AI Agent System Design: A Hands-On Guide to Building Reliable Multi-Agent Software with Specification-Driven Workflows, Governance, and Automation (AI Systems in Practice)

Your AI agent read the rules file. It ignored the rules anyway.

Teams building with AI coding agents eventually hit the same wall. You write the conventions down. The agent honors them until it encounters pressure — a failing test, a shrinking context window, an ambiguous ticket — and then it does something else. The usual conclusion is that the prompt needs work.

A better prompt alone won't fix it. Instructions guide behavior. Enforcement limits what can happen. Until you can tell which of your controls is which, you are not engineering a system. You are hoping.

AI Agent System Design is a hands-on book about building that system: the permissions, containment boundaries, specifications, review gates, automation and measurement that turn a capable but unreliable model into a bounded engineering process.

One project runs through the entire book — a TypeScript payments service, and the deceptively small job of making a single endpoint idempotent — because none of this becomes real until something can charge a customer twice.

You'll learn how to build and evaluate:

• Three control layers that act at different moments: prevention before the action, promotion gates before the merge, and detection and attribution afterwards
• Containment that reduces the blast radius of prompt injection and other untrusted content, designed on the assumption that boundaries will be tested
• Specifications whose acceptance criteria name their own verification, so "done" stops being a matter of opinion
• A debugging protocol that produces trustworthy evidence a defect is fixed, rather than a test quietly rewritten to pass
• Multi-agent handoffs that carry decisions instead of transcripts, with the evidence needed to decide whether a second agent earns its cost
• Eval sets, paired runs and confidence intervals, so that "it got better" becomes a claim you can defend in a design review

Prompt injection is not solved, and these pages cite the primary sources that say so. Multi-agent architectures are not universally better; one chapter shows you how to evaluate them on your own codebase rather than take anyone's word for it. A twenty-task eval suite is a baseline, not a license for autonomy.

Written for software engineers, tech leads and platform teams running — or preparing to run — agents against real repositories, and for anyone accountable for what those agents are allowed to touch. Examples use Google Antigravity, Claude Code and ordinary CI; the architecture is portable by design, with repository guidance in AGENTS.md, an open format read by Codex, Cursor and a growing ecosystem of coding agents. Not a book of prompt templates or tool roundups.

The engineer's job did not disappear. It moved — to saying precisely what correct means, drawing the boundaries an unreliable process is allowed to work inside, and building the machinery that catches it when it is wrong.