Anti-patterns are recurring architectural choices that hide complexity, delay control, or trade short-term delivery speed for long-term fragility.
10.1 How to use this catalog
Review every anti-pattern against the current system, not only the target architecture. A platform may have a secure gateway while one connector still uses shared credentials, or a formal governance process while one business unit runs unregistered agents.
Reference basis: this catalog synthesizes official guidance from Microsoft’s cloud antipattern catalog, AWS production generative-AI guidance, OWASP’s LLM risk taxonomy, and NIST’s AI risk-management framework.
10.2 The monolithic agent
One component handles prompts, retrieval, planning, memory, tools, policy, workflow state, and output rendering.
Agent frameworks make it easy to place all logic inside one loop.
Brittle releases, broad blast radius, weak testability, and unclear ownership.
10.3 Prompt-only security
The system prompt tells the model not to reveal data, exceed permissions, or follow malicious instructions, but no deterministic service enforces those rules.
Prompt edits are faster than IAM, policy, connector, and workflow integration.
Prompt injection, inconsistent enforcement, and weak audit evidence.
10.4 Unlimited agency
The agent has excessive functionality, permissions, or autonomy and can expand scope without a bounded resource or action budget.
Broad tools make demonstrations flexible.
Unexpected side effects, excessive agency, and difficult incident containment.
10.5 Context dumping
The system sends entire repositories, long histories, or all retrieved documents to the model “just in case.”
Large context windows create the illusion that retrieval discipline is unnecessary.
Extraneous fetching, stale evidence, higher cost, and sensitive-data leakage.
10.6 Raw tools presented as business capabilities
The model receives arbitrary SQL, shell execution, generic HTTP, broad file access, or low-level administrative APIs.
Raw primitives avoid the work of building domain adapters.
Privilege escalation, SSRF, code execution, data exfiltration, and target-system instability.
10.7 Conversation history as workflow state
The model conversation becomes the record of completed steps, approvals, retries, and enterprise operations.
Conversation memory appears to provide state for free.
Duplicate actions, lost approvals, unreliable recovery, and weak audit evidence.
10.8 Synchronous everything
Long model calls, retrieval, tool sequences, and approvals remain behind one blocking request.
Synchronous APIs are easy to prototype.
Thread exhaustion, poor UX, unknown transaction state, and cascading failure.
10.9 Blind retries and retry storms
Each layer retries independently, or the agent repeats a write because it did not receive a response.
Retries appear to improve resilience.
Retry storms, duplicate side effects, quota exhaustion, and extended outages.
10.10 Shared memory, cache, or index without isolation
Responses, embeddings, conversation memory, or evidence are reused across users or tenants without incorporating access and policy into the key.
Shared caches improve cost and latency in testing.
Cross-user leakage, stale authorization, and inconsistent evidence.
10.11 No evaluation system
Teams test a handful of prompts manually and deploy when responses “look good.”
Manual review is fast during early development.
Silent regressions, unverifiable improvement, and unsafe tool behavior.
10.12 Shadow AI by prohibition
The organization bans external AI but provides no usable approved alternative or onboarding path.
Prohibition is easier than enablement and governance.
Untracked disclosure, unmanaged accounts, inconsistent quality, and no incident evidence.
10.13 Vanity metrics as business evidence
The program reports prompts, tokens, generated words, licenses, or registered agents without linking them to cycle time, quality, risk, revenue, or cost.
Usage data is easy to collect.
Resources flow to popular demos rather than measurable value.
10.14 Model provider as the enterprise architecture
Identity, workflow state, tools, memory, evaluation, and business logic are tightly bound to one provider-specific runtime.
Provider frameworks accelerate early delivery.
Lock-in, difficult fallback, and limited lifecycle control.
10.15 “We will add observability later”
The team logs only final answers or application errors. Retrieval, model routes, policy decisions, tools, approvals, and post-conditions are invisible.
Telemetry is treated as pilot overhead.
Slow incident response, unverifiable quality, weak audit, and unowned cost.
10.16 Governance after launch
Ownership, data classification, model approval, access review, incident response, and retirement are deferred until the use case proves value.
Governance is seen as a gate that slows experimentation.
Orphaned agents, uncontrolled changes, unknown residual risk, and difficult shutdown.
10.17 Anti-pattern detection matrix
| Signal | Likely anti-pattern | Review question |
|---|---|---|
| One service owns prompts, retrieval, tools, memory, and policy | Monolithic agent | Can one component change without retesting the whole system? |
| Security rules appear mainly in prompts | Prompt-only security | Which deterministic service enforces each rule? |
| Agent has generic SQL, HTTP, shell, or file tools | Unlimited agency | Why is a narrow capability insufficient? |
| Client timeout leads to repeated write | Blind retry | How is unknown transaction state reconciled? |
| Cache key omits tenant or policy | Shared memory | Can users receive data generated under different access? |
| Release approval relies on screenshots | No evaluations | Which tests prevent regression? |
| Program KPI is prompt volume | Vanity metrics | Which business outcome improved? |
| No trace links source, model, tool, and outcome | Observability later | Can an incident be reconstructed end to end? |
10.18 Architecture review checklist
10.19 Chapter summary
Enterprise AI anti-patterns share a common structure: they hide a control decision inside a convenient component. Identity is hidden in the prompt. Workflow state is hidden in conversation memory. Business capability is hidden inside a raw API. Quality is hidden behind anecdotes. Governance is hidden behind the assumption that the pilot is temporary.
The corrective architecture makes identity, policy, context, state, capabilities, evaluation, observability, ownership, and recovery explicit and measurable.
Core conclusion: the fastest prototype architecture is rarely the fastest path to production.
Reference foundations
- Microsoft Azure Architecture Center — Performance testing and antipatterns.
- Microsoft Azure Architecture Center — Cloud design patterns.
- AWS Prescriptive Guidance — Architecting generative AI applications for production.
- OWASP GenAI Security Project — Excessive Agency.
- OWASP Top 10 for Large Language Model Applications.
- NIST AI RMF Generative AI Profile.