- Home
- AI agents
Guide · Plan, Build, Govern and secure, Operate
Enterprise AI agents: the complete guide
Enterprise AI agents are software systems that take a goal, plan the steps, call tools and company systems, and act inside limits the company sets. This guide covers the whole lifecycle: what agents are, how to build them, how to govern and secure them, and how to run them in production on Microsoft, AWS and Google clouds.
In this guide: 83 pages
We wrote this guide for two readers at once: the IT leader who has to decide what to allow, and the developer who has to build it. Each page gives the plain idea first and the technical term once, shows the controls, names the trade-offs and says when not to do something. Every product name and status is as of 2 November 2026, and every page ends with a dated list of sources.
The guide follows one lifecycle: Plan, Build, Govern and secure, Operate. The same strip appears on every page with the current phase highlighted. Fourteen topics hang off it, each with its own sub-pages. Pages marked "coming" in the sidebar are in the second release.
The lifecycle, and the topics in each phase
- Phase 01
Plan
What an agent is, where it pays off, and what the published examples actually show.
- Phase 02
Build
Tools and MCP, memory, knowledge, orchestration, and the platform you build on.
- Phase 03
Govern and secure
Registry, identity, guardrails, threats and the regulation that applies.
- Phase 04
Operate
Tracing, cost, evaluation and the retest when a model changes.
What an enterprise agent is made of
Every topic in the guide maps onto one part of this picture: the request path across the top, and the four controls that sit outside the model along the bottom.
The fourteen topics
Plan
What is an AI agent?
Software that takes a goal, plans the steps, calls tools and systems, and acts within limits you set.
Enterprise AI agent examples
Publicly reported deployments by function and industry, with the figures each company published.
- IT service desk
- Finance and accounting
- Customer service
- HR and onboarding
- Procurement
- Legal and contracts
- Sales
- Supply chain and field service
- Software engineering
- Security operations
- Knowledge search
- Examples by industry
- Measuring AI agent ROI
Build
Tools, MCP and agent-to-agent
How agents call tools through the Model Context Protocol and talk to each other through A2A.
- What is MCP?
- MCP security
- MCP vs A2A
- MCP gateways and registries
- Tool calling and actions
Agent memory and context
What an agent remembers within a task and across tasks, and how to keep that memory private.
- Types of agent memory
- Context engineering
- Memory privacy and retention
Knowledge and retrieval
How agents find and cite company knowledge, with the permissions each user already has.
- Agentic RAG vs RAG
- Permission-aware retrieval
- Knowledge graphs and GraphRAG
Orchestration and multi-agent systems
When one agent is enough, when several are needed, and where a person approves the result.
- Multi-agent patterns
- Workflows vs agents
- Human in the loop
- Long-running agents
Platforms and frameworks
Copilot Studio, Microsoft Foundry, Amazon Bedrock AgentCore and Gemini Enterprise Agent Platform compared.
- Copilot Studio vs Microsoft Foundry
- Microsoft vs AWS vs Google
- Agent frameworks compared
- Build vs buy
- Reference architecture on Azure
- Reference architecture on AWS
Govern and secure
AI agent registry and sprawl
One record per agent, with an owner, an identity, a risk tier and an approval state, so sprawl has somewhere to stop.
- What is an AI agent registry?
- Controlling agent sprawl
- Shadow AI
- Citizen-built agents
- Agent lifecycle management
Agent identity and access
Each agent gets its own identity and acts either for a user or as itself, with short-lived, scoped tokens.
- What is agent identity?
- On-behalf-of vs autonomous access
- Least privilege and sandboxing
Guardrails
Checks on what goes into an agent, what it does with tools and what comes out, enforced outside the model.
- Input and output guardrails
- Approval gates and limits
- Guardrails on Azure, AWS and Google
Security threats to agents
Prompt injection, tool abuse and the OWASP agentic top 10, with the incidents that made them real.
- Prompt injection
- OWASP Top 10 for Agentic Applications
- Agent platform vulnerabilities
- Data protection for agents
Governance and regulation
What the EU AI Act, NIST and ISO 42001 ask of a company that deploys agents, and who signs for what.
- EU AI Act and AI agents
- NIST AI RMF and ISO 42001
- Model risk for banks and insurers
- Operating model and maturity
- Audit trails
Operate
Observability and cost
Traces of every model call and tool call, what to log, and where the money goes.
- Tracing AI agents
- What to log
- Agent cost monitoring
- Alerting and incident response
Evaluation and testing
Acceptance criteria, offline and online evaluation, red teaming and the retest when a model changes.
- Acceptance criteria for AI agents
- Offline and online evaluation
- Red teaming AI agents
- Regression testing when models change
Glossary
Glossary
About 70 terms, A to Z, each in one or two sentences.
