The Agentic Product Standard

A canonical standard for building production-grade agentic products — plus a Claude Code skill set that operationalizes it.

Distilled from the production practices of Anthropic, OpenAI, Cognition, Sierra, LangChain, and leading practitioners — 2024–2026.

Product Standard → · Agent Standard → · Install the Skills → · Decision Checklist →

An agentic product is not "a product with AI." It is a product where part of the process is dynamically directed by an LLM within a deterministic architecture with explicit trust boundaries.

Most teams ship agent demos. Few ship agents that survive contact with production. The difference is almost never the model — it's the architecture, the harness, and the eval discipline around it. This repo is the field-tested standard for that work, plus a set of Claude Code skills that put it into your editor.

Table of contents

• Why this exists
• The six principles
• What's in this repo
• Install the skills
• The AgenticProduct family
• The Autonomy Ladder
• The five composition patterns
• The 8-layer harness
• The 10-question checklist
• Score yourself
• The Loop License
• Production readiness — Definition of Done
• Anti-patterns
• Reading list
• Contributing
• License

Why this exists

Six principles converged independently across the production practices of the labs and the leading practitioners. They are the spine of every decision in this standard:

The six principles

The single most important rule: Architecture is what remains when the model improves. The model is the variable, the harness is the constant. Invest proportionally.

What's in this repo

agentic-product-standard/
├── STANDARD.md                          ← the canonical standard (product level)
├── AGENT_STANDARD.md                    ← the single-agent operational standard (mirrored in agent-builder)
├── SCORECARD.md                         ← M0–M3 self-assessment, mapped to the Autonomy Ladder
├── CONTEXT.md                           ← shared vocabulary every skill speaks
├── setup.sh                             ← quick setup: skills + (optional) AgenticMind, one run
├── family.sh                            ← stand up the whole reference stack locally, one command
├── templates/security/                  ← red-team kit: lethal-trifecta gate, injection suite, MCP pin
├── templates/ci/eval-gate.yml           ← CI workflow that blocks merges on eval regression
├── templates/loop-license/CHECKLIST.md  ← one-page Loop License gate (six gates, L3+)
├── examples/agenticmind-case-study.md   ← reference implementation, audited against the canon
├── docs/adr/                            ← architecture decision records (why the repo is shaped this way)
└── skills/                              ← Claude Code skill set (operationalizes the standard)
    ├── agent-builder/                    ← single-agent track (bundles AGENT_STANDARD.md + templates/)
    └── agentic-product-architect/        ← multi-agent track: master router + sub-skills
        ├── SKILL.md                      ← master: router + philosophy
        ├── architecture-design/          ← autonomy ladder, 5 patterns, single vs multi
        ├── context-engineering/          ← write/select/compress/isolate, the 40% rule
        ├── harness-engineering/          ← the 8 layers around the LLM loop
        ├── tool-design-mcp/              ← MCP-first, <20 tools, RAG-MCP, sandboxing
        ├── memory-architecture/          ← Mem0 / Zep / Letta / LangMem / files
        ├── tenant-isolation/             ← multi-tenant: pooled/silo, leakage paths, leakage eval
        ├── durable-execution/            ← Temporal Workflow + Activity pattern
        ├── eval-driven-dev/              ← Husain/Shankar pyramid + judge calibration
        ├── framework-selection/          ← LangGraph / Claude SDK / OpenAI SDK / others
        ├── production-readiness/         ← 23-point Definition of Done audit (+ Loop License + measurement science, L3+)
        ├── antipatterns-review/          ← code review through 17 known failure modes
        └── reference-stack/              ← the paved road: install & wire the AgenticProduct family

Two standards, one practice:

• STANDARD.md is the product-level reference — read it once, return to it often.
• AGENT_STANDARD.md is the single-agent operational standard — contract, schemas, permission tiers, durable state, evals (also bundled into the agent-builder skill so it ships self-contained).
• skills/ is the practice — two Claude Code skills (agent-builder for one agent, agentic-product-architect for multi-agent products) that auto-load the right guidance while you design, build, and review.

🚀 Install the skills

The skill set works with Claude Code. Two tracks share the same sub-skills: agent-builder for building one production-grade agent (it bundles AGENT_STANDARD.md + copy-paste templates/), and agentic-product-architect — a master skill that routes to twelve specialized sub-skills for multi-agent products. Each is independently triggerable.

Fastest: one command, no clone

If you have skills (the community skill installer), pull the skill straight from this repo — it scans skills/, lets you pick agent-builder and/or agentic-product-architect, and installs them into the agents you choose:

npx skills@latest add Moai-Team-LLC/agentic-product-standard

This installs the skills only. To also stand up the runnable memory layer (AgenticMind), run the setup.sh --with-agenticmind flow below — or, after adding the skills, point your agent's MCP client at a self-hosted AgenticMind (see its Quickstart).

