Academic editorial preview · v0.3. Proposed Institute-delivered course; not yet scheduled or open for enrollment. No accredited credit or certification is offered through this draft.

AI-GR551 — Agentic AI Systems: Architecture, Secure Development & Deployment

IAIGCRM Secure & Governed AI Development Curriculum

Version: 0.2 academic editorial draft · October 26, 2026

Status: Private research branch only; NOT authorized for public publication or Azure deployment

Level: Graduate integrative capstone · Proposed credit: 3 semester credits · Duration: 15 weeks, ~3 contact hours weekly plus 6–9 hours independent work (subject to institutional credit-hour validation)

Course description

Design, implement, test, secure, deploy and defend a bounded agentic AI application through a semester-long engineering project. Topics include agent-vs-workflow selection, prompt scripting, context engineering, tool and MCP integration, memory, orchestration, multi-agent coordination, RAG, adversarial security, evaluation, identity, observability, human approval, CI/CD, hosting, operational assurance and governance. Students demonstrate that agent autonomy is justified against simpler deterministic alternatives.

Prerequisites: graduate proficiency in Python, APIs, Git, testing and software architecture; introductory ML/LLM literacy; security fundamentals. AI-GR501 and AI-GR601 recommended prior or concurrent; bridge materials for policy and technical cohorts.

Course-level learning outcomes (CLO)

On successful completion, students will be able to:

CLO-1: Analyze requirements and justify agentic vs deterministic design using documented cost, risk and performance trade-offs.
CLO-2: Engineer a reproducible, stateful agentic application with structured prompts, tool schemas, orchestration and bounded execution.
CLO-3: Integrate RAG, external tools and/or MCP with enforceable identity, data provenance and least-privilege access.
CLO-4: Threat-model and adversarially evaluate the application, documenting controls and measured residual risks.
CLO-5: Implement automated evaluations, traces, monitoring, safe failure, human approval and release controls.
CLO-6: Deploy to a controlled staging environment through a documented CI/CD pipeline with security evidence.
CLO-7: Defend an evidence-based release decision before a simulated architecture/security/governance review board.

Curriculum-wide security and assurance baseline

SEC-01: Identity, authentication, authorization, least privilege.
SEC-02: Data privacy, classification, provenance, retention.
SEC-03: Secure architecture, model/application design and supply chain.
SEC-04: Threat modeling, adversarial testing and abuse-case validation.
SEC-05: Tool security, bounded autonomy and delegated authority.
SEC-06: Telemetry, monitoring, incident response and recovery.
SEC-07: Risk governance, regulatory analysis and accountable oversight.
SEC-08: Verification, evidence, assurance and release gates.

Progression: Introduce (UG101) → Apply (UG301) → Engineer/test (GR501) → Govern/assure (GR601) → Integrate and defend (GR551). Each capstone submission must map SEC-01–08 to implementation, tests, evidence, owners and residual risk.

Weekly instructional plan

Week 01 — Agentic AI foundations and engineering decisions

Measurable objectives: Distinguish deterministic workflows, tool-using assistants, autonomous agents; compare latency, risk and cost.

Laboratory/studio: Build a bounded single-tool assistant and deterministic baseline.

Security/governance checkpoint: SEC-03/05/07: scope of authority, risk classification, explicit non-agent alternative.

Assessed deliverable: Architecture decision record (ADR-01), baseline metrics.

Indicative reading: Russell & Norvig, AIMA (agents chapter); NIST AI RMF overview.

Week 02 — Requirements, architecture and trust boundaries

Measurable objectives: Derive functional/nonfunctional requirements, map assets, actors, data flows and trust boundaries.

Laboratory/studio: Produce component and sequence diagrams; implement isolated dev environment.

Security/governance checkpoint: SEC-01/03/04: STRIDE-inspired threat model, data classification, secrets handling.

Assessed deliverable: System requirements specification (SRS), UML views, threat model v1.

Indicative reading: NIST SP 800-53 Rev.5 selected access/system controls; OWASP LLM Top 10.

Week 03 — Prompt scripting and context engineering

Measurable objectives: Version system/developer/user instructions; implement structured outputs and prompt tests; measure regressions.

Laboratory/studio: Implement prompt templates, JSON Schema validation, test fixtures, deterministic fallbacks.

Security/governance checkpoint: SEC-03/04: instruction hierarchy, untrusted input isolation, injection tests.

Assessed deliverable: Versioned prompt registry, 20-case evaluation suite.

Indicative reading: OpenAI/Anthropic provider documentation (current edition, verified by instructor); OWASP prompt injection guidance.

Week 04 — Agent state, memory and persistence

Measurable objectives: Compare stateless/stateful agents; design session isolation, retention, retrieval and deletion.

Laboratory/studio: Build checkpointed state with per-user partitioning and TTL; failure recovery.

Security/governance checkpoint: SEC-01/02/06: isolation, data minimization, encryption, auditability.

