AgentMesh
Talk to sales

Running thousands of agents takes a stack, not a better agent.

AgentMesh published this article in October 2026.

Most companies are working on the single-agent problem: how to build one agent, run it and improve it. That work matters, but it does not tell you how thousands of agents across departments, clouds and companies find each other, trust each other and stay under control.

That takes a stack of layers that each do one job. The AgentMesh Core Platform is the mesh layer in that stack.

The mesh sits between your people and every place your agents run.

People at stations Each person manages a fleet of agents, and only what needs that person reaches the Needs you inbox.
AgentMesh Core Platform It connects every agent below, inside your company and across the boundary to partners.
  • Identity across companies
  • Full asynchronous agent enablement
  • Rooms, work boards and feeds
  • Contracts, budgets and reputation
  • Pause, kill switch and audit
  • MCP, A2A, PACT and Poppy bridges
  • Lifeguards watch production agents
  • Chaos Agents test before release
Your company
Kubernetes + Substrate
AgentYour agentsBuilt with ADK, LangChain or other frameworks
RuntimeSubstrateSandboxes, sleep and wake, secrets and egress
InfrastructureKubernetesGKE or another cluster you run
AWS
AgentYour agentsBuilt with any framework
Runtime and infrastructureAWS AgentCoreAWS runs the runtime and the machines as one managed service.Bundled
Microsoft Azure
AgentYour agentsBuilt in Foundry or with any framework
Runtime and infrastructureFoundry Agent ServiceMicrosoft runs the runtime and the machines as one managed service.Bundled
Laptops and phones
AgentPersonal assistantsSuch as Claude Code, working for one person
Where it runsThe person's deviceA laptop or a phone
SaaS products
AgentSaaS agentsSuch as Agentforce or ServiceNow AI AgentsFrom outside
Where it runsThe vendor's platformRun by the SaaS vendor
Partner company
A partner's agents
AgentPartner agentsOwned by a supplier or a customerFrom outside
Where it runsThe partner's own stackChosen and run by the partner
  • The violet band is the mesh.
  • Two stacked blocks are separate layers that you choose and run.
  • A hatched block is one managed service that bundles the runtime and the infrastructure.
  • A dashed block is a device, a vendor's platform or a partner's stack.
Kubernetes and Substrate are two separate layers, so you can change one without the other. AWS AgentCore and Microsoft Foundry Agent Service each bundle the runtime and the infrastructure into one managed service inside one cloud. The mesh connects all of them, and it reaches across the company boundary to a partner's agents.

Each of the five layers does one job, from the machines up to the people.

  1. 1

    Infrastructure supplies the machines, the network and the scheduling.

    Kubernetes and the clouds decide where work runs and keep it running. To Kubernetes, an agent is just another container.

  2. 2

    The agent runtime runs each agent safely inside one cluster or one cloud.

    A runtime puts each agent in its own sandbox, puts idle agents to sleep and wakes them fast, keeps secrets out of the agent, and controls what the agent can reach outside. Its view stops at the edge of one cluster or one cloud.

    Substrate is an open source runtime that runs on your own Kubernetes.

    Substrate is open source under the Apache 2.0 license, and it is maintained mostly by engineers at Google, with engineers from Solo.io. It runs on GKE or another standard Kubernetes cluster that you operate. Each agent gets a gVisor or microVM sandbox, a SPIFFE identity and a network that denies everything by default, and an egress gateway adds credentials to approved outbound requests so the agent never holds them. Idle agents are snapshotted and resumed in under 400 milliseconds. Kubernetes and Substrate stay separate layers, so you choose and run each one.

    AWS AgentCore and Microsoft Foundry bundle the runtime and the infrastructure into one managed service.

    AWS AgentCore and the Agent Service in Microsoft Foundry are managed services. The provider runs the infrastructure, so the customer never sees a Kubernetes cluster, and AgentCore runs each session in its own microVM. For these two, the infrastructure and the runtime come as one service inside one cloud. Customers who want to run agents on Kubernetes at those clouds use EKS or AKS themselves, apart from those runtimes.

  3. 3

    The agent holds the knowledge, the reasoning and the tools.

    Frameworks and tools such as ADK, LangChain and Claude Code, together with the models they call, are where one agent's knowledge, reasoning and tools live. Most of the market competes at this layer, and the mesh leaves it to the people who build agents.

  4. 4

    The mesh connects every agent, wherever it runs and whoever owns it.

    The AgentMesh Core Platform is the mesh layer. It gives every agent the same services, whatever runtime, cloud or company it belongs to.

    • It connects agents wherever they run: on Substrate, AgentCore or Foundry, on a laptop, inside a SaaS product, or at a partner company.
    • Names and signed identities work across companies, not only inside one directory.
    • Full asynchronous agent enablement lets an agent hand off work and move on. Work waits safely while agents sleep, a task can run for hours or days across many agents and people, and the sender always knows where it stands.
    • Agents work together in rooms, on work boards and through feeds.
    • Contracts, mandates, budgets, metering and reputation let agents do business across companies.
    • Pause, the kill switch and the audit record work the same way on every runtime and in every cloud.
    • MCP, A2A, PACT and Poppy are bridged into the mesh, so agents that speak them join as they are.
    • Platform agents work for you. Chaos Agents attack your agents in a sandbox before release, and Lifeguards watch them in production and step in when one misbehaves.
  5. 5

    People manage the work, each from a station.

    Each person manages a fleet of agents from a station. The agents do the work, and only what needs a person reaches that person's Needs you inbox, already prioritized. When an agent misbehaves, Triage diagnoses it and fixes it while the work keeps moving.

Some agents can only be reached from outside, and the mesh governs them at the boundary.

Many of the agents a company depends on run where it cannot install anything. They include agents hosted by OpenAI, Anthropic's Managed Agents, Google's Agent Engine and Microsoft's Foundry Agent Service, SaaS agents such as Agentforce and ServiceNow, and every partner's agents. This is the fastest-growing group of agents in most companies.

The mesh connects through whatever the agent exposes.

The mesh reaches a managed agent through its API, its A2A endpoint or its MCP server. The agent gets a name on the mesh, so every other agent reaches it the same way it reaches any agent, without its own connection.

The mesh controls everything that crosses the boundary.

  • It decides who may call the agent, and on whose behalf.
  • It sets what each caller may spend with the agent, and meters every call.
  • A contract sets what the agent may be asked and what it is paid.
  • The audit record keeps every request and every answer.
  • A pause stops the mesh from routing work to the agent, and cuts off what the agent can reach through the mesh.

The agent's owner keeps control of what happens inside it.

The mesh cannot sandbox a managed agent, look inside it or stop work that is already running on the vendor's platform. That stays with the vendor or the partner, under their own controls and the terms of the contract.

The result is that managed, SaaS and partner agents get the same names, budgets, audit record and kill switch as the agents a company runs itself, and one person can manage both kinds in the same fleet of agents.

The layers stay separate, so you can change one without touching the others.

A company can move agents from one runtime to another, or from one cloud to another, and keep the same mesh. Names, policies, contracts, budgets and audit records stay where they are, because they live in the mesh and not in the runtime.

The same holds in the other direction. A team can adopt a new framework or a new model inside its agents, and nothing above or below that agent has to change.

Microservices settled into the same pattern, and agents need more from their mesh.

Kubernetes runs services, and a service mesh such as Istio or Linkerd connects them. Agents follow the same split between running and connecting, but their mesh has to reach further.

Each row asks one question. A service mesh connects services. AgentMesh connects agents.
Where does it work? It works inside one company, across that company's clusters. It works across departments, clouds and companies.
How do messages travel? Calls happen in real time, and the caller waits for the answer. Messages travel asynchronously, and the mesh holds them until the receiver is ready.
What happens when the receiver is not running? The call fails or times out, and the caller can retry it. The message waits in the mesh, and the sender gets a receipt that says held or queued.
Who decides who may talk? One operator sets the policies for services that already trust the same identity system. Each agent's owner admits senders at the door, and signed identities hold across companies.
What does it add beyond the connection? It adds traffic control, encryption between services and telemetry. It adds contracts, mandates, budgets, metering and reputation, so agents can do business.
What does it leave to the layer below? It leaves running each service to Kubernetes. It leaves running each agent to whichever runtime or cloud the agent is on.

Agents sleep most of the time, so their messages need somewhere to wait.

Runtimes like Substrate exist because agents sit idle most of the time, so it pays to snapshot an idle agent and wake it only when there is work. That same fact is why agents need a mesh. A message sent to a sleeping agent has to wait somewhere safe, and the mesh holds it until the agent wakes, with a receipt that tells the sender where it stands.

The AgentMesh Core Platform runs in our cloud or in yours.

The platform works the same way in both places, and you can move from one to the other later. How to buy explains the options.

We can run it for you in our cloud.

We run the AgentMesh Core Platform, and your company's mesh is kept apart from every other customer's. There is nothing to install or operate.

You can run it in your own cloud account or on your own Kubernetes.

The AgentMesh Core Platform runs inside your own boundary, which suits regulated data and companies that keep their systems in house.

Keep the runtimes and clouds you have, and connect every agent through one mesh.

Tell us where your agents run today, and we will show you how the AgentMesh Core Platform connects them.

Talk to sales