Quick setup (one train)

setup.sh installs the skills and, in the same run, can stand up AgenticMind — the reference implementation — as a runnable knowledge & memory layer your agent calls over MCP. Design guidance and a working substrate, end to end:

git clone https://github.com/Moai-Team-LLC/agentic-product-standard.git
cd agentic-product-standard
./setup.sh --with-agenticmind        # skills → clone AgenticMind → its setup.sh (deps + Postgres + migrations)

Run bare (./setup.sh) and it installs the skills, then asks whether to set AgenticMind up next. AgenticMind's leg needs Bun ≥1.3 + Docker; the skills themselves need neither.

./setup.sh                  # install skills here, then prompt about AgenticMind
./setup.sh --user           # install skills into ~/.claude/skills (every project)
./setup.sh --skills-only    # skills only, no prompt

Manual install

User-level (available in every project):

cp -R agentic-product-standard/skills/* ~/.claude/skills/   # both tracks; they share sub-skills

Project-level (scoped to one repo):

mkdir -p .claude/skills
cp -R /path/to/agentic-product-standard/skills/* .claude/skills/   # both tracks

Claude Code discovers skills via each SKILL.md and its YAML frontmatter. Once installed, agent-builder triggers when you set out to build, implement, or review one agent, while agentic-product-architect triggers for multi-agent products, an agent loop, or any major agentic framework (LangGraph, CrewAI, OpenAI Agents SDK, Claude Agent SDK, Pydantic AI, AutoGen). Ask a focused question — "Mem0 or Zep?", "how should I structure context?", "review my agent code" — and the relevant sub-skill loads directly.

🌐 The AgenticProduct family

The standard tells you how; five reference implementations are repos you can run — each building one surface the standard defines. AgenticOps runs the fleet, AgenticMind judges and grounds its answers, AgenticPerformance measures and improves what runs, AgenticGateway carries every model call, and AgenticAssurance red-teams it — all conforming to this standard.

How they compose. AgenticOps runs the fleet, AgenticMind gives agents auditable knowledge & memory, and AgenticPerformance measures every run with traces and evals — closing the run → remember → measure loop. AgenticGateway is the model plane every LLM call in that loop passes through — one key, eval-measured routing, cost ceilings — and AgenticAssurance red-teams any agent in the loop, with the whole stack conforming to the agentic-product-standard.

Want the whole loop as one deployable engine? The Agentic Platform vendors these members as pinned submodules and assembles them into one runnable product — a unified agentic CLI, a live console, and a per-product engine you agentic init → agentic up. (family.sh below spins the family up to explore; the platform is the deployable, operable engine.)

AgenticMind remains the flagship reference implementation — an auditable, self-improving knowledge & memory layer agents plug into over MCP (the OSS pick for the memory slot in memory-architecture); install it with ./setup.sh --with-agenticmind. See its case study for a layer-by-layer conformance map, and ECOSYSTEM.md for the full family — which surface each repo implements, its status, and how they compose.

Run the whole family locally — one command. family.sh clones every member and brings up the three long-lived services (Mind, Performance, Gateway) through each repo's own compose + run scripts, then prints how to use the library (Ops) and the CLI (Assurance):

./family.sh up        # clone + stand up the reference stack   (needs git, docker, bun)
./family.sh status    # health of every service
./family.sh down      # stop everything (Docker volumes preserved)

Generated secrets are written into each member's local .env and never printed. Paved road, not a mandate — swap any member for your own (Principle 2).

The Autonomy Ladder

Never start with "build an agent." Start with "what is the minimum autonomy this task requires?" The cost of getting this wrong is asymmetric.

Escalation rule: do not climb to L+1 until L delivers ≥90% pass rate on a curated eval set.

The five composition patterns

Compose agentic products from these primitives like Lego — before reaching for a framework.

1. Prompt Chaining — sequential decomposition (outline → draft → polish)
2. Routing — classifier + dispatcher to a specialist
3. Parallelization — fan-out of independent subtasks + aggregation
4. Orchestrator-Workers — central planner + dynamic workers
5. Evaluator-Optimizer — generator + critic in a loop until acceptance

Meta-principle: first try to solve the task by composing these patterns in deterministic code. A full agent loop is the last resort.

The 8-layer harness

In a production agent, the harness — everything around the LLM loop — is 98% of the code.

╔═════════════════════════════════════════════╗
║  8. Security & Identity  (CROSS-CUTTING)    ║ ← threat model · injection defense · agent identity · least-privilege tokens · pinned tool defs
╠═════════════════════════════════════════════╣
║   7. Observability & Tracing                ║ ← log EVERYTHING
║   6. Evaluation Layer (CI gates)            ║ ← block regressions
║   5. Human-in-the-Loop (notify/ask/review)  ║ ← approval gates
║   4. Guardrails (input/output validation)   ║ ← defense in depth
║   3. Durable Execution (Workflow + Activity)║ ← pause/resume/retry
║   2. Context & Memory Management            ║ ← write/select/compress/isolate
║   1. Agent Loop (gather → act → verify)     ║ ← the "agent" proper
╚═════════════════════════════════════════════╝
              ↕ MCP / function calling

Permission boundaries are enforced by code, never by prompt. The Replit incident of 2025 — an agent wiped a production database for 1,200+ companies despite an explicit "code freeze" in its prompt — is the canonical proof. The model will ignore prompt-level restrictions under enough pressure. Code won't.

