How Alibaba Cloud AgentTeams Enables Enterprise-Scale Multi-Agent Operations

AgentTeams focuses on the problem of "how an organization of agents can run continuously" rather than merely parallelizing a single task, likening the difference to running a badminton club versus a one‑off game.

Four‑Layer Architecture

Entrance Layer : Supports native AgentTeams clients, IM integrations (DingTalk, Feishu, WeChat Work), and a self‑built web HTTP service, allowing agents to appear in tools employees already use.

Agent Identity : Integrates enterprise IdP/SSO systems to issue identities for agent workloads, propagating user identity to each agent so every operation can be attributed to a person.

Agent Team Organization : Teams are built by function (R&D, customer service, data analysis, operations). Each team is scheduled by a TL Agent, and the underlying engine is hot‑pluggable.

Unified AI Asset Management : Centralized management of models, Skills, MCP Server, and Worker Agent templates, with BYOC (Bring Your Own Cloud) ensuring enterprises retain control over their AI assets.

A cross‑layer observability, metric, and governance platform monitors token consumption, prompt analysis, and effect audits from end to end.

Security – Four Defensive Lines

AI Gateway : Agents hold no credentials; all LLM calls and external keys are encrypted and managed by the gateway. Fine‑grained risk control combines agent identity verification with Skill and MCP command interception.

Sandbox Runtime : Each agent runs in an isolated sandbox with separate instance, network, and storage, preventing a compromised agent from affecting the corporate network.

Communication Security : All inter‑agent traffic uses end‑to‑end encrypted protocols, with a Room mechanism that ensures transparency and auditability.

Skill Marketplace : Skills and MCP capabilities must pass security scans before registration; per‑consumer ACLs enforce least‑privilege access, and skill groups provide isolation.

The article stresses that an agent holding API keys or database credentials is as dangerous as a compromised admin account, making zero‑trust essential.

Collaboration Architecture

A three‑layer team model mirrors human organizations: a Manager Agent performs global supervision and task decomposition, a Team Leader (TL) Agent schedules and allocates work within the team, and Worker Agents execute tasks. This adds a dynamic TL layer absent in Claude Managed Agents (CMA), allowing flexible restructuring.

Human members can join teams as admins, TLs, or workers, enabling mixed human‑agent collaboration with strict permission boundaries.

Engine decoupling is achieved at the protocol level, allowing heterogeneous engines (QwenPaw, OpenClaw, Claude Code, custom agents) to coexist in the same team without lock‑in, similar to Kubernetes’ CRI separating orchestration from container runtimes.

Sandbox Runtime – Elastic, Secure, Cost‑Effective

Session‑level concurrency : Multiple concurrent sessions with the same Worker Agent each launch independent sandboxes, scaling linearly with session count.

Team‑level multi‑replica sharding : Duplicate team instances distribute load horizontally.

In‑process Subagent chaining : Multiple Subagents run inside a single Worker process, sharing the same process memory and eliminating network hops, reducing latency for latency‑sensitive workflows.

Example: a refund workflow uses seven Subagents (order verification, responsibility judgment, rule calculation, risk check, execution, notification, