Guardrails for AI Native SDLC - Two architectural patterns

The industry talks about "AI Agents" as if they all work the same way. They don't.

Broadly, there are two architectural patterns.

Pattern 1: Programmatically Orchestrated Agentic Systems

Examples:

• LangGraph

• Semantic Kernel

• AutoGen

• OpenHands (parts of its execution model)

Here, an application orchestrates the execution.

The framework decides:

• which agent runs next

• when to invoke tools

• branching and loops

• retries

• approval gates

• state transitions

• memory management

The LLM is primarily responsible for reasoning and generating outputs, but it is not in complete control of the execution flow.

A simplified view looks like this:

User
   │
Application / Framework
   │
Planner
   │
Developer Agent
   │
Reviewer Agent
   │
Tester Agent
   │
Deploy

The framework is deterministic. The LLM participates inside individual steps.

Pattern 2: Prompt-Orchestrated Agentic Systems

Examples include many VS Code workflows using GitHub Copilot custom agents, BMAD-style agent definitions, prompt libraries, skills, and markdown-based workflows.

What appears to be:

• Agent

• Skill

• Workflow

• Persona

• Checklist

is often implemented as prompt context supplied to the LLM.

The execution is closer to:

User Prompt
        +
Agent Instructions
        +
Workflow Instructions
        +
Skills
        +
Context Files
        ↓
      LLM
        ↓
Reasoning
        ↓
Tool Usage
        ↓
Response

The LLM is simultaneously:

• planner

• controller

• executor

• reviewer (if instructed)

• tool user

There is usually no external engine enforcing that Step 1 must complete before Step 2, or that every checklist item must be followed. The LLM is expected to follow the instructions, but it can also skip, reorder, or partially apply them.

This distinction is important.

Many teams believe they have built a deterministic workflow because they have "agents" and "skills." In reality, they have built a sophisticated prompt that relies on the LLM to faithfully execute it.

That doesn't make it a bad approach. It simply means the engineering challenges are different.

In deterministic frameworks, guardrails are often implemented as executable code and policy.

In prompt-orchestrated systems, guardrails are largely behavioral instructions unless backed by external validation.

Understanding which architecture you're building is the first step toward designing effective Agentic SDLC guardrails.

In the next post, we'll look at what guardrails actually are, the different types of guardrails, and why the implementation strategy is fundamentally different between deterministic frameworks and prompt-orchestrated systems.