Start here, by role
IT leader
Decide what to allow and what it will take to run.
Architect
Choose the platform and the controls around it.
Developer
Build one agent that survives contact with production.
Risk and compliance
Know what the regulation asks and what the controls prove.
How do Microsoft, AWS and Google compare?
The building blocks every cloud converged on in 2026, named the way each vendor names them. Statuses are as the vendor pages showed on 2 November 2026; GA means generally available.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Build tool | Copilot Studio (low-code) and Microsoft Foundry Agent Service (pro-code); Microsoft Agent Framework 1.0 (GA 3 Apr 2026) replaces Semantic Kernel and AutoGen | Amazon Bedrock AgentCore with Strands Agents or any framework; Amazon Bedrock Agents is now "Classic" and closed to new customers since 30 Jul 2026 | Agent Development Kit (ADK Python 2.0 GA 19 May 2026) and Agent Designer in Gemini Enterprise |
| Runtime | Foundry hosted agents (GA per Azure update of 2 Jun 2026; Microsoft’s Build recap said early July) and prompt agents; Copilot Studio harnesses | AgentCore Runtime (GA 13 Oct 2025); managed harness GA 17 Jun 2026 | Agent Runtime, formerly Vertex AI Agent Engine (renamed 22 Apr 2026) |
| Identity | Microsoft Entra Agent ID (GA, Learn page dated 1 May 2026) | AgentCore Identity (GA 13 Oct 2025) | Agent Identity, SPIFFE-based (API in preview since 18 Jun 2026) |
| Registry | Agent 365 registry (GA 1 May 2026); sync with AWS and Google in preview | AWS Agent Registry (GA 31 Aug 2026) | Agent Registry (GA 18 Jun 2026) |
| Gateway | Foundry Toolboxes (preview); Azure API Management AI gateway with MCP support | AgentCore Gateway (GA 13 Oct 2025) with AgentCore Policy (GA 3 Mar 2026) | Agent Gateway (GA 18 Jun 2026) |
| Guardrails | Azure AI Content Safety Prompt Shields (GA since Aug 2024); Foundry agent guardrails on tool calls (preview) | Amazon Bedrock Guardrails (GA); Automated Reasoning checks (GA 6 Aug 2025) | Model Armor (since Feb 2025); Agent Gateway integration GA 24 Jun 2026 |
| Observability | Foundry tracing (GA for prompt and hosted agents; workflow agents preview); Application Insights Agents view (preview) | AgentCore Observability and CloudWatch generative AI observability (GA 13 Oct 2025) | Agent Observability (GA 18 Jun 2026) |
| Evaluation | Foundry agent evaluators (several in preview); Copilot Studio agent evaluation (GA Mar 2026) | AgentCore Evaluations (GA 31 Mar 2026, 13 built-in evaluators) | Gen AI evaluation service with agent evaluation; ADK evaluation |
Names changed often in 2026: Azure AI Foundry became Microsoft Foundry, Vertex AI became Gemini Enterprise Agent Platform, and Google Agentspace became Gemini Enterprise. The guide uses the current name and mentions the old one once.
Enterprise examples
The examples topic collects publicly reported deployments by function and industry, with the figures each company or vendor published. None of these is a QueryNow client, and each figure is the publisher’s own claim.
Cox Automotive
Scaled from zero to 17 production AI agents in under a year on Amazon Bedrock AgentCore, using AgentCore Identity for permission management.
Publicly reported by AWS, case study page undated (copyright 2026)
Commerzbank
Its "Bene" assistant on Google Cloud handles over two million chats and resolves 70% of inquiries.
GE Appliances
More than 800 AI agents deployed across manufacturing, logistics and supply chain on Google’s agent platform.
Thomson Reuters
An agentic platform engineering hub on AgentCore where an A2A registry requires human validation before a new agent enters production.
Glossary, the short version
The full glossary holds about 70 terms, A to Z. These eight come up on every page.
- AI agent
- Software that takes a goal, plans steps, calls tools and acts within limits, with a model doing the reasoning.
- MCP
- Model Context Protocol, the open standard agents use to call tools and read data; current specification 2026-07-28.
- A2A
- Agent-to-agent protocol for agents that call each other; version 1.0.0 since 12 Mar 2026.
- Agent identity
- A non-human identity of its own for each agent, used to allow, limit, log and revoke what it does.
- Agent registry
- The master list of agents, one record each, with owner, identity, risk tier and approval state.
- Shadow AI
- AI that staff use or build without IT knowing or approving it.
- Guardrails
- Checks on inputs, tool calls and outputs, enforced outside the model.
- Evaluation
- Tests that score an agent against acceptance criteria, offline before release and online in production.
