Agentic AI Systems: Architectures, Autonomy, and Emergent Behaviours

<p><b><i><span>Background.</span></i></b><span> Agentic artificial intelligence systems, defined by their capacity to reason, plan, and act autonomously through external tools and environments, represent a categorical shift in the operational profile of deployed AI. Architectures grounded in reasoning-and-acting paradigms, plan-and-execute decompositions, and tool-augmented designs have moved from research prototypes into enterprise deployment within three years, yet the security, safety, and governance literature has not kept pace with the speed of operational adoption.</span></p> <p><b><i><span>Purpose.</span></i></b><span> This paper synthesises the contemporary literature on agentic AI architectures, autonomy taxonomies, emergent behaviours, memory and state management, and evaluation methodologies. It positions agentic AI as a distinct security and governance category requiring frameworks not satisfied by predictive AI controls, large language model controls, or traditional software assurance practices.</span></p> <p><b><i><span>Approach.</span></i></b><span> The paper adopts a narrative literature review methodology drawing on authoritative primary sources, including the OWASP Top 10 for Agentic Applications (2025), the Cloud Security Alliance MAESTRO framework (2025), the DeepMind Levels of AGI autonomy taxonomy (Morris et al., 2024), foundational agent architecture research (Yao et al., 2023; Wang et al., 2024), and the emerging agentic red-teaming and evaluation literature.</span></p> <p><b><i><span>Findings.</span></i></b><span> Three structural findings are advanced. First, agent architectures introduce attack surfaces (tool invocation, memory persistence, multi-step reasoning trajectories) that have no direct analogue in either traditional software or non-agentic AI systems. Second, autonomy is best treated as a continuum, operationalised through delegation boundaries, rather than as a binary property, with distinct security implications at each level. Third, evaluation methodologies designed for static models systematically underestimate risk in dynamic agentic systems, requiring red-teaming approaches that test for emergent behaviours, goal drift, and cascading failures across multi-step trajectories.</span></p> <p><b><i><span>Implications.</span></i></b><span> Practitioners deploying agentic AI require architecture-aware governance: tool-invocation controls, memory-hygiene practices, autonomy classification at the system-design stage, continuous behavioural monitoring, and red-teaming methodologies tailored to multi-step agent operations. The paper provides a structured reference for translating architectural choices into security and governance controls.</span></p>