A support ticket arrives with a customer’s phone number in it. Your agent reads the ticket, drafts a reply, and the number appears nowhere in the draft. You go looking for the line in the prompt that told it to be careful with personal data, and there is no line. The model was never asked. By the time the text reached it the number had already been swapped for a placeholder, and the real one came back only on the way out. Nothing inside the agent changed to make that happen. The behaviour was declared beside the agent rather than written into it.

Every passenger walks the same corridor

Between the terminal door and the plane there is a corridor, and along it a handful of desks. Check-in, security, passport control. Each desk is run by a different body, each does one job, and they come in a fixed order. Nobody redesigns the aircraft to add one. On the way home you walk the same corridor backwards, through baggage and customs to the exit.

An agent has a corridor like this, with named places where a desk can stand: before the run starts, before the model is called, around the call itself, around every tool call, after the model answers, at the end of the task. Each desk owns one concern. One strips personal data out of the text. One retries a failed call or falls back to a different model. One decides which tools are visible for this task at all. One compresses a long history so it still fits. One stops the run and asks a person to approve an action that touches the world outside. One saves what was learned when the task ends.

Put together, that is a single pass: history compressed on the way in, verbose tool output trimmed before it comes back, an approval requested before the external action, memory written at the end. The agent’s own logic is never edited. The desks are.

A prompt asks, a layer enforces

Write “never reveal personal data” in the system prompt and you have made a request. It will usually be honoured. Usually is an odd word to find in a compliance document. The same applies to retries, to fallbacks, to which actions need a human: these are decisions you want to hold whatever the model happens to produce, and a sentence is not a mechanism for holding anything.

Moving them out into layers changes what you can do with them. A layer can be tested on its own, with no agent around it. It can be reused by every agent you run, so the rule is written once. And it can be owned by the team that owns the concern: security writes the redaction desk, platform writes the retry, and the application team goes back to writing the application.

The failure mode is an airport with too many desks and no floor plan. Layers accumulate, two of them quietly rewrite the same history, one wants to run before a decision another one has already made, and the order they compose in was never a decision anybody took. Ordering is part of the design, not an implementation detail. A passport desk placed after the plane has left is not a slow control. It is no control.

Behaviour you declare instead of behaviour you code

The pattern is spreading upward. Enterprise runtimes now settle on one abstraction covering agents, tools, memory, middleware and workflow, and let you state the whole shape in a file: instructions, tools, memory, and the topology connecting them, versioned and reviewed like code. A graph handles branches, fan-out, joins and checkpoints. A team describes a writer and a reviewer in sequence, then in production adds a content safety layer and swaps the model provider without rewriting the workflow, while a visual debugger replays messages, tool calls and routing decisions.

The corridor teaches the caveat too: the same procedure at two airports is not the same experience. Protocols that reach remote agents and external tools make things connectable, not equivalent, and a graph that survives a provider swap on paper still needs its branches and checkpoints tested in practice. What travels is the direction. The loop belongs to you, and so does everything standing around it. An agent you can trust does what you declared beside it, not what you asked it to do.