocabulary. In parallel, formal-verification techniques generalize from single-domain demonstrations like VeriGuard [5] into routine tooling, and a certification apparatus purpose-built for agent decision loops emerges, drawing explicitly on the precedent of DO-178C’s and IEC 61508’s assurance-level structure [6, 7] and extending today’s process-level AI management standards, ISO/IEC 42001 and the NIST AI RMF, down to behavioral certification [8, 9].
Horizon. Recognizable convergence signals by 2029–2030; a stabilized reference stack with an attached certification regime plausible by 2035.
Assumptions. The field’s current pattern vocabulary proves sufficient for most production tasks, so inventing new topologies stops paying off relative to reusing known ones; a standards body or consortium is willing to fund and maintain decision-loop-specific certification rather than stopping at process-level standards.
Observable indicators. First, two or more major agent frameworks converge on describing their systems using the same small set of topology names, not just compatible tool interfaces. Second, a named certification or assurance-level scheme specific to agent decision loops, distinct from process-level standards like ISO/IEC 42001, is published and adopted by more than one vendor. Third, formal-verification methods in VeriGuard’s line of work are cited in production system documentation as a routine practice rather than a research demonstration.
Disconfirmation. Falsified if, by 2031, major frameworks still describe materially different core topologies with no shared vocabulary, or no decision-loop-specific certification scheme has been published by any standards body, as opposed to a process-level management standard.
Scenario two: The Common Dialect — patterns converge, reliability stays empirical
Mechanism. The same interoperability, hiring, and tooling pressures drive convergence on a shared topology vocabulary as in scenario one, but formal verification stays narrow because the cost of building a trusted specification for each new tool surface and task domain keeps outrunning the rate at which any certifying body could standardize it — VeriGuard’s guarantee is only as good as the policy and specification built for its particular domain [5], and that construction cost does not amortize the way reusing a known topology does. Reliability instead keeps being measured the way tau-bench and METR already measure it, statistically and per-deployment [10, 11], with red-team taxonomies like Microsoft’s continuing to expand rather than close [12]. A converged pattern vocabulary and empirical assurance simply coexist.
Horizon. Recognizable by 2029–2030; a stable configuration plausible through 2035.
Assumptions. The interoperability value of a shared topology vocabulary is large enough to justify itself even without anyone being able to certify any specific instance of it; formal-specification cost per domain keeps outrunning standardization capacity industry-wide, not just at the margin.
Observable indicators. First, the shared topology vocabulary described in scenario one. Second, no decision-loop certification scheme achieves adoption beyond a single vendor’s internal practice. Third, published system documentation continues to report benchmark pass rates and red-team findings, not certified assurance levels, as the primary reliability claim.
Disconfirmation. Falsified if a decision-loop certification scheme is adopted by three or more independent vendors as their primary published reliability claim by 2031 — that would indicate the world is in scenario one instead.
Scenario three: The Certified Silo — patterns fragment, reliability is certified
Mechanism. No single topology vocabulary wins broadly because task domains differ too much for one shape to fit all of them — a conversational tool-caller, a multi-day autonomous research agent, and an industrial-control agent are different enough problems that pattern convergence stalls even as each domain matures on its own. Within high-consequence verticals, however, a domain-specific certification regime does emerge, following the precedent of how DO-178C stayed aviation-specific and IEC 61508 spawned incompatible sector derivatives like ISO 26262 and IEC 61511 rather than one universal standard [7, 6]. Each vertical certifies its own bespoke architecture instead of the field certifying one shared architecture.
Horizon. A recognizable divergence-with-certification pattern by 2030–2032; stable by 2035.
Assumptions. Certification cost is justified only where consequences are severe enough to resemble aviation- or process-industry stakes; the verticals that clear that bar differ enough from each other that a shared reference architecture does not emerge even after each is separately certified.
Observable indicators. First, two or more industry-specific agent certification schemes emerge independently — for example, one scoped to healthcare-agent decision loops and one to industrial-control-agent decision loops — with structurally incompatible requirements. Second, general-purpose agent frameworks outside those verticals remain uncertified and keep diversifying. Third, tooling built for one certified vertical fails to transfer to another.
Disconfirmation. Falsified if a single certification scheme is adopted across two or more structurally different verticals without requiring incompatible architectures — that would push the world toward scenario one instead.
Scenario four: The Open Bench — patterns fragment, reliability stays empirical
Mechanism. The same fragmentation drivers as scenario three hold, but no vertical builds a certification regime either, because the cost of formal certification never gets justified anywhere: domain-specific verification of VeriGuard’s kind stays too narrow and too expensive relative to how fast task domains keep changing [5]. The field keeps doing what tau-bench and Microsoft’s still-growing red-team taxonomy already show it doing today — measuring reliability empirically, per deployment, and rediscovering failure modes about as fast as new capability ships [10, 12]. Gartner’s projected 40%-plus cancellation rate for current agentic projects is this scenario’s leading indicator, already visible in 2026 rather than a future prediction [14].
