---
title: "Agentic AI and Multi-Agent Systems"
canonical_url: "https://cognilium.ai/services/ai-agents"
slug: "services/ai-agents"
section: "services"
page_type: "pillar"
date_modified: "2026-09-29"
description: "Agentic AI systems that plan a sequence, call real tools, check the result and hand off to a person where an action cannot be reversed — built on LangGraph, CrewAI, Google ADK, AWS Bedrock AgentCore and MCP, or on custom orchestration."
publisher: "Cognilium AI"
author: "Mudassir Marwat"
person_same_as:
  - "https://www.linkedin.com/in/mudassir-marwat/"
  - "https://orcid.org/0009-0008-1927-2598"
  - "https://github.com/mudassirmarwat"
  - "https://medium.com/@mudassir-marwat"
  - "https://www.youtube.com/@mudassir-marwat"
  - "https://dev.to/mudassirmarwat"
  - "https://hashnode.com/@mudassirmarwat"
  - "https://huggingface.co/mudassirmarwat"
  - "https://bsky.app/profile/mudassir-marwat.bsky.social"
  - "https://substack.com/@mudassirmarwat"
  - "https://topmate.io/mudassirmarwat"
  - "https://fueler.io/mudassirmarwat"
  - "https://www.instagram.com/mudassirmarwat/"
  - "https://www.facebook.com/mudassir.marwat"
  - "https://www.reddit.com/user/mudassirmarwat/"
  - "https://www.f6s.com/member/mudassir-marwat"
  - "https://cognilium.ai/founder"
answers:
  - "What is agentic AI?"
  - "What is the difference between an AI agent and an agentic workflow?"
  - "When does a multi-agent system beat a single agent?"
  - "Where do multi-agent systems break in production?"
  - "How do you stop an agent taking an action you did not intend?"
  - "How do you evaluate an agentic system?"
  - "What does agentic AI cost to run?"
  - "Which framework should an agentic system use?"
  - "Can agentic AI run inside an ERP like Dynamics 365?"
entities:
  - name: "LangGraph"
    id: "https://cognilium.ai/#entity-langgraph"
    url: "https://www.langchain.com/langgraph"
    same_as:
      - "https://www.wikidata.org/wiki/Q132393291"
  - name: "CrewAI"
    id: "https://cognilium.ai/#entity-crewai"
    url: "https://www.crewai.com"
    same_as:
      - "https://www.wikidata.org/wiki/Q139761640"
      - "https://en.wikipedia.org/wiki/CrewAI"
  - name: "Amazon Bedrock"
    id: "https://cognilium.ai/#entity-bedrock"
    url: "https://aws.amazon.com/bedrock/"
    same_as:
      - "https://www.wikidata.org/wiki/Q124052638"
      - "https://en.wikipedia.org/wiki/Amazon_Bedrock"
  - name: "Amazon Web Services"
    id: "https://cognilium.ai/#entity-aws"
    url: "https://aws.amazon.com"
    same_as:
      - "https://www.wikidata.org/wiki/Q456157"
      - "https://en.wikipedia.org/wiki/Amazon_Web_Services"
  - name: "Google Cloud Platform"
    id: "https://cognilium.ai/#entity-googleCloud"
    url: "https://cloud.google.com"
    same_as:
      - "https://www.wikidata.org/wiki/Q17054505"
      - "https://en.wikipedia.org/wiki/Google_Cloud_Platform"
  - name: "Microsoft Dynamics 365"
    id: "https://cognilium.ai/#entity-dynamics365"
    url: "https://www.microsoft.com/en-us/dynamics-365"
    same_as:
      - "https://www.wikidata.org/wiki/Q27556059"
      - "https://en.wikipedia.org/wiki/Microsoft_Dynamics_365"
  - name: "SAP"
    id: "https://cognilium.ai/#entity-sap"
    url: "https://www.sap.com"
    same_as:
      - "https://www.wikidata.org/wiki/Q552581"
      - "https://en.wikipedia.org/wiki/SAP"
  - name: "LangChain"
    id: "https://cognilium.ai/#entity-langchain"
    url: "https://www.langchain.com"
    same_as:
      - "https://www.wikidata.org/wiki/Q117340550"
      - "https://en.wikipedia.org/wiki/LangChain"
related:
  - "https://cognilium.ai/agentic-erp"
  - "https://cognilium.ai/erp-ai"
  - "https://cognilium.ai/solutions/enterprise-agent-orchestration"
  - "https://cognilium.ai/solutions/aws-bedrock-agentcore-deployment"
  - "https://cognilium.ai/products/paralegent-ai"
---

# Agentic AI and Multi-Agent Systems

Agentic AI is software that pursues a goal across several steps: it decides what to do next, calls real tools to do it, checks the result, and stops to ask a person when the next action cannot be undone. The difference from a chatbot is not intelligence. It is that something happens afterwards.


## What agentic AI is, in two distinctions

### What separates an agent from an assistant

An assistant returns text and the work starts when you read it. An agent holds the process: it plans a sequence, calls tools, reacts to what comes back, and carries the task to a result. The test is simple — if the system produced nothing but words, it was an assistant.

### What separates a demo from a system

A demo runs the happy path once. A system runs the same workflow ten thousand times, on real data, while models time out, tools return half an answer and two agents reach opposite conclusions. Everything below this line is about the second one.


## Thirty-seven agents, five systems

Four are our own products. The fifth is a delivered client system, described by role only — no client is named, and nothing of theirs is described.

### Paralegent AI (23)

Our contract-review product: twelve scoring agents, one per legal category, smart-routing to eleven specialist analysts. Circuit breakers, two-tier retry, tracing on every request, and model-agnostic by design.

### A family-office platform (7)

A supervisor-router dispatching to financial, legal, knowledge, document, calendar and email specialists, with 62 tool functions and 105 endpoints behind them.

### VectorHire (4)

Resume, professional-network, code-host and live voice-interview agents screening a candidate at the same time rather than in sequence.

### An AgentCore reference build (3)

Advisor, budget planner and compliance guardrails on AWS Bedrock AgentCore — guardrails written in code that block non-compliant requests as they happen, with persistent memory.

### A manufacturer, delivered (1)

A multi-agent decision assistant over the ERP — natural language to SQL, to API, document retrieval and OCR — delivered inside the chat tool the executives already used.


## Where agentic systems break

Ten named failure modes, each with a full article behind it. This is what the second month of running an agentic system looks like.

### It should have been one agent

Splitting a task across specialists adds coordination cost to every request. If one model with good tools can do the job, several models will do it slower and for more money.

*https://cognilium.ai/blogs/multi-agent-vs-single-agent*

### Nobody can tell which agent broke

A single trace per request is enough for one agent and useless for nine. Without per-agent spans, a wrong answer is a black box and the only debugging tool is re-running it.

*https://cognilium.ai/blogs/multi-agent-observability*

### The retry sent the email twice

Retries are correct for reads and dangerous for writes. An agent that retries a side effect without an idempotency key performs it again, and the second one is indistinguishable from the first.

*https://cognilium.ai/blogs/multi-agent-reliability*

### The same context is paid for fourteen times

Every agent that receives the full history pays for the full history. Cost grows with the product of agents and turns, not the sum, and it only becomes visible once real volume arrives.

*https://cognilium.ai/blogs/multi-agent-cost-optimization*

### There are no brakes

Agents that hand work to each other need a stated stopping condition. Without one, a disagreement becomes a loop that runs until a budget or a timeout ends it.

*https://cognilium.ai/blogs/multi-agent-control-termination*

### One poisoned agent poisons the chain

Text from one agent is instruction-shaped input to the next. Where a trust boundary is not drawn between them, a single compromised step reaches every step downstream.

*https://cognilium.ai/blogs/multi-agent-security-trust-boundaries*

### The agents do not share a brain

They pass notes. What survives a handoff is exactly what one agent chose to write down, and most context loss happens at that seam rather than inside any agent.

*https://cognilium.ai/blogs/multi-agent-context-handoffs*

### It was built as a line when the work was a graph

Steps arranged in sequence wait on each other for no reason. Work that has no dependency between its branches should run at the same time, and latency is usually shape, not model speed.

*https://cognilium.ai/blogs/multi-agent-latency*

### The agent keeps forgetting

A longer context window postpones the problem rather than solving it. What an agent should carry forward is a decision about relevance, and that decision has to be designed.

*https://cognilium.ai/blogs/agent-memory-why-agents-forget*

### It reported success when the write failed

An agent reads the response it was given, not the state of the system. Where the tool returns an acknowledgement rather than a confirmation, the agent will report work that never landed.

*https://cognilium.ai/blogs/why-erp-agents-report-false-success*


## Six patterns we have proven in production

### Supervisor and router orchestration

One agent that decides, specialists that do. The alternative — every agent seeing every request — is simpler to build and far more expensive to run.

### Typed tool contracts

A tool is a schema, not a prompt. If the model cannot produce a valid call, the call does not happen.

### Guardrails in code, not prompts

A prompt asking a model to behave is a request. A policy engine that refuses the action is a guarantee. Dispensable actions go through the second one.

