▸ A definition, for people who have shipped enough to be suspicious of new ones
The claim
Agentic engineering does not make your experience less valuable. It moves where that experience creates leverage — from the code you personally write to the systems that write code on your behalf.
You spent them learning where boundaries belong, which abstractions survive contact with scale, and how systems fail at three in the morning. Those judgments used to be applied while writing the software. They can now be applied while governing machines that write it — which is a much larger surface.
Agentic engineer · the definition
Designs, builds, governs, and validates systems in which AI can reason and act toward an outcome while remaining inside explicit architecture, authority, data, tool, and human-control boundaries.
Note what the definition does not say. It does not say “someone who builds agents.” That is a component. This is the system the component runs inside.
Where AADM fits
Agentic engineering is the discipline. AADM is one operating model for practising it — an open standard plus a hosted MCP that carries the standard to whatever tool you happen to be using.
You can adopt the discipline without buying anything. The standard is public.
For twenty years, a senior engineer was the transformation from requirement to running software. Every step in that chain ran through one person. AI can now perform much of the mechanical execution — which changes the shape of the chain, not the need for someone who understands it.
The last twenty years
Every transformation between a requirement and shipped software passed through one person's head and one person's hands.
Judgment applied one line, one ticket, one pull request at a time. Throughput capped by the number of hours you have.
Agentic engineering
Machines perform the mechanical execution. You set the frame it executes inside, and you keep the decisions that are actually decisions.
Judgment encoded once, then re-applied by machines on every turn. Throughput capped by how well you specified the frame.
Read the two together and the change is easy to state: the scarce skill moves from producing code to exercising engineering judgment over machines that can produce code. Production capacity stopped being the constraint. Knowing what should be produced, and what should never be, became the constraint.
The economics, restated
Your value used to be “I can build this complicated system.”
It becomes “I can architect a system that humans and AI agents can safely build, operate, diagnose, and evolve at much greater speed.”
This is not a list of things AI will eventually learn. It is a list of judgments that require holding a system's future in your head — and each one has a characteristic way an unguided agent gets it wrong.
lands at · L6 vs L7
The agent failure
Puts the check wherever the call site happened to be. Validation lands in the domain layer because that file was already open.
The agent failure
Optimizes for the diff that passes today. It has no model of the maintenance cost it is transferring to someone else in eighteen months.
lands at · L4–L8
The agent failure
Adds a nullable column to make the failing test green, and the data model quietly stops describing the business.
lands at · L11 vs L18
The agent failure
Puts the permission check in the controller, so authorization becomes something you audit per route forever instead of per band once.
The agent failure
Extracts a helper on the second occurrence and calls it architecture. It cannot tell a real seam from a coincidence.
The agent failure
Has never been paged. Retries, partial writes, clock skew, and thundering herds are not in the diff it is looking at.
lands at · L21–L22
The agent failure
Cannot distinguish passing from correct. Green is the only signal it has, so green is the answer it optimizes toward.
None of these are model-intelligence problems, which is why waiting for a better model does not solve them. They are context problems: the agent has no durable reference for where your boundaries are, which controls bind, or what your team means by done. Give it that reference and most of the column on the right stops happening.
Hand a capable model an ambiguous task with no architecture, no boundaries, and no gates, and you get exactly what you would get from a bright graduate with root access and no supervision — except at machine speed.
That isn't leverage. That's faster technical debt.
“They appeared related” is a perfectly honest answer. Proximity in a vector space is the only signal the agent had, because nobody gave it a better one. The fix is not a stern prompt. It is a durable frame the agent loads before it starts reasoning.
This is the whole discipline compressed into a brief. If you can hand a machine all nine of these and have them hold across sessions, engineers, and tools, you are doing agentic engineering. If you cannot, you are prompting — and hoping.
Here is the outcome.
A scoped plan with acceptance criteria per slice, written before any edit.
plan_delivery · slice_issues
Here is the architecture.