Assessed deliverable: State schema, retention schedule, tests for cross-session leakage.

Indicative reading: NIST Privacy Framework; selected stateful-agent framework documentation.

Week 05 — Tools, APIs, schemas and MCP

Measurable objectives: Design typed tools and least-privilege capabilities; distinguish tool metadata from trusted policy.

Laboratory/studio: Implement two sandboxed tools and an MCP client/server example in controlled environment.

Security/governance checkpoint: SEC-01/05: allowlists, per-tool scopes, authentication, confirmation for side effects.

Assessed deliverable: Tool registry, permission matrix, misuse test report.

Indicative reading: MCP specification (current version); OWASP API Security Top 10.

Week 06 — Orchestration and workflow reliability

Measurable objectives: Compare graph/state-machine orchestration with agent loops; implement bounded retries and timeouts.

Laboratory/studio: Rebuild workflow in a selected framework and plain-code reference implementation.

Security/governance checkpoint: SEC-03/05/06: termination limits, idempotency, circuit breakers, safe fallback.

Assessed deliverable: Architecture trade-off report and trace evidence.

Indicative reading: LangGraph/Agents SDK/other maintained framework docs; distributed systems reliability readings.

Week 07 — Planning, delegation and multi-agent coordination

Measurable objectives: Evaluate planner-executor, supervisor and multi-agent patterns; measure coordination overhead.

Laboratory/studio: Build delegated subtask workflow with explicit contracts and budget limits.

Security/governance checkpoint: SEC-01/05/07: delegation boundaries, escalation, no privilege amplification.

Assessed deliverable: Multi-agent design review and ablation against single agent.

Indicative reading: Peer-reviewed agent orchestration studies selected/verified by instructor.

Week 08 — Midterm architecture and security review

Measurable objectives: Defend architecture, threat assumptions, test strategy and evidence quality.

Laboratory/studio: Conduct architecture review board simulation and live demonstration.

Security/governance checkpoint: SEC-04/07/08: risk register, control coverage, design gate.

Assessed deliverable: Midterm design dossier and oral defense.

Indicative reading: NIST AI RMF Govern/Map/Measure/Manage; ISO/IEC 42001 overview.

Week 09 — RAG, provenance and knowledge permissions

Measurable objectives: Measure retrieval precision, groundedness, freshness and citation correctness.

Laboratory/studio: Implement RAG with document ACLs, source attribution and negative tests.

Security/governance checkpoint: SEC-01/02/03: document-level authorization, poisoning, provenance.

Assessed deliverable: Retrieval benchmark, provenance ledger, permission tests.

Indicative reading: Lewis et al. (2020), RAG; selected retrieval evaluation literature.

Week 10 — Adversarial agent security

Measurable objectives: Classify direct/indirect prompt injection, exfiltration, malicious tools and data poisoning.

Laboratory/studio: Run authorized red-team suite against synthetic data and sandboxed tools.

Security/governance checkpoint: SEC-01/04/05: defense-in-depth, egress controls, independent authorization.

Assessed deliverable: Attack/defense matrix, remediation and retest evidence.

Indicative reading: MITRE ATLAS; OWASP GenAI guidance; NIST AI 600-1.

Week 11 — Evaluation, tracing and operational observability

Measurable objectives: Define task success, safety, cost, latency and failure metrics; establish statistical test design.

Laboratory/studio: Instrument traces, structured logs, test harness, regression gates.

Security/governance checkpoint: SEC-06/08: PII-safe telemetry, correlation IDs, evidence retention.

Assessed deliverable: Evaluation dashboard and reproducible baseline report.

Indicative reading: NIST AI RMF Measure; model/system evaluation research selected by instructor.

Week 12 — Human oversight and governance gates

Measurable objectives: Design human approval for irreversible actions, contestability, emergency stop and audit records.

Laboratory/studio: Implement approval-gated high-impact tool execution and kill switch.

Security/governance checkpoint: SEC-01/05/07/08: human authorization, separation of duties, accountable decisions.

Assessed deliverable: Governance control mapping and approval test evidence.

Indicative reading: EU AI Act relevant provisions; ISO/IEC 42001 governance clauses (licensed access).

Week 13 — Hosting, containers, CI/CD and supply chain

Measurable objectives: Select hosting model, design network and secret boundaries, reproducible builds and promotion stages.

Laboratory/studio: Deploy containerized application to isolated staging; SBOM and vulnerability scanning.

Security/governance checkpoint: SEC-01/03/06/08: IAM, network egress, signed builds where feasible, release gate.

Assessed deliverable: Deployment architecture, CI/CD pipeline, SBOM and security scan.

Indicative reading: NIST SSDF SP 800-218; SLSA guidance; cloud provider deployment docs.

Week 14 — Production operations, drift and incident response

Measurable objectives: Specify SLOs, budgets, drift signals, escalation, rollback and disaster recovery.

Laboratory/studio: Inject failures and simulate incident; measure recovery and monitoring.