### Human in the loop at the boundary

The system proposes and a person disposes, wherever the action is irreversible. That boundary is designed in, not bolted on after a bad week.

### A judge before delivery

Output scored against a rubric before it ships — in one build, every lesson is scored before a teacher ever sees it.

### Deterministic overrides

Where arithmetic beats judgement, arithmetic wins. A real design rule from one of our systems: an ordinal is arithmetic, a name is judgement.


## Frameworks in production

Chosen per problem, including none — our contract-review pipeline has no framework dependency at all.

- LangGraph
- LangChain
- CrewAI
- Google ADK
- AWS Bedrock AgentCore
- AutoGen
- MCP


## Agentic AI inside the system that runs the business

Most agentic AI writing stops at the demo because the author has never had to put one next to a general ledger. We build these inside Microsoft Dynamics 365, SAP and modern ERP platforms, which is where the interesting constraint lives: an agent can read widely, it writes back only what it created, and anything that moves money or stock is prepared for a person to approve rather than executed.

That boundary is a design decision, and it is stronger than promising autonomy.


## The whole body of work, in reading order

- **Decide the shape** — Before any of it is built
-   - Most multi-agent systems would work better as one agent — https://cognilium.ai/blogs/multi-agent-vs-single-agent
-   - Four ways to wire a multi-agent system, and when each one breaks — https://cognilium.ai/blogs/multi-agent-architecture-patterns
-   - Multi-agent orchestration on AWS Bedrock AgentCore — https://cognilium.ai/blogs/multi-agent-orchestration-aws
-   - Supervisor-router on Google ADK with per-org tool registration — https://cognilium.ai/blogs/google-adk-supervisor-multi-tenant-tool-registration
- **Where it breaks** — The nine failure modes, each one published in full
-   - Your multi-agent system is a black box — https://cognilium.ai/blogs/multi-agent-observability
-   - When a multi-agent system fails, which agent broke? — https://cognilium.ai/blogs/evaluating-multi-agent-systems
-   - Your retry just sent the email twice — https://cognilium.ai/blogs/multi-agent-reliability
-   - You pay for the same context fourteen times — https://cognilium.ai/blogs/multi-agent-cost-optimization
-   - Your multi-agent system has no brakes — https://cognilium.ai/blogs/multi-agent-control-termination
-   - One poisoned agent poisons the chain — https://cognilium.ai/blogs/multi-agent-security-trust-boundaries
-   - Your agents don't share a brain. They pass notes. — https://cognilium.ai/blogs/multi-agent-context-handoffs
-   - You built a line when the work was a graph — https://cognilium.ai/blogs/multi-agent-latency
-   - There is no such thing as a local change — https://cognilium.ai/blogs/multi-agent-change-management
- **What the agent carries forward** — Memory, and why a bigger context window is not the answer
-   - Why your AI agent keeps forgetting — https://cognilium.ai/blogs/agent-memory-why-agents-forget
-   - Mem0 vs Graphiti vs building your own graph — https://cognilium.ai/blogs/mem0-vs-graphiti-agent-memory
-   - Why your agent retrieves the wrong memory — https://cognilium.ai/blogs/agent-memory-retrieval-ranking
-   - Why a bigger context window won't save your agent — https://cognilium.ai/blogs/agent-working-memory-context-window
-   - An agent that saves everything remembers nothing — https://cognilium.ai/blogs/agent-memory-consolidation
-   - Your agent's memory benchmark is measuring the wrong thing — https://cognilium.ai/blogs/evaluating-agent-memory
- **Running it in production** — Evals, judges, retries, queues and partial failure
-   - The production LLMOps stack: evals, judges, retries, circuit breakers — https://cognilium.ai/blogs/production-llmops-stack
-   - LLM-as-judge with temperature-escalation retry inside a 60-second budget — https://cognilium.ai/blogs/llm-judge-temperature-escalation-retry
-   - Smart category-score routing that cuts LLM cost — https://cognilium.ai/blogs/smart-category-score-routing-cost
-   - Bias-detection alerts on a four-agent candidate evaluation pipeline — https://cognilium.ai/blogs/bias-detection-multi-agent-evaluation
-   - Surviving partial failure in a 3,300-call agent pipeline — https://cognilium.ai/blogs/agent-pipeline-failure-recovery-dynamodb-sqs
-   - When to mix SQS FIFO and standard queues in an agent pipeline — https://cognilium.ai/blogs/sqs-fifo-vs-standard-agent-pipeline-design
- **Inside the ERP** — What changes when the agent sits next to a general ledger
-   - What can't Copilot do in Dynamics 365, and what do you build instead? — https://cognilium.ai/blogs/what-copilot-cannot-do-dynamics-365
-   - Are Dynamics 365 ERP form tools just RPA with a new name? — https://cognilium.ai/blogs/erp-form-tools-are-not-rpa
-   - Can an AI agent in Dynamics 365 give itself more permissions? — https://cognilium.ai/blogs/can-an-erp-agent-escalate-its-own-permissions
-   - Why is my ERP agent answering with yesterday numbers? — https://cognilium.ai/blogs/erp-agent-stale-data-12-hour-rule
-   - Why did my ERP agent report success when the write actually failed? — https://cognilium.ai/blogs/why-erp-agents-report-false-success
-   - What does a Dynamics 365 ERP agent actually cost to run? — https://cognilium.ai/blogs/dynamics-365-ai-agent-running-costs
-   - Do I need a Dynamics 365 licence for an AI agent's identity? — https://cognilium.ai/blogs/erp-agent-identity-licensing
-   - Why can't I see my ERP agent's permissions in Entra? — https://cognilium.ai/blogs/erp-agent-permissions-invisible-in-entra
-   - How do I expose my own X++ business logic as an agent tool? — https://cognilium.ai/blogs/expose-x-plus-plus-logic-as-agent-tool
-   - What happens to my ERP agent on 1 October 2026? — https://cognilium.ai/blogs/static-erp-mcp-server-retirement
-   - MCP server, virtual entities or dual-write: how should an AI agent read Dynamics data? — https://cognilium.ai/blogs/how-should-an-ai-agent-read-dynamics-data
-   - In-app Copilot sidecar or a Copilot Studio MCP agent, which one? — https://cognilium.ai/blogs/copilot-sidecar-vs-mcp-agent
-   - What can the Procurement Agent not do yet? — https://cognilium.ai/blogs/what-the-procurement-agent-cannot-do
-   - Data tools, form tools or action tools: which does your ERP agent need? — https://cognilium.ai/blogs/mcp-data-tools-vs-form-tools-vs-action-tools
-   - Which environments can run the Dynamics 365 ERP MCP server? — https://cognilium.ai/blogs/which-environments-run-the-erp-mcp-server
-   - Does the Dynamics 365 ERP MCP server truncate results? — https://cognilium.ai/blogs/does-the-erp-mcp-server-truncate-results
-   - Which model should a Dynamics 365 ERP agent run on? — https://cognilium.ai/blogs/which-model-should-an-erp-agent-run-on