UDALI band placement — which of the 22 layers this work actually belongs in.
map_feature · architecture_lens
Here are the boundaries.
The numbered seam archetypes this change crosses, read from the standard.
fetch_seam
Here is where AUTH belongs.
The numbered authorization controls that bind — verbatim, not paraphrased.
fetch_auth
Here are the tools you may use.
A typed, versioned tool surface. The agent cannot reach past it.
tools/list
Here are the layers you may change.
Ownership patterns mapped to real paths in your repository.
.aadm/config.json
Here is what you must not touch.
Stage gates that hold. Evidence lands before a fix does.
debug_defect · Path A → Path B
Here is the evidence required.
Proof bound per crossing, in language an auditor will accept.
audit_run · sentinel_closure
Now execute.
The right workflow for the question asked — not whichever instinct fired first.
route_lane
The right-hand column is the part that is easy to underestimate. Any of these nine can be written into a prompt once. The engineering problem is making them survive — across a new session, a different engineer, a different IDE, and the model release that quietly changed how your prompt is interpreted.
These titles get used interchangeably in job postings, which is unhelpful, because they describe genuinely different scopes of responsibility. The distinction that matters is what breaks when you get it wrong.
Builds deterministic capability
Given the same input, the system does the same thing. Correctness is something you can reason about statically, and the failure modes are the ones you were trained on.
What you now own
Adds intelligence
The system now produces outputs you cannot fully predict from the code. Evaluation replaces some of what unit tests used to do, and “correct” becomes a distribution rather than a value.
What you now own
Adds goal-directed action
The system does not just answer — it acts. Now you own tool surfaces, loop termination, state between turns, and the blast radius of a wrong decision taken confidently.
What you now own
Engineers the whole system
Architecture, agents, harness, authority, context, observability, evaluation, and human governance as one designed system — where humans, deterministic software, and reasoning machines each hold the part of the work they are actually good at.
What you now own
Each rung keeps everything under it. An agentic engineer has not stopped being a traditional engineer — the deterministic parts of the system are still where most of the correctness lives, and knowing which parts should stay deterministic is itself one of the judgments a model cannot make for you.
Most confusion in this space comes from collapsing seven distinct things into the word “AI.” They answer different questions, they fail differently, and they are owned by different people. Naming them separately is the first useful thing this vocabulary does.
Agentic engineer
Who is accountable
The role. A person, not a product — the one who answers for the result.
AADM
How work is governed
Three lanes with stage gates: Navigator for delivery, Investigator for defects, Sentinel for assurance.
UDALI
Where responsibility belongs
Twenty-two layers in five bands. The shared vocabulary for naming where a change lives.
Harness
How agents are controlled
Cursor, Claude Code, Windsurf — the execution environment that decides what the model can actually run.
MCP
How governance context is provided
One Streamable HTTP endpoint the harness loads every session, so every seat gets the same standard.
Agent
What reasons and acts
The model in the loop. Fast, tireless, and entirely dependent on the frame you gave it.
Tools
What the agent can do
The typed surface. If it is not a tool, it is not an available action.
Read the middle column top to bottom and you have a chain of custody for a decision: a person is accountable, a model is governed, a vocabulary says where things belong, a harness constrains execution, an endpoint supplies the context, an agent acts, and a tool list bounds what acting can mean.
There is a temptation to file this role next to the models — one band, one specialism, someone else's problem the rest of the time. That misreads it. The whole point is that an agent's change can land in any of twenty-two layers, so someone has to hold the shape of all of them. UDALI is the vocabulary for doing that out loud.
The span
A staff engineer is usually deep in two or three bands. An agentic engineer has to hold the shape of all of them at once, because the agent will happily cross every boundary in a single commit unless someone named where the boundaries were.
Unifier
L1–L3
Interface
The judgment call
Protected from backend churn. These never change in response to a backend change — an agent that “tidies” them while fixing a service has already broken the rule.