Horizon. Close to today’s baseline; recognizable as the stable case by 2028 if none of the trends above change; could persist largely unchanged through 2035.
Assumptions. Task-domain diversity keeps outpacing standardization and certification effort in every vertical, including safety-critical ones; empirical, outcomes-based evaluation keeps being accepted as sufficient for procurement and regulatory purposes, consistent with binding law currently defaulting to a human-in-the-loop requirement rather than a certified statistical one [13].
Observable indicators. First, no certification scheme for agent decision loops achieves multi-vendor adoption in any vertical by 2032. Second, framework and topology vocabulary remains fragmented, without the convergence signal scenarios one and two both depend on. Third, published reliability claims across the industry remain benchmark- and red-team-based.
Disconfirmation. Falsified if either pattern convergence or certification adoption is observed at the thresholds defined in scenarios one through three — either observation would move the world out of this cell.
What all four share, and the possibility neither axis names
Three things hold across every cell, and are the safest things to build engineering practice on regardless of which one obtains. First, some form of empirical evaluation survives in all four, including the certified ones — even a certified decision loop needs continuous red-teaming to catch drift and novel misuse, exactly as Microsoft’s own taxonomy needed a second annual revision despite a year of dedicated red-teaming [12]. Certification adds a floor; it does not remove the need to keep testing above it. Second, interface-level standardization of the kind MCP already provides is a narrower and more separable question than this article’s Axis A, and can plausibly settle on its own regardless of which cell the decision-loop question lands in [4] — a converged interface layer sitting on top of a fragmented reasoning layer, or vice versa, is compatible with any of the four cells above. Third, none of the four requires a capability plateau or a discontinuity in what agents can actually do; each is compatible with capability continuing to rise at something like the pace METR’s horizon study already documents [11], because the axes describe engineering and institutional maturity, not the underlying rate of technical progress.
The four scenarios share a blind spot too, worth naming rather than hiding. All four assume the two axes here remain the two that matter and that the field moves toward whichever cell it reaches gradually. A large enough exogenous shock would not fit cleanly into any of the four: a single catastrophic agent failure severe enough to force emergency, binding certification requirements overnight, skipping the gradual adoption path every scenario above traces; a genuine breakthrough in general-purpose formal verification that makes certification suddenly cheap across domains rather than narrow and VeriGuard-shaped [5]; or a regulatory shock in which a jurisdiction extends Article 14’s human-oversight requirement directly into a decision-loop certification mandate, rather than leaving that extension to voluntary industry standards [13]. Any of these would move both axes at once, abruptly, rather than along the paths each scenario assumes.
Two predictions, stated separately from the scenarios
Prediction one. Horizon: end of 2028. At least one further formal-verification framework in VeriGuard’s line of work will report evaluation across more than one narrow task domain, moving from single-paper demonstration toward multi-domain applicability, regardless of which scenario the field otherwise tracks toward. Assumption: research investment in agent-specific formal verification continues at roughly its current trajectory. Indicator: a published paper, system card, or product document citing formal-verification coverage across multiple, materially different task domains. Disconfirmed if by the end of 2028 published formal-verification work for agents remains confined to single, narrow demonstrations comparable in scope to VeriGuard’s own [5].
Prediction two. Horizon: end of 2031. No jurisdiction with meaningful enforcement power will have replaced a human-in-the-loop requirement of the kind Article 14 currently specifies with an automated statistical release gate for a high-risk agent action class, absent a published, independently audited certification regime for that specific action class’s error bound. Assumption: regulators remain unwilling to accept an uncorroborated benchmark pass rate as sufficient grounds for removing human oversight. Indicator: regulatory text, enforcement guidance, or a formally adopted certification scheme cited as the basis for removing a human-oversight requirement. Disconfirmed if a jurisdiction formally permits automated release for a high-risk action class based on statistical or benchmark evidence alone, without a certified error bound behind it [13].
What to take away
The refusal to name a favourite among these four is the substantive claim, not a hedge around one. In August 2026 the evidence is genuinely split on both axes at once: a single vendor’s five-pattern vocabulary and a research survey’s unifying framework sitting beside a widely used multi-agent framework that implements the same named shape incompatibly; a formally verified agent-safety method that works today sitting beside a benchmark showing leading agents still failing more than half of realistic tool-use tasks; adjacent engineering fields that have run levels-based, third-party certification for decades sitting beside AI-specific standards that still stop at organizational process rather than reaching an agent’s actual decision loop; and, underneath all of it, a market where a plurality of current agentic projects are themselves projected not to survive to see any of this resolved. Anyone reporting a confident single future for AI agent architecture in 2035 is reporting which of these four they would bet on, not what the current record shows. The more useful and less satisfying discipline is the one this article tried to practise throughout: know which signal to watch, and have said in advance, on the record, what each one finding would mean.
