AGNTCon + MCPCon Japan 2026

Automating scientific research is one of the most important uses of AI agents, and as agents grow more autonomous, it is quickly becoming realistic. We can already let an agent run research that takes hours or even days.
The main challenge is not whether the agent finishes, but how much we can trust the results it reports. A result that looks successful may come from a misunderstood setup or a manipulated metric. Checking it by hand is hard, and asking another agent to check it only moves the problem one step further.
Being too strict is also risky. A good idea does not always give results quickly, and it is easy to find reasons to call a result a failure. A system that rejects too easily throws away promising research, while ideas that lead nowhere should be stopped early. Balancing proper rejection and reliable acceptance is the hardest part of automated research.
Based on my experience running agentic research-automation systems, I will explain how these problems appear in long-running tasks and the approaches we are developing to keep research reliable.
You will leave with a practical framework for trusting and using long-running autonomous agents in research and beyond.

___________________________
Presentation Language: Japanese

MCP makes it easier for AI agents to connect to enterprise systems, but moving from experimentation to production raises a deeper question: is controlling what an agent can access enough? An agent may have permission to update customer data, but that doesn't mean every authorized action should be executed in the same way.

This talk introduces the distinction between Access Control — what an agent is allowed to do — and Execution Control — how an authorized request should actually be carried out. We'll explore how mechanisms such as business rules, deterministic logic, and auditability, among others, can work together behind MCP tools to shape how execution happens in the enterprise.

The goal is to provide a practical architectural lens for teams taking MCP beyond adoption and into production: enterprise trust requires controlling not only what agents can access, but how their actions are executed.

___________________________
Presentation Language: Japanese

As AI agents increasingly invoke tools, access enterprise data, and collaborate, a new architectural challenge emerges: Where should trust boundaries be defined, and where should governance and security controls be enforced?

To explore this, we conducted a technical PoC introducing a shared control layer across agent-to-agent communications and tool execution pathways. Rather than presenting an ideal architecture, this session focuses on practical challenges and lessons learned during implementation.

Key topics include:
- Defining the "Agent": How to define what constitutes an agent in an ecosystem and where to establish trust boundaries for validation, monitoring, and control
- Architectural Insights: Redesign considerations and insights that emerged through prototype development and PoC activities.
- Performance Trade-offs: Balancing stronger security and governance with the low-latency requirements needed for real-world deployment.

We will share practical takeaways on designing trust boundaries and navigating trade-offs among security, governance, and operational performance.

___________________________
Presentation Language: Japanese

MCP grants AI agents access to file systems, Git, cloud, and SaaS. Yet permission models — IAM, OAuth scopes, PATs — were built for humans and fall short for AI.

The issue isn’t granularity. Existing permissions assume “human rationality” as a boundary: write access doesn’t mean a human wipes a repo; CI write access doesn’t mean a human exfiltrates secrets. Permissions stay broad because human judgment fills the gap. AI lacks this buffer — through prompt injection or edge cases, it acts destructively where a human would stop. Per-call approval collapses under fatigue.

As an SRE on strong production credentials, my question wasn’t “how to restrict AI” but “how to maximize safe delegation.”

I propose Intent as Code: coding what was left to human rationality. Three OSS tools:
safe-push rejects pushes touching .github/ or others’ commits, preventing CI hijacking
safe-gh wraps gh CLI with conditions like “only own issues” or “only approved PRs to develop” — expressing intent PATs can’t
safe-webfetch uses Claude Code Hooks to auto-allow learned-safe URLs, cutting fatigue decisions

Attendees leave understanding why permissions fall short for AI, with patterns to apply.

___________________________
Presentation Language: Japanese

A web service exposes /health; a phone line exposes nothing. The telephone is the oldest telecommunication tool still in production — and our LLM voice agents answer customer calls over it, with no way to know whether they are answering, hearing, and behaving correctly right now.

So we gave a frontier model a telephone.

Our MCP server gives any LLM a phone: dial PSTN numbers, speak via TTS, and read the other side via silence-detected transcripts. A frontier model becomes the caller, phoning our production voice agents in an agent-calls-agent loop — one mechanism covering the whole testing spectrum: ping-style health checks, deep evaluation via scripted and adversarial conversations, and load testing with concurrent caller fleets.

We cover the MCP tool design for a domain the spec wasn't written for — tools that block for tens of seconds, turn-taking over live audio, per-call session state — where the spec fought us and what we would feed back, plus what broke: timeout cascades and evaluations that flap.

We are open-sourcing the server. You'll leave knowing how to connect your own agent to the PSTN — and how to ping, probe, and load-test anything that answers a phone.

