# Agent orchestration

> VI: https://5ac.vn/wiki/agent-orchestration/ · EN: https://5ac.vn/en/wiki/agent-orchestration/ · lang: en · spec_as_of 2026-10-19 (spec no formal spec) · cluster C4

The infrastructure layer that runs multiple AI agents, models and tools through one business process under control: identity, permissions, audit logs, sandboxes and token budgets.

---
## Definition

Agent orchestration is the infrastructure layer that runs multiple AI agents, multiple models and multiple tools through one business process under control. Each agent carries its own identity and permission set, every action lands in an audit log, new agents execute in a sandbox before touching live data, and each workflow ships with a token budget. Orchestration is not a species of agent — that question belongs to the sub-agent entry — it is the operating layer that decides what agents are allowed to do and how their work stays traceable.

## Mechanism

A minimum orchestration layer answers four questions: who is this agent, what is it allowed to do, what did it do, and who is accountable when it acts incorrectly? Its four components map one-to-one: **identity** — separate profiles and access boundaries, never one shared unrestricted credential; **permissions** — read rights, recommendation rights and execution rights kept apart, with human approval gating sensitive actions such as sending quotes or changing order status; **audit logging** — timestamp, triggering user, tool called, data touched, result and estimated cost; **sandboxing** — sample or anonymized data first, production access later. The cost argument matters as much as safety: an agent loop of planning, retrieval, tool calls, checks, corrections and retries can turn one simple request into dozens of model calls, and uncontrolled workflows inflate token spend 10–20x. Three controls stop that: per-workflow budgets with retry and runtime caps, model routing that keeps cheap work on cheap models, and per-agent logs so every cost has an owner.

## Application context

The 2026 market signal moved the goalposts — major vendors now talk about agent identity and sub-second sandboxing, so the question shifted from "can we build agents?" to "can we operate agents safely?". For a 10–50 person SMB the recommended path is 30 days: week one, define which data agents may read and must never touch; week two, configure profiles, permissions and human approval points; week three, test on sample or anonymized data; week four, release to a small team while measuring three numbers — time saved, errors created, token cost per useful outcome. The selection rule: choose the control plane first, the model catalog second, and treat orchestration as operating infrastructure, not a short-term AI experiment.

## Sources fetched

- [Secure Agent Orchestration for Vietnamese SMBs: Identity, Audit Logs, and Control](/en/blog/secure-agent-orchestration-layer-vietnamese-smbs/) — four components, four accountability questions, 30-day path — accessed 2026-10-19
- [Agentic AI Orchestration: How SMBs Can Control the 10-20x Token Cost Explosion](/en/blog/agentic-ai-orchestration-token-cost-control-smb/) — per-workflow budgets, model routing, control plane first — accessed 2026-10-19

## Related

- [AI Agent](/en/wiki/ai-agent/)
- [What is a sub-agent?](/en/wiki/sub-agent/)
- [Agent governance](/en/wiki/agent-governance/)