Scalable Design of Agent

Functional Requirements Understand the intent from the user's conversation. Break the intent into a series of steps needed to achieve it. Build an execution path for those steps, including ordering and dependencies. Enforce authentication and authorisation before any agent logic runs. Every request must pass identity verification (JWT / OAuth2), role-based access control (RBAC), and session binding so the authenticated identity carries across all downstream calls. Unauthenticated requests are rejected at this layer. Human in the loop (HITL) before execution. The user must be able to review the plan, request changes, or reject it before the agent acts. Confirm the task operation flow via chain-of-thought reasoning. Once the plan is approved, break it into tasks and validate the sequence with the user. (TODO: Research reasoning models — distinguish the model's internal CoT from the agent's explicit task graph, and how to surface steps for HITL review.) Extract entity models and data from