What changed
Dated changes that affect what the guide says. We add a line each time a page is reviewed.
Guide published with the hub, the registry topic and its first sub-page. All statuses checked against vendor pages on this date.
AWS Agent Registry generally available in five Regions; the preview bedrock-agentcore namespace retired on 30 Oct 2026.
Amazon Bedrock Agents renamed Agents Classic and closed to new customers; AWS points new work to Bedrock AgentCore.
MCP specification 2026-07-28 published: stateless core, Dynamic Client Registration deprecated, Enterprise-Managed Authorization extension stable.
Google Agent Registry, Agent Gateway and Agent Observability generally available in Gemini Enterprise Agent Platform; Agent Identity API in preview.
Microsoft Agent 365 generally available for commercial customers; Microsoft Entra Agent ID generally available; registry sync with AWS and Google in public preview.
Google renamed Vertex AI to Gemini Enterprise Agent Platform and Agent Engine to Agent Runtime.
Microsoft Agent Framework 1.0 generally available, succeeding Semantic Kernel and AutoGen.
AgentCore Evaluations generally available with 13 built-in evaluators; AgentCore Policy had gone generally available on 3 Mar 2026.
A2A protocol version 1.0.0 released with signed agent cards.
Frequently asked questions
What is an enterprise AI agent?
Software that takes a goal, plans the steps, calls tools and company systems, and acts inside limits the company sets, with a language model doing the reasoning. The enterprise part is the limits: an identity of its own, a registry record, guardrails on what it can do, and traces of what it did.
How is an agent different from a chatbot or from Microsoft 365 Copilot?
A chatbot replies to a question. An agent takes a goal and carries out the steps, including actions in other systems. Microsoft 365 Copilot is an assistant that works beside a person inside Microsoft 365; Agent Builder creates declarative agents from your own knowledge sources inside it, and taking actions in other systems needs Copilot Studio. The what-is-an-AI-agent topic covers agents against copilots, chatbots and RPA.
Which platform should we build on?
Usually the one where your data and identities already live. Microsoft 365 and Azure tenants start with Copilot Studio and Microsoft Foundry; AWS accounts start with Amazon Bedrock AgentCore; Google Cloud projects start with Gemini Enterprise Agent Platform. The platforms topic compares them on build, runtime, identity, registry, gateway, guardrails, observability and evaluation.
Do agents need their own identity?
Yes. Running an agent as a human user or a shared service account breaks audit, Conditional Access and lifecycle. All three clouds now give each agent its own identity: Microsoft Entra Agent ID, AgentCore Identity and Google Agent Identity.
What is agent sprawl, and how do we stop it?
Too many agents, often duplicated, ownerless or abandoned, across platforms with no central list. You stop it with a registry that has an owner, an identity, a risk tier and an approval state per agent, and with rules that reassign or block ownerless agents. The registry topic shows how.
Does the EU AI Act apply to AI agents?
Yes. Since 2 August 2026 the Article 50 transparency duty applies, and the Commission’s own examples include an AI agent. High-risk obligations for Annex III uses apply from 2 December 2027 after the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026). The governance topic covers the dates and the deployer duties.
How do we know an agent works before we switch it on?
With acceptance criteria written before the build and an evaluation set run against them, then again whenever the model, a prompt, a tool or a connected system changes. The evaluation topic covers offline and online evaluation, red teaming and regression tests at model change.
How current is this guide?
Every page shows its review date and lists dated sources. Product names and statuses were checked on 2 November 2026. Microsoft Ignite and AWS re:Invent in late 2026 are the next scheduled review triggers, and the What changed log on this page records each update.
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- What is Microsoft Foundry
- Microsoft Foundry Agent Service overview
- Microsoft Agent 365 now generally available
- What’s new in Microsoft Entra Agent ID
- Microsoft Agent Framework 1.0
- Set up tracing for agents in Microsoft Foundry
- Guardrails and controls in Microsoft Foundry
- What’s new in Copilot Studio
- Amazon Bedrock AgentCore is now generally available
- Policy for Amazon Bedrock AgentCore generally available
- AgentCore Evaluations generally available
- AWS Agent Registry now generally available
- Amazon Bedrock Agents Classic maintenance mode
- Automated Reasoning checks in Amazon Bedrock Guardrails generally available
- Gemini Enterprise Agent Platform release notes
- Welcome to Google Cloud Next ’26
- Introducing Gemini Enterprise
- Model Armor release notes
- Model Context Protocol specification versioning
- A2A protocol specification, version 1.0.0
- Cox Automotive case study
- How Thomson Reuters built an agentic platform engineering hub with Amazon Bedrock AgentCore
- EU Digital Omnibus on AI enters into force
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner