What is agentic integration?
A practitioner's definition of agentic integration, how it differs from iPaaS and API integration, the building blocks, the patterns that work in production, and a step-by-step way to start.
Traditional integration moves data between systems along paths a developer designed in advance. Agentic integration adds a new kind of consumer: an AI agent that chooses at runtime which tools to call, in which order, with which arguments, and sometimes which other agent to delegate to. That single difference changes how interfaces are designed, secured and operated. Integration teams that already run API management, iPaaS and event platforms are well placed to do it, because most of what agents need already exists in those platforms. It needs to be exposed and governed in a new way.
Agentic integration vs traditional integration
| Aspect | Traditional integration (API, iPaaS, ESB) | Agentic integration |
|---|---|---|
| Who decides the call sequence | A developer, at design time | An AI agent, at runtime, within policy |
| Interface contract | OpenAPI, WSDL, IDoc, EDI message types | Tool definitions (name, description, JSON Schema), Agent Cards, plus the same APIs underneath |
| Main consumers | Applications, partners, scheduled jobs | Agents and copilots acting for users or autonomously, plus other agents |
| Identity | Technical users, client credentials | User + agent + service identity on every call, with delegation |
| Typical failure | Mapping error, timeout, bad data | Plus wrong tool chosen, prompt injection, loops, over-reach |
| Controls | Authentication, quotas, monitoring | Plus per-tool authorization, filtered discovery, approval gates, kill switches, behaviour monitoring |
| Standards | REST, OData, SOAP, AsyncAPI, EDI | Plus MCP (agent to tool) and A2A (agent to agent) |
The important word is plus. Agentic integration does not replace your integration platform. Agents should reach systems of record through the same managed APIs, integration flows and event brokers as every other consumer, so the mappings, retries and monitoring you already trust keep working.
Reference architecture
The building blocks
- Agents. Software that plans and acts using a language model: copilots in business apps, custom agents, or agents on platforms such as SAP Joule Studio, Microsoft Copilot Studio, Amazon Bedrock AgentCore, Google's agent platform or Salesforce Agentforce. See enterprise agent platforms.
- Tools via MCP. The Model Context Protocol is the standard way to expose enterprise capabilities to agents as tools, resources and prompts. Since the 2026-07-28 revision it is stateless and scales like any HTTP API. See what changed in MCP 2026-07-28.
- Agent-to-agent via A2A. When one agent hands work to another it does not control, A2A provides discovery (Agent Cards), task lifecycles and secure messaging. See agent-to-agent (A2A) integration.
- Gateways. An MCP or agent gateway authenticates agents, authorizes each tool call, filters what each agent can discover, applies quotas and records an audit trail. See MCP gateway architecture.
- Identity. Every call carries the user, the agent and a narrowly scoped downstream credential. See agent identity and authorization.
- Integration services and events. Existing APIs, integration flows and event brokers do the real work: mapping, validation, retries, compensation. See integration orchestration.
- Governance. Approval gates, kill switches and controls mapped to the OWASP Agentic Top 10. See agentic risk controls.
Five agentic integration patterns
| Pattern | When to use it | Typical example |
|---|---|---|
| 1. Governed tool access | An agent needs to read or change data in a system | Sales copilot calls get_order_status, an MCP tool over an existing ERP API |
| 2. Agent-to-agent delegation | Work crosses platforms, teams or companies | Procurement agent asks a supplier's agent to confirm stock over A2A |
| 3. Event-triggered agents | Agents should react to business events, not poll | An invoice-blocked event wakes an AP agent that gathers evidence for a clerk |
| 4. Human-in-the-loop actions | The action is high-impact or irreversible | Agent proposes a vendor bank change; a person approves the exact payload |
| 5. Agent-assisted integration operations | Integration teams want faster build and support | An agent correlates failed iFlow messages with recent changes and drafts a fix for review |
Where the standards stand
Two open protocols now carry most agentic integration. MCP (agent to tool) is on its 2026-07-28 revision, and A2A (agent to agent) reached v1.0 in March 2026. Both are governed by the Agentic AI Foundation under the Linux Foundation. Commerce-specific protocols (UCP, ACP, AP2) sit on top for buying and payments. The full comparison is in the agent protocol stack in 2026. On the security side, the OWASP Top 10 for Agentic Applications and NIST's 2026 AI Agent Standards Initiative set the baseline.
How to start: six steps
- Pick one read-only use case with a clear owner, such as order status, leave balances or invoice status.
- Reuse an existing managed API or integration flow; do not build a new path to the system of record.
- Expose it as one narrow MCP tool through a gateway, with a strict input schema and a description written for the model.
- Carry user identity end to end so the agent can never see more than its user could.
- Instrument it: correlation IDs, per-tool metrics, denied-call alerts and an audit record per call.
- Only then add writes, each with idempotency keys and, where impact is high, a human approval step.
Teams on SAP can follow the same path with the MCP Gateway in SAP Integration Suite; see the SAP guide.
Common mistakes
- One generic "call any API" tool with a powerful technical user.
- Letting agents query databases directly instead of going through the integration layer.
- Treating text returned by tools or other agents as instructions.
- Approval steps that show the agent's summary instead of the actual data.
- No kill switch per agent and per tool.
Frequently asked questions
What is agentic integration in simple terms?
Agentic integration is connecting AI agents to business systems, data and other agents so they can take real actions safely. Agents get governed tools (usually through MCP), can delegate to other agents (through A2A), and reach systems of record through existing APIs and integration flows with identity, approval and audit controls.
How is agentic integration different from iPaaS?
An iPaaS runs integration flows that developers design in advance. Agentic integration adds AI agents that choose their own calls at runtime, so it adds tool contracts, agent identity, per-tool authorization, approval gates and behaviour monitoring on top of the iPaaS, which still does the mapping, routing and error handling.
What protocols are used for agentic integration?
The Model Context Protocol (MCP) connects agents to tools and data, and the Agent2Agent protocol (A2A) connects agents to other agents. Both are governed by the Agentic AI Foundation. Underneath, agents still use REST, OData, events and the other integration standards your landscape already runs.
Is agentic integration safe for ERP, HR and finance systems?
It can be, if agents only reach systems through governed gateways and existing APIs, carry the user's identity on every call, use narrow task-shaped tools, and need human approval for high-impact actions such as payments or master-data changes.
Where should a company start with agentic integration?
Start with one read-only use case over an existing managed API, expose it as a single narrow MCP tool through a gateway, carry user identity end to end, and instrument it before adding any write operations.
Sources and further reading
- Model Context Protocol: 2026-07-28 key changes
- A2A: What's new in v1.0
- Linux Foundation: Agentic AI Foundation formation
- OWASP Top 10 for Agentic Applications 2026