Layer 8 is cross-cutting (v2.0). Identity, least privilege, and isolation constrain every layer; injection defense spans input and output. Run the lethal-trifecta check (private data × untrusted content × external comms) on every deployment, and pin MCP tool definitions by hash so a server can't rug-pull you. A guardrail is one tactic, not the discipline — see STANDARD.md · Layer 8 and the red-team kit.

✅ The 10-question checklist

Run this before drafting any architecture. It unblocks 80% of design debates.

□ What is the minimum autonomy level (L0–L4) that solves this?
□ Can it be solved by composing the 5 patterns without a full agent loop?
□ Is the task breadth-first (parallelizable) or depth-first (coherent)?
□ What are the 3 failure modes that would lose user trust first?
□ Where are the permission boundaries? What MUST the agent NOT do?
□ Which constraint dominates framework choice?
□ Where does state live? (in-context = anti-pattern for long-running)
□ Who validates outputs at each stage? (assertion / LLM judge / human review)
□ Where do traces live, with what retention?
□ Eval set: how many examples, who labels, how does it grow?

If you can't answer half of these, slow down and answer them together — don't write code yet.

📊 Score yourself

Principles are easy to nod along to; SCORECARD.md makes you prove it. It turns the Definition of Done into a binary Yes/No maturity self-assessment with four bands mapped to the Autonomy Ladder:

Run it with the team against a real deployment each release — the first No you hit is your next piece of work.

🔒 The Loop License

Autonomy is earned, not granted. Before an agent runs unattended — finding its own work and looping without a human in each turn (Autonomy Ladder L3+) — it must hold a Loop License: six gates, all required, each enforced in code and tested.

Eval pass-rate threshold · regression gate · declared blast radius · cost cap · kill switch · escalation path.

Miss any one and the system stays at L2 (human-in-the-loop), no matter how good the model is. Backing the gates: independent verification (the producing model never grades its own work — deterministic checks first, a decorrelated calibrated judge second), a governed instruction supply chain (skills and prompts are versioned, provenanced, eval-gated artifacts), and a hard ingestion boundary ("find work" is untrusted input). Full treatment in STANDARD.md Part IV; the one-page gate is templates/loop-license/CHECKLIST.md.

Production readiness — Definition of Done

An agentic product is not production-ready until all 23 are satisfied (items 16–19 and the L3+ oversight item bind at L3+ unattended operation; items 20–23 deepen the eval bar wherever the relevant component exists). Full detail in STANDARD.md.

Unattended (L3+) — the Loop License: stop conditions · independent verification · loop economics, gated by blast radius · cost cap · kill switch · escalation path.

Anti-patterns

The fastest way to recognize a doomed agent project — the skill set's antipatterns-review flags each with a diagnostic and a fix.

1. Multi-agent before a single-agent baseline
2. Framework abstractions before understanding the raw API
3. LLM judges without calibration against human labels
4. Permissions enforced through prompts
5. Memory as an afterthought
6. Generic evals ("helpfulness," "correctness")
7. Likert scales in an LLM judge (binary only)

8. 100 tools per agent

9. One agent for both breadth and depth
10. Deploying without trace monitoring
11. Hardcoded prompts without version control
12. Treating single-vendor benchmarks as ground truth
13. Trusting community MCP servers without pinning or scanning (rug pulls)
14. Deploying the lethal trifecta with no mitigation
15. Token passthrough / over-scoped OAuth (confused deputy)
16. No budget ceiling on autonomous sessions
17. Peer-to-peer multi-agent buses instead of an orchestrator

Reading list

The operational base — not reference docs. Read in order:

1. Anthropic — Building Effective Agents (Schluntz & Zhang)
2. OpenAI — A Practical Guide to Building Agents
3. HumanLayer — 12 Factor Agents (Dex Horthy)
4. Anthropic — How we built our multi-agent research system
5. Cognition — Don't Build Multi-Agents (Walden Yan)
6. LangChain — Context Engineering for Agents (Lance Martin)
7. Hamel Husain — A Field Guide to Rapidly Improving AI Products + Your AI Product Needs Evals
8. Anthropic — Building agents with the Claude Agent SDK
9. Anthropic — Effective Context Engineering for AI Agents (just-in-time retrieval)
10. OWASP — Top 10 for Agentic Applications (2026) + Simon Willison — The lethal trifecta
11. OpenTelemetry — GenAI semantic conventions (the observability standard)

Contributing

This standard is meant to evolve — the field moves fast. Corrections, new exemplars, framework updates, and translations are all welcome. See CONTRIBUTING.md and the Code of Conduct.

The architectural canons (the autonomy ladder, the 5 patterns, single-vs-multi, the harness) are stable. Specific vendors and framework rankings will shift — those are exactly the kind of PRs we want.

License

MIT — use it, fork it, ship with it.

If this saved you a week of architecture debates, star the repo ⭐ so others find it.

v3.1 · assembled from production practices as of June 2026