An agent with a 1M-token context still meets you as a total stranger tomorrow — the context window is RAM, wiped the moment the session ends. Real memory is an engineering system you build around the model: what to save, when to update it, and what to forget. This is the taxonomy, the storage trade-offs, and the write policy that separates a gimmick from a colleague.
A microservice fails loudly — a 500, a stack trace, a pager going off. An LLM app fails politely: the answer just got worse, the cost quietly tripled, or the agent looped fourteen times before answering, and nothing errored. This is how you point OpenTelemetry at that problem, so 'the model felt off' turns into 'the third tool call took six seconds and triggered two extra model round-trips.'
Two protocol standards keep getting confused in architecture meetings, and they solve perpendicular problems. MCP standardizes how one agent talks down to its tools; A2A standardizes how agents talk sideways to each other. Here's the anatomy of both, the mental model that makes the difference stick, and an honest case for why most systems still shouldn't go multi-agent.
SQL injection was killed by a structural fix: parameterized queries drew a hard line between code and data. Prompt injection is the same shape of bug with no such line — for an LLM, instructions and data arrive in one channel, and nothing reliably marks 'this part is data, never obey it.' Here's why agents make it lethal, and how to design as if injection will succeed.