The agentic stack stopped being a framework debate and became infrastructure in 2026. Production teams converge on the same five layers, whatever logos they attach to them. Here's the stack as it's actually deployed, layer by layer.
Layer 1: Models With Agentic Training
The differentiator at the model layer is no longer raw benchmark scores but tool-use reliability over long horizons. Vendors now market directly on it: Anthropic ships Sonnet-class models positioned as "the most agentic yet"; xAI's Grok 4.5 leads on coding and agentic tasks with configurable reasoning levels; Google's Gemini 3.5 family is explicitly "built for complex agentic workflows"; Cohere's North Mini Code targets agentic coding as a 30B open-weight MoE. Practical guidance: evaluate models on your tool schemas and multi-step tasks — agentic reliability varies more across models than single-turn quality does.
Layer 2: Tools and the MCP Convergence
Model Context Protocol won the connector war by default — everyone shipped it. Mistral offers 60+ pre-built connectors plus custom MCP options with org-scoped admin controls; the pattern repeats across vendors. The operational lesson teams learned this year: connectors are an attack surface and a governance surface. Scoped API keys, per-workspace connector allowlists, and audit logs on tool calls are now baseline requirements, not enterprise nice-to-haves.
Layer 3: Orchestration
Where the agent's control flow lives. The market split into three patterns:
Vendor-native agent platforms — Oracle's AI Agent Studio builds agents natively into Fusion apps; Databricks' Genie One orchestrates work grounded in enterprise data; Microsoft's stack spans Copilot Studio and Foundry (with Microsoft IQ now GA across it).
Cloud agent runtimes — Amazon's AgentCore and equivalents: managed execution with built-in policy.
Code-first orchestration — teams writing deterministic control flow that calls models at decision points. This quietly dominates serious deployments: the agent supplies judgment, the code supplies structure.
Layer 4: Execution Environments
The newest layer to institutionalize: agents need somewhere safe to do things. CoreWeave's Sandboxes (execution for RL, tool use, and evals, runnable serverlessly through W&B) marks the arrival of sandboxed execution as rentable infrastructure. Hugging Face's HF Jobs — a private, OpenAI-compatible endpoint in one command with per-second billing — plays the same role for ephemeral model serving. If your agents run code or browse, isolated execution is non-negotiable.
Layer 5: Guardrails and Evaluation
The layer that separates demos from production. Amazon integrated Bedrock Guardrails into AgentCore so every agent action is evaluated for prompt injection, harmful content, and sensitive-data exposure — action-level screening, not just input/output filtering, is the new bar. Alongside runtime guardrails: continuous evals (regression suites on real task distributions), sampled human review with named owners, and per-use-case kill switches. Budget 10–20% of run cost here.
What Changed vs. 2025
Three shifts define the year: (1) agent capability moved into the systems of record (Oracle, Databricks, Microsoft) rather than sitting beside them; (2) action-level security screening became standard; (3) the execution sandbox emerged as a distinct infrastructure category. The framework wars of 2024–25, meanwhile, resolved into a shrug: control flow is just code.
Build Order for New Teams
Start at Layer 5 and work up: evals first, then one model behind a gateway, then a small tool surface with scoped credentials, then orchestration in plain code, then a sandbox when agents start acting. Teams that build top-down (orchestrator first) ship demos; teams that build bottom-up ship systems.