Security/governance checkpoint: SEC-02/06/07/08: incident playbook, retention, alert thresholds, periodic revalidation.

Assessed deliverable: Operations runbook, tabletop findings, release-readiness report.

Indicative reading: NIST SP 800-61 current revision; NIST AI RMF Manage.

Week 15 — Capstone assurance hearing and demonstration

Measurable objectives: Demonstrate complete lifecycle and justify bounded autonomy with evidence.

Laboratory/studio: Live system demo, adversarial challenge, release board oral defense.

Security/governance checkpoint: SEC-01–08: show implemented controls, exceptions, residual risks and release decision.

Assessed deliverable: Final repository, technical report, evidence pack, risk acceptance decision and defense.

Indicative reading: Review course corpus; independent scholarly sources supporting design choices.

Assessment scheme

Component	Weight	Evidence
Weekly laboratories and reproducibility records	25%	Versioned code, test results, lab reflection
Requirements, architecture, and threat-model portfolio	15%	SRS, UML, data flows, ADRs, threat model
Midterm architecture/security review	15%	Oral defense, evidence and risk register
Security, evaluation and operations portfolio	20%	Adversarial tests, eval harness, monitoring, CI/CD and runbook
Final capstone system and release-board defense	25%	Running staging system, source, evidence pack, defense
Total	100%

Critical minimum gate: No final project passes the capstone without a documented tool authorization model, demonstrable test suite, threat model, audit traces, human approval for consequential actions, and an evidence-based release/deny decision. Safety-critical or real-world action systems are out of scope; demonstrations use synthetic data and sandboxed or expressly authorized services.

Capstone project specification

Students choose a defensible application (e.g., internal policy research assistant, bounded ticket triage, document analysis, or synthetic operations workflow). They must maintain a version-controlled repository and deliver:

Problem definition, user/stakeholder requirements, deterministic baseline and ADR.
Architecture diagrams (component, sequence, deployment), data inventory and trust boundaries.
Prompt/script registry, tool/API contracts, access scopes, memory/retention design and provenance controls.
RAG or equivalent grounding strategy, documented test corpus and benchmark.
Threat model and adversarial test plan; attack outcomes, remediation, regression results.
Automated evaluation metrics (task success, groundedness, latency, cost, unauthorized action rate), uncertainty and failure analysis.
Staging deployment, build provenance/SBOM, secrets management, telemetry and rollback.
SEC-01–08 traceability matrix: requirement → control → test → evidence → residual risk → accountable owner.
Risk register, human-oversight procedures, operational runbook and release-gate decision.
Individual oral defense, including disclosure of AI assistance and independent code comprehension.

Proposed final capstone rubric (25% course weight): engineering functionality/reproducibility 25%; security controls and validation 25%; evaluation rigor 15%; governance/evidence/release decision 20%; architecture documentation and oral defense 15%.

Instructional technology and hosting policy

Use one primary orchestration stack and one comparative framework; examples include LangGraph, OpenAI Agents SDK, Google ADK, or equivalent maintained frameworks. Teach portable concepts first, not vendor-specific APIs. MCP is an optional integration standard where supported and justified. Development can use Python, pytest, typed schemas, containers, GitHub Actions and a sandboxed Azure/AWS/GCP or local staging deployment. Students must not be required to purchase paid services; provide equivalent local/open-source alternatives and preapproved resource budgets. Tool documentation, versions and licensing must be verified at course launch.

Academic integrity, ethics and accessibility

AI assistance is permitted for tutoring, brainstorming, code review and debugging with transparent disclosure; students must explain, test and independently defend all submitted work. No secrets, personal data or unauthorized external systems in prompts or labs. All adversarial tests run in owned or explicitly authorized environments. Offer accessible and privacy-preserving alternatives and institutional accommodations. No institutional accreditation or academic credit is implied by this model syllabus.

Reading foundations for faculty verification

Russell & Norvig, Artificial Intelligence: A Modern Approach (agents and planning selections).
NIST AI Risk Management Framework 1.0 and Generative AI Profile (AI 600-1).
NIST SP 800-53 Rev. 5; NIST SP 800-218 Secure Software Development Framework.
ISO/IEC 42001:2023 and ISO/IEC 27002:2022 (institutional licensed access).
OWASP GenAI Security Project; MITRE ATLAS; OWASP API Security Top 10.
Lewis et al. (2020), “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks.”
Current official MCP specification and framework/vendor SDK documentation (version pinned by instructor).
Regulation (EU) 2024/1689, applicable provisions and implementation timelines as verified at course offering.

Required editorial review before publication

Validate weekly readings to precise chapters/URLs and current versions; develop instructor lecture notes, detailed labs, test fixtures, grading rubrics, reference architectures, accommodation plans, lab costs and credit-hour equivalence. Map all CLOs to specific assessments and security domains; peer review technical/legal currency. Retain this as an academic model syllabus pending adoption by an institution.