Architectural Challenges of Modern LLM Agents

An LLM agent differs from a regular software client in that a probabilistic model sits between intention and action. While an agent only responds with text, the cost of an error is limited to the response. When it is given memory, APIs, tools, and the right to modify real data, standard architectural solutions begin to exhibit new classes of risk.

This concept serves as a common node for systematizing such problems. It does not claim that all the listed issues are already solved or even fully formulated. The goal is to accumulate real-world observations from agent operations, connect them with existing engineering practices, and gradually outline agent-native architectural principles.

Already Noticeable Problem Classes

• Mutation Granularity. An agent is often given a full entity replacement CRUD operation, even though its intention pertains to only a single fragment. This increases the potential error surface.
• Stale Context and Change Concurrency. Between reading and writing, an object may be changed by another user, agent, or process.
• Validation and Impact Limiting. A tool must not only allow an action, but also check its preconditions and limit the scope of modification.
• Reversibility. Agentic changes should ideally be made observable, verifiable, and rollbackable.
• Context and Its Transmission Cost. A more structured data representation can increase reasoning reliability, but sharply increase the token count and interaction cost.
• Tool Semantics. It is important for an agent to understand not only the parameter schema, but also the properties of the operation: whether it modifies state, is destructive, is idempotent, or can be safely retried.

Connection to Existing Approaches

The problem of partial changes did not appear with LLMs. HTTP PATCH was standardized precisely for the partial modification of a resource instead of a complete replacement: RFC 5789. For structured JSON documents, there is JSON Patch — RFC 6902.

Modern coding agents also use granular-edit approaches. OpenAI provides the Apply Patch tool, where the model creates, updates, and deletes files via structured diff operations instead of needing to return the full file. The GitHub Copilot coding agent makes changes in a separate branch and prompts the user to review the final diff: GitHub Copilot coding agent.

At the tool protocol level, MCP separately describes tools as external impact operations, and the evolution of the specification introduces a risk vocabulary around readOnly, destructive, idempotent, and other properties: MCP Tools specification, Tool Annotations as Risk Vocabulary.

These practices solve different parts of the overall problem, but do not form a ready-made universal architecture for the secure editing of arbitrary CMS content by LLM agents.

Current Status

This is a research direction. The implementation of a general agent-safe mutation layer in haih-agent has not yet started. Individual problems will be spun off into child concepts as they manifest in real work and become sufficiently clear for substantive analysis.