Designer
L4–L8
Data shape
The judgment call
Validation belongs at L7, the boundary contract — not L6, the pure domain. This is the single most common misclassification, human or machine.
Adapter
L9–L12
Access + identity
The judgment call
Permission checks live at L11. When they drift up into a controller, authorization becomes something you have to audit per route instead of per band.
Logician
L13–L16
Business orchestration
The judgment call
Services own use-case shape. Your product's own runtime agents live at L15 — which is why this band is where the two loops meet.
Integrator
L17–L20
Request + edge
The judgment call
The edge is thin on purpose. Anything an agent adds here that is not transport, shaping, or dispatch is logic that escaped its band.
Integrator
L21–L22
Quality + release
The judgment call
Where evidence is produced rather than asserted. A green pipeline is an input to a release decision, not the decision itself.
The value of a layer vocabulary is not taxonomy for its own sake. It is that “this belongs at L11, not L18” is a reviewable statement, and “that feels like it's in the wrong place” is not. Features move through clean handoffs between bands instead of being dropped whole into one monolithic implementation pass.
Between you and the agent sits a harness, and between the harness and the standard sits an endpoint. That middle span is the part teams usually improvise — a folder of prompt files, a rules doc somebody maintains, a pinned Slack message. It is also the part that decides whether your discipline survives the next session.
Agentic engineer
Names the outcome, the architecture, and the constraints
AI coding harness
Cursor · Claude Code · Windsurf · anything that speaks MCP
AADM MCP
Streamable HTTP · versioned tools, doctrine, and gates
carries three things
Which of the three lanes this task belongs to, and the stage gates that come with it.
Which numbered controls bind here — read from the standard, not paraphrased from memory.
Which of the 22 layers this work belongs in, and which ones it has no business touching.
Coding agent
Reasons and acts — inside the frame set above it
Your application
Where AUTH is actually enforced and “done” is actually proven
Read the stack downward and it is a governance path. Read it upward and it is an accountability path: when the application does the wrong thing, the answer is never “the model did it.” It is that somebody's frame was wrong, and that somebody is at the top.
This is the distinction that most cleanly separates agentic engineering from prompt engineering. There is a loop that builds your product and a loop that runs inside it, and the same person is responsible for the design of both — even though only one of them is visible in a pull request.
Agentic engineer
Owns the design of both loops
Development loop
Runtime loop
The two loops are not independent. The development loop decides what the runtime loop is allowed to do — which tools exist, where authorization sits, what gets logged, what a bad decision can reach. Govern the first one badly and you have shipped an ungovernable second one.
This is not a pitch for AI.
You do not need to be convinced that models are useful; you have already formed a view, probably an evidence-based one. The argument here is narrower and it is about leverage. You spent twenty years learning how software should be built. Agentic engineering is how that knowledge stops being applied one pull request at a time and starts being encoded into architecture, constraints, tools, and harnesses that let machines execute repeatedly without abandoning engineering discipline.
AADM is one way to do that. It is a standard and a context service — deliberately not an enforcement product. Being clear about that boundary is the only way the rest of it stays credible.
What AADM deliberately does not do
Your production authorization, gateways, tests, and CI stay authoritative. The last line on that list is not a limitation to be engineered away — it is the job description.
▸ Six directions
The standard is free to read and lives in public. The hosted MCP exists so the same text reaches every agent, every session, without anyone maintaining a fork.
The same argument aimed at the failure modes: what an unguided loop does to a codebase, side by side with what a governed one does.
UDALI layers, the AUTH catalog, the SEAM catalog, and the workflow definitions. Public, free, and adoptable without buying anything.
Every typed tool an agent can call, grouped by lane. This is the concrete answer to “what may the agent do.”
One Streamable HTTP endpoint, every MCP-capable client. Cursor and Claude Code have their own walkthroughs.
Optional. Put UDALI paths and lane defaults in a versioned .aadm/config.json so the boundaries follow the repo, not the engineer.
Due-diligence answers, rollout stages, and the boundary language for security and procurement conversations.