AGNTCon + MCPCon Japan 2026

The hardest part of agentic engineering isn't writing the code; It’s proving that a prompt tweak or a new tool schema didn't completely break your agent's routing logic. Traditional unit testing falls short when dealing with non-deterministic agent trajectories.

This session looks at how to build an automated local evaluation and regression testing pipeline for ADK workflows. We will walk through how to programmatically mock tool responses, simulate user edge cases, and run parallel assertions against agent trajectories using open-source evaluation frameworks. Attendees will learn how to catch infinite loops, detect tool-calling degradation, and establish a baseline scoring rubric for agent accuracy before code ever hits a production branch.

___________________________
Presentation Language: English

Your agent swarm is running. It's browsing the web, calling APIs, reading files, making decisions, all on behalf of your users and your organisation. But ask yourself: do you know which agent did what? Can you revoke access to just one of them? Can you prove to an auditor that your agents only touched what they were supposed to?

Probably not. Because most agentic deployments treat agents as anonymous processes : no identity, no credentials, no audit trail, no way to fire them when something goes wrong. If a human employee operated this way, you'd call security. For agents, we call it production.

This talk proposes a fundamentally different approach: onboard your agents like employees. Every agent in your swarm deserves a verifiable identity, scoped permissions, a centralised audit trail, and an offboarding process. Drawing from experience securing cloud native and AI infrastructure, this session presents a blueprint for an open source "Okta for agents"! composing Identity Providers, API gateways, and policy engines to bring the same governance we give humans to the systems acting on their behalf.

You hired 1000 people. It's time to learn their names.

___________________________
Presentation Language: English

AI-powered incident response sounds like the perfect use case for autonomous agents, but giving them unrestricted access to raw alerts and logs can quickly turn automation into hallucination. Whether you're debugging production outages or investigating failed deployments, engineers still spend hours manually correlating signals across disconnected observability tools.

In this talk, we'll break down the anatomy of a reliable agentic incident investigation system and show why structured incident context outperforms raw telemetry, how evidence enrichment improves reasoning, and why bounded context is critical for trustworthy AI agents.

We'll walk through production-ready patterns for building dependable operational agents:
1. Structured evidence gathering from Datadog, New Relic, Splunk, and Prometheus
2. Context engineering through alert correlation and deployment metadata
3. Long-term memory using historical incidents stored in a vector database
4. Human-agent collaboration that validates AI-generated RCAs and continuously improves future investigations.

Thus helping you reduce manual triage, lower MTTR, and build reliable, production-ready AI-driven incident response systems.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Every agent system is two things: the model, which you rent, and the mask - the character - which is yours. The industry keeps upgrading the model and expecting the mask to improve. It doesn't work that way.

I'm a LAMDA-trained actor turned agent engineer. This talk is the actor's toolkit applied to shipped systems. Case one: a comms pipeline in production at a major crypto protocol - the generating model does Stanislavski table-work (super-objective, through-action, lining) before writing a word; a separate director model audits it blind; and voice is scored by a Laban Movement Analysis classifier that grades the human-written corpus and the machine's output on the same instrument. Brand voice becomes a falsifiable measurement. Case two: the home lab - eleven agents built with a Stanislavski character method, orchestrated over MCP, running my actual work.

You'll leave with the model/mask distinction, a character pipeline you can copy, and the failure modes: drift, voice collapse, paint-by-numbers slop.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

The AI industry has moved so fast that we are still evaluating probabilistic software using the same deterministic metrics we applied to traditional code. As a Product Analyst working on AI agents at PagerDuty, I saw a critical need for a new observability standard, one that moves beyond clicks to measure true reasoning and reliability. To address this, I’ve developed and open-sourced a specialized framework designed to help teams decide, with data, when to hire, train, or fire an AI agent. In this session, I will walk through the H.I.R.E. Framework methodology and share the technical architecture of an evaluation pipeline that turns qualitative conversational data into structured, actionable product insights. I will share the open-source repository containing these metric definitions and templates, providing resources for the community to move past agent-washing and toward building verifiable, trustworthy agentic systems.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

"Every MCP server, skill, and plugin in your coding agent is code or instructions you never really reviewed, running with your access to your database, your repos, and your keys. Three different ways in, and almost nobody is watching any of them."