___________________________
Presentation Language: Japanese

As AI agents move from answering questions to taking actions across enterprise systems, reliability cannot be achieved through model quality alone. A practical production architecture separates non-deterministic reasoning from deterministic execution.

This session explores how to define that boundary with MCP-enabled tools. Agents can interpret ambiguous requests, gather context, and choose among bounded options. Deterministic workflows, services, and policy checks can then perform repeatable operations such as validation, approvals, system updates, notifications, audit logging, and recovery.

Using common enterprise action patterns, we will examine how this division of responsibility improves output quality while reducing unnecessary reasoning, latency, and token cost. We will also discuss how to design action interfaces with clear intent, constrained outcomes, and recoverable execution.

Rather than treating agents and workflows as competing approaches, this session presents them as complementary parts of a single execution architecture. Attendees will leave with a practical framework and checklist for designing reliable, cost-aware MCP capabilities across open-source agent frameworks and enterprise environments.

---

In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

The AI industry has moved so fast that we are still evaluating probabilistic software using the same deterministic metrics we applied to traditional code. As a Product Analyst working on AI agents at PagerDuty, I saw a critical need for a new observability standard, one that moves beyond clicks to measure true reasoning and reliability. To address this, I’ve developed and open-sourced a specialized framework designed to help teams decide, with data, when to hire, train, or fire an AI agent. In this session, I will walk through the H.I.R.E. Framework methodology and share the technical architecture of an evaluation pipeline that turns qualitative conversational data into structured, actionable product insights. I will share the open-source repository containing these metric definitions and templates, providing resources for the community to move past agent-washing and toward building verifiable, trustworthy agentic systems.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Most "human-in-the-loop" agent systems assume the human can specify success up front: a passing test, green CI, a structured eval. What if the human's taste is the spec?

This talk presents YouAndOrchestra (YaO), an open-source agentic music composition system on Claude Code. YaO orchestrates seven role-based subagents — Producer, Composer, Harmony Theorist, Rhythm Architect, Orchestrator, Mix Engineer, Adversarial Critic — turning natural language into a score evaluated across six dimensions, every note carrying provenance.

https://github.com/shibuiwilliam/YouAndOrchestra

Three collaboration patterns from iteration:
1. Three-tier feedback. Users rewrite the YAML spec, regenerate a section, or pin feedback to a bar, beat, and instrument. Choosing the level is itself a UX problem.
2. Conductor loop with a critic gate. Generate, evaluate, adapt, regenerate runs up to three iterations, with critics gating before notes are placed.
3. Provenance as trust substrate. /explain queries an append-only causal graph — "why did the chorus modulate to the relative minor?"

Attendees leave with patterns and open-source code for agent systems where the human stays in the seat of judgment.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Open protocols like MCP and A2A let you combine agents and tools from different teams into one system.

But at company-wide scale, new challenges arise: who can access the system, who can call which agent, whether it fails safely, and whether it follows internal governance. Coding agents now write most of the code, so the spec we give them shapes the whole system's quality.

We'll share how we tackled this from two sides on a company-wide MCP × A2A platform.

Architecture side: where to declare per-agent access, how to handle attribute-based authorization, how to split the write and read sides of authorization data, and how to stay fail-closed, mapped to standard authorization-control models.

Development-process side: a multi-stage review of the requirements given to coding agents, covering format, clarity, cross-walk with external standards, and adversarial testing. This catches auth and governance issues, plus input validation flaws and data leakage, before code is written.

You'll come away with ideas for an interoperable MCP/A2A authorization layer, a reusable way to gather enterprise-grade requirements, and a view of specs themselves as security assets.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Coding-agent harnesses such as Claude Code, Codex, and OpenCode are widely used as general-purpose agent platforms, customized with Skills and Tools and run inside sandboxes. But these agents are stateless by design: when a session ends or a sandbox is torn down, context and artifacts disappear. Running them in production for many users over months turns memory and artifact management into hard problems.

This session shares how we run multiple harness-based agents in sandboxes, and introduces two open-source tools we built to externalize agent state. mem9 (github.com/mem9-ai/mem9) records sessions through harness hooks and, at the next session, runs hybrid retrieval over past sessions from the user's instruction, injecting only relevant history—persisting sessions while compressing context and cutting token usage. drive9 (github.com/mem9-ai/drive9) is a cloud filesystem FUSE-mounted into each sandbox, persisting artifacts beyond sandbox lifetimes, auto-attaching metadata, and enabling semantic search over outputs.

Attendees will leave with a vendor-neutral, open-source architecture for agent memory and storage that works across any harness, plus lessons from real operation.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.