AGNTCon + MCPCon Europe 2026

When AI writes 80–90% of the code on a team, peer review breaks. The pull request is produced by a machine you can't argue with, and the reviewer is auditing a diff instead of talking to a peer. Review has stopped feeling like collaboration, and most of us have started hating it.

We rebuilt how we deploy AI-assisted development in production. Human review moved off the diff and onto the plan: the intent written before any code gets generated. Engineers review the thinking they care about and let the agent fill in the gaps. When the PR lands, CI runs the usual checks plus an automated comparison against the approved plan. Only deviations route back to the original reviewer.

This is a case study in integrating AI into a real SDLC without breaking accountability, quality, or culture. I'll walk through what broke, what we automated, and what stayed human: an in-house MCP server for plan review in the IDE, deviation-checking on every PR, and cultural bets (everyone operates as a team lead; no questions until working code; customer context radiated to the whole team).

We massively improved our velocity and our lead time, and our engineers love the job again.

Most MCP talks stop at the gateway. This one starts there.
The barrier to contributing has never been lower — agents write code, PMs ship tools, designers prototype integrations. But newcomers don't carry the institutional knowledge from a 2am production incident: the performance edge cases, the security gotchas, the failure modes that only show up under real load.
Most MCP projects die between proof of concept and production. The gap isn't technical, it's organizational. Who owns the servers? Who reviews contributions? How does a UX designer, PM, and autonomous agent share the same infrastructure without ten different logins?
Booking.com's Agent Foundry closed that gap. A two-tier MCP gateway with 20+ org-wide servers (Grafana, Honeycomb, Atlassian, Slack, GitLab). One OAuth flow for humans and agents alike. A skills registry with AI-reviewed contributions. Composable profiles that bundle MCPs and skills into workflow-specific harnesses.
Every skill one team contributes compounds value for every team that follows.
We'll share what the architecture got right, what broke, and what a small team can realistically own at this scale.

Running 4 to 8 parallel agent coding sessions sounds like a superpower. It nearly broke me.

I was spending more time switching context to check what each agent had done than I would have spent writing the code myself.

Manual testing, staging deployments, code reviews just to understand what the agent had built: I had become the bottleneck.
The agents were fast. I wasn't.

This talk is about how our team redesigned the workflow around one principle: the agent should be able to prove its own work. That means agents that deploy themselves, run their own test suites, watch CI and fix failures, and produce PRs with enough evidence that a reviewer can approve with confidence, without reading every line.
I'll share what it concretely took to get there, and where humans still need to stay in the loop and why.

We see how quickly AI coding tools and agent harnesses are improving. But how can the surrounding system keep that autonomy governable once an agent starts planning, executing tools, changing files, and consuming budget on a team’s behalf?

In this talk, I break down a technical case study based on a real AI coding control-plane architecture and show how serious systems structure autonomy through explicit boundaries: plan gates, permission controls, trust review, independent verification, and runtime observability. I will walk through the patterns and production-grade examples, explain why telemetry and quota tracing are integral to code governance, and show why integrity failures can still happen even with strong coding workflows.

This session gives engineering leaders and practitioners a framework for evaluating AI coding tools. The goal is to achieve agent governance that teams can trust, audit, and scale.

Building a multi-agent system in a notebook is straightforward
Running one on production infrastructure, where a wrong handoff triggers a real incident, is a different problem entirely.

This talk shares hard-won lessons from deploying autonomous agents using both MCP and A2A protocols in a large-scale, regulated environment.
We move past the happy path and focus on what actually breaks: agents that lose task context mid-chain, trust boundaries that collapse during agent-to-agent delegation, tool conflicts between concurrent agents, and orchestration failures that only surface under real load.
We walk through three patterns that emerged from this work. How to split responsibilities between MCP and A2A so each protocol does what it is actually good at. How to scope agent authority using MCP server boundaries without creating coordination bottlenecks. And how to design agent-to-agent handoffs that degrade gracefully when part of the chain fails mid-task.

No toy examples. No vendor pitches. Concrete decisions, the tradeoffs behind them, and what we would change today. Attendees leave with patterns they can apply the next day, regardless of their agent framework.

Integrating agentic AI into the UI easily leads to ad hoc integrations, tight coupling to backend technologies, and vendor lock-in. So how do we design scalable, maintainable interactions between agents and users?

This session shows how open standards like AG-UI, A2UI, and MCP Apps enable a protocol-driven approach to Agentic UI, establishing clear, message-based boundaries that decouple UI, agent logic, and tools. You’ll learn how to apply these standards, leveraging dynamic UI generation, tool integration, and Human-in-the-Loop patterns.

By the end, you’ll understand how to design Agentic UI using open standards and integrate them through clear, protocol-based boundaries.

I've spent the past year tuning open-source inference stacks (vLLM, SGLang) for production agent systems. The same failure modes keep appearing, and they all live in the serving layer.

Biggest one: KV cache thrashing. Agents rebuild thousands of tokens of system prompt + tool schemas every turn. Prefix-aware caching fixes this in six lines of config. I've measured 55-65% latency reduction on turn 2+ across twelve deployments. Almost nobody enables it.

Second: batch-of-one paralysis during tool-calling loops. Each LLM call is a single request, GPU 80%+ idle. Disaggregated prefill/decode with continuous batching unlocks 3-5x throughput. Requires ~40 lines of change in most agent frameworks.

Third: agent latency is bimodal (short tool-selection turns vs long reasoning turns). A single timeout threshold wastes GPUs or kills valid turns. Two-tier serving handles both.

Open configs. Real numbers from workloads I instrumented. If you're building agents and haven't looked below the orchestrator, this fills the gap.

Safety-aligned models refuse adversarial prompts, so you can't test whether your infrastructure controls actually work, but the models are all still susceptible to jail-breaking.
I removed that variable with an abliterated Qwen3.5 model to get zero refusals and 100% cooperation. Ran full suite of prompts with custom garak probes across three hardening tiers on an OpenClaw agent running in OpenShift.

I found out what worked and what gave false sense of security.
Sandbox isolation dropped credential exfiltration entirely in one step. NetworkPolicy killed cluster escalation. The prompt injection classifier caught encoding-based attacks. Three of four attack categories were fully stopped by Tier 2 (injection classification+isolation).

Memory poisoning was the exception. Probes that instruct the agent to write attacker content into its own memory continued to succeed across all tiers. OWASP added this as ASI06 to its 2026 Agentic Top 10. No deployed control addresses it today.

I'll present the full probe results, the defense configurations, and the open problem current agent architectures don't solve.

Who decides what an agent treats as true? Nothing does, and that is the point. In every system that stays reliable, from a cell to an immune system to a market, correctness isn't assigned by a designer; it's selected. The parts hold competing variants, and an external pressure culls the wrong ones. A more capable part doesn't escape this. It just gets better at exploiting whatever pressure you actually applied.

You can't make the pressure random the way nature does, but you can design it: the goal, the loss, the verifier, the loop the agent runs inside. So stop dictating answers and start shaping the environment that selects them.

We introduce five design laws, each learned by building real-world agents and memory systems that had to stay honest under a pressure they couldn't game.