If you accept that the executable runtime is the least valuable part of an agent graph, the obvious question is what the valuable parts are. Three things, in our experience. None of them require a framework, all of them are available in any stack, and each one exists because we got it wrong first.
One: edges declared as data, validated before runtime.
Every node in our pipelines emits the same handoff envelope. It’s a JSON Schema document with required keys: which node just ran, which node should run next, what inputs this node required, what artifacts it produced, and the run identifier that ties the whole execution together. Two details make it more than documentation. First, the declared prerequisites are typed by name and by where the state lives: artifact, database, or both. A node doesn’t merely declare that it needs an approved scenario model; it declares which channel to read it from. That’s the difference between a dependency comment and a dependency contract. Second, the schema carries a literal machine-readable adjacency list, and a test suite parses every node’s declared downstream pointer and asserts it matches the expected edge. Miswire an edge and the build fails, with an error that names the consequence rather than the symptom.
Compare that to a graph defined in code. In LangGraph, a wrong edge is a runtime discovery. You find out when execution takes a path you didn’t intend, usually deep into a long run, usually by noticing the output is wrong. In a contract-defined graph, the edge is a fact that can be wrong in a detectable way before anything executes. For a system whose output is a client deliverable, “detectable before execution” is worth considerably more than “recoverable at runtime.” In service-blueprint terms, it lifts the backstage row above the line of visibility for the one reader whose signature ends up on the deliverable.
An honest note on how this happened: the chain existed as an informal convention for roughly two months before anyone wrote the schema. The formalization was a retrofit. I’d argue that ordering is correct rather than embarrassing. A contract written before you know the shape encodes your guesses. You learn the real shape of the graph by running it badly a few times.
Two: gates typed by severity, and moved out of the prompt.
Every serious treatment of agent graphs mentions human-in-the-loop. Almost none of them address the failure mode that actually kills it in practice, which is that if every gate blocks, operators rubber-stamp, and the gate becomes theater.
So we type them, and the types are not new. They are the authority bands the rest of our practice already runs on, implemented as pipeline gates: the agent acts where a step is mechanical and reversible, the agent proposes where policy or interpretation is involved, a human decides where a signature, a liability or a cost commitment is at stake. A blocking HALT stops the pipeline cold and requires explicit sign-off: the quality audit, the terminal portfolio review, the point where a load-bearing analytical assumption gets locked. A REVIEW checkpoint surfaces the work and continues. Our workbook-assembly node has one, and its documentation is explicit that this is a review and not a HALT, because the underlying numbers were already approved two nodes upstream. Gating them twice would train the operator to stop reading.
The gates also do more than pause. Our quality node has three outcomes, not two: accept, reject, or request fixes, and reject routes backward to the build node, which re-runs, which re-enters QA. That back-edge means the graph is cyclic-with-a-gate, not a DAG. The industry says “DAG” in its architecture diagrams and then ships loops, because rework is not an exception in real delivery; it’s a designed-in path.
The sharpest version of this, and the one I’d point at first if you only change one thing: put the gate in the tool surface, not in the prompt. One of our MCP servers splits querying into a planning call and an execution call. The planning call returns a proposed query for the operator to approve; only then does execution happen. Underneath, the raw-data tier runs a count first and, past a threshold, returns options rather than rows. A gate written into a system prompt is a suggestion the model can reason its way around. A gate expressed as two separate tools with an approval between them is a gate.
Three: state versioned, with a ledger.
Every node persists its output under a versioned envelope: a current-version flag, a version number, a superseded-by pointer, and an enumerated reason for the supersession. Every run stamps an identifier and writes a completion row to a run-tracking table. This is unglamorous and it is the single feature that most justifies the whole approach. It is also the plainest statement of a rule we apply everywhere else: the record is the deliverable, and the pages are drawn from the record rather than the other way round. The question a client asks six months after delivery is almost never “what does the model say.” It’s “why did this number change from the last version.” A run ledger with typed supersede reasons answers that in about ninety seconds. A stateless graph executor that recomputes on demand cannot answer it at all, because the prior state simply isn’t there.
The version lineage also produces a governance signal we didn’t design for and now rely on. Compare when an aggregate was computed against the most recent edit time of any input feeding it, and you get dependency staleness for free. The operator console surfaces it as a banner: this rollup is older than its inputs, re-run it. That’s a graph-derived governance primitive, and it exists only because the edges are declared somewhere a dashboard can read them.
Which brings up a gap I’d argue the field hasn’t named yet. Engineer-facing instrumentation is now close to universal. LangChain’s June 2026 survey of 1,340 practitioners found 89% have some form of agent observability and 62% have step-level tracing. And quality is still the number-one reported barrier, at 32%. Those traces are read by the people who wrote the agent. Meanwhile 34% of enterprise buyers in a February 2026 CrewAI survey of 500 senior executives, at companies above $100M in revenue and 5,000 employees, now rank security and governance as their top platform selection criterion, above ease of integration and above raw performance. Tracing is not accountability, and the instrument that makes orchestration legible to someone who didn’t build it mostly doesn’t exist.
Ours is a grid: every domain across every pipeline stage, with run status in each cell. An engagement partner reads it correctly without being taught what a directed acyclic graph is. It works precisely because the graph is declared data rather than compiled control flow: a dashboard can read a YAML adjacency list; it cannot read your Python.
The valuable part of a graph is the part you can inspect before it runs and audit after it finishes. Edges declared as data and validated in CI. Gates typed by severity and expressed in the protocol rather than the prompt. State versioned with a ledger that survives the run. Three names for one habit we already had: put the machinery below the line of visibility where someone else can read it, write the authority into the step rather than the prompt, and treat the record as the deliverable. No framework required for any of it.