## Agentic AI, answered plainly

### What is agentic AI?

Agentic AI is software that pursues a goal over multiple steps rather than answering once. It decides the next action, calls real tools to carry it out, checks what came back, and escalates to a person where an action cannot be reversed. The distinguishing property is not the model — it is that the system holds the process.

### What is the difference between an AI agent and an agentic workflow?

An AI agent is one actor that can choose and call tools. An agentic workflow is the process those actors run inside: the sequence, the branch conditions, the retries, the stopping rule and the approval step. Most production problems are workflow problems, not agent problems.

### When does a multi-agent system beat a single agent?

When the sub-tasks need genuinely different tools, different context or different models, and when they can run at the same time. If one model with a good tool set can do the job, several will do it slower and cost more, because every handoff adds coordination and repeats context.

### How do you stop an agent taking an action you did not intend?

Not with a prompt. A prompt asking a model to behave is a request; a policy engine that refuses the call is a guarantee. The pattern we ship is typed tool contracts, an authorisation check in code before any side effect, and a human approval step on anything irreversible.

### How do you evaluate an agentic system?

End-to-end success rate is necessary and not sufficient, because it tells you a run failed without telling you where. Useful evaluation scores each step against a rubric, traces per agent so a failure can be attributed, and judges output before delivery rather than after a user has seen it.

### What does agentic AI cost to run?

The model bill is driven by how much context is repeated, not by how clever the prompt is. Every agent receiving the full history pays for the full history, so cost scales with agents multiplied by turns. Routing so that only the relevant specialists are called is usually the single largest saving available.

### Which framework should an agentic system use?

Whichever one the problem argues for, including none. We ship on LangGraph, LangChain, CrewAI, Google ADK, AWS Bedrock AgentCore, AutoGen and MCP, and our own contract-review pipeline has no framework dependency at all because a framework would have fought that problem.

### Can agentic AI run inside an ERP like Dynamics 365?

Yes, with a boundary. An agent can read widely across Dynamics 365 or SAP, it writes back only records it created itself, and anything that moves money or stock is prepared and proposed for a person to approve. That constraint is what makes the system safe to leave running.


---

Canonical HTML: https://cognilium.ai/services/ai-agents