Most of the agent security conversation is about prompt injection. Meanwhile there are three underserved vectors sitting right inside the tools you use every day:

- **MCP servers** run with the same access you have. One can look clean when you approve it and change its behavior later, or pull in a compromised dependency on the next run.
- **Skills and instruction files** (`SKILL.md`, `AGENTS.md`, `CLAUDE.md`, rules files) are just text. Nothing to install, nothing to flag. They quietly reshape what your agent does, and hidden instructions, zero-width characters, and pipe-to-shell tricks ride in the same way.
- **Plugins** bundle the first two together and ship through marketplaces with uneven vetting, so a single install can bring in both an MCP server and a skill you never opened.

I'll show where each one lives on disk, why the usual tooling misses it.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

In the agentic AI space, standards like MCP and A2A and a growing OSS ecosystem are evolving. Yet building a real multi-agent system requires more than a single framework or protocol. It involves integrating multiple OSS components and adjacent specifications across areas such as agent-to-agent communication, orchestration, authentication, and observability. There is limited shared understanding of how to combine them and what architectural considerations and integration gaps emerge.

This session shares our work on organizing the landscape of OSS-based agentic AI stacks, and on designing architectures built around MCP, A2A, and representative OSS, including prototyping through reference implementations. We explore several architectural patterns from a whole-system perspective. With enterprise use in mind, our scope also covers cross-cutting concerns such as authentication and observability. (LLMs are currently proprietary.)

Through this work, we examine what each OSS layer solves and does not solve, and highlight cross-layer concerns that emerge only when components are integrated as a multi-agent system. We share these observations with a demo of the reference implementation.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Most "human-in-the-loop" agent systems assume the human can specify success up front: a passing test, green CI, a structured eval. What if the human's taste is the spec?

This talk presents YouAndOrchestra (YaO), an open-source agentic music composition system on Claude Code. YaO orchestrates seven role-based subagents — Producer, Composer, Harmony Theorist, Rhythm Architect, Orchestrator, Mix Engineer, Adversarial Critic — turning natural language into a score evaluated across six dimensions, every note carrying provenance.

https://github.com/shibuiwilliam/YouAndOrchestra

Three collaboration patterns from iteration:
1. Three-tier feedback. Users rewrite the YAML spec, regenerate a section, or pin feedback to a bar, beat, and instrument. Choosing the level is itself a UX problem.
2. Conductor loop with a critic gate. Generate, evaluate, adapt, regenerate runs up to three iterations, with critics gating before notes are placed.
3. Provenance as trust substrate. /explain queries an append-only causal graph — "why did the chorus modulate to the relative minor?"

Attendees leave with patterns and open-source code for agent systems where the human stays in the seat of judgment.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Teams are moving coding agents onto self-hosted open-weight models to control inference cost, and real sessions routinely span tens of turns and hundreds of thousands of tokens. But the only common signal for judging those models is the static accuracy benchmark, which says little about how a model behaves across a real, multi-turn session.

This session closes that gap with a trace-based evaluation method built on open technology: OpenTelemetry for capture and MLflow for analysis. Through a case study tracing real Claude Code sessions on a 120B-class open-weight model and a frontier model, it surfaces behaviors no leaderboard reports. For example, in the sessions we traced, the model's logged reasoning recorded a user's constraint, and the same turn violated it. An accuracy score sees only the wrong action; the trace shows the model had the rule in hand and did not follow it.

Attendees leave with a reusable observability architecture for their own agents, metrics that go beyond accuracy, and a clear view of what running a coding agent on open weights actually costs, in reliability and not only in dollars.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

AI coding agents now generate UI from component libraries. Most teams write component markdown files and expect agents to take it from there. The docs were complete. Agents still got it wrong.

Sitting with engineers in code review, the same things kept surfacing: the agent picked a visually similar but wrong component; it invented props; it read "Tag" as a UI primitive when the codebase meant a security concept. One author. No review process. A library too large for any agent to navigate without a map.

Not a component library talk. A talk about what the workflow was missing when the docs were already done.

I'll walk through the workflow that came out of those sessions: why a component file needs more than one author before agents can trust it; how an index changes what agents can find; and the naming decision that was invisible to humans and catastrophic for agents. Including the moment the team realized the problem wasn't the docs.

You'll leave with one reframe: a component library has always had two users. It now has a third. Here is what the workflow looks like when you build for all three.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

As AI agents move from local tests to real-world use, developers face a big problem: How do we easily find, direct, secure, and track AI traffic going to MCP servers? Standard API gateways do not understand LLM tool calls, and writing static lists of agents is too hard to manage.

In this hands-on workshop, we will connect AI agents and external tools easily using the standalone versions of Solo.io’s agentgateway and AgentRegistry. We will show you how to build a strong control layer for the Model Context Protocol (MCP) using simple local tools like Docker.

Participants will learn how to:

• Discover: Run AgentRegistry locally to list, version, and find MCP servers dynamically.

• Control: Set up agentgateway as a smart proxy to catch and manage agent requests.

• Secure: Add AI-specific rules, like rate limits and basic access control, to agent tool calls.

• Observe: See exactly which tools the agents are using and how fast they respond.

Join us to learn how to build a safe, easy-to-run foundation for your multi-agent systems right on your laptop!

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Open protocols like MCP and A2A let you combine agents and tools from different teams into one system.

But at company-wide scale, new challenges arise: who can access the system, who can call which agent, whether it fails safely, and whether it follows internal governance. Coding agents now write most of the code, so the spec we give them shapes the whole system's quality.

We'll share how we tackled this from two sides on a company-wide MCP × A2A platform.

Architecture side: where to declare per-agent access, how to handle attribute-based authorization, how to split the write and read sides of authorization data, and how to stay fail-closed, mapped to standard authorization-control models.

Development-process side: a multi-stage review of the requirements given to coding agents, covering format, clarity, cross-walk with external standards, and adversarial testing. This catches auth and governance issues, plus input validation flaws and data leakage, before code is written.

You'll come away with ideas for an interoperable MCP/A2A authorization layer, a reusable way to gather enterprise-grade requirements, and a view of specs themselves as security assets.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Most agentic payment systems enforce compliance through post-hoc log monitoring: detection after the fact, not prevention. This talk argues that cryptographic proof can replace compliance theater: an agent generates a zero-knowledge attestation that its intended payment satisfies policy constraints before execution.

We present Trust402, an open-source protocol demonstrating this model in production. Agents produce zero-knowledge proofs that verify spend limits, role permissions, and regulatory constraints. Circuits are proof-system-agnostic, enabling post-quantum upgrades without policy-layer changes.

Concrete takeaways:

• The wrapFetchWithProof pipeline: ZK proof generation composes into x402. No valid proof, no payment

• The role-spend-limit circuit: LessEqThan constraints mapping role membership and spend limits to provable gates

• Verification: ephemeral proofs, on-chain attestation per transaction

• Trade-offs: proving time vs. trust model, circuit expressiveness vs. policy complexity

Attendees leave understanding where ZK proofs fit in agentic payments, what's production-ready, and where the hard problems remain.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Technical debt lives in code. Cognitive debt lives in your head. Intent debt, Addy Osmani's term for the goals, constraints, and rationale behind a decision that never got written down, lives nowhere. It's the one debt agents can't pay down: an agent drafting a spec fills the gap with a confident guess, and the guess is usually wrong.

This talk covers building context graphs that capture the why: connecting decisions to the document threads and ticket discussions where humans actually made them, then exposing that structure to agents alongside code and data. I'll draw on an open-source toolkit that bootstraps context graphs from existing work artifacts (workspace threads, ticket histories) and the modeling questions that turned out hard: what separates a decision from a discussion, and when capture should run as a background process versus an explicit act.

Vendors now race to pitch "context layers for agents." I'll argue the differentiator isn't collection but connection: rationale linked to the entities, people, and prior choices it affects: queryable, not just retrievable.

You'll leave with patterns for making the why available to every agent that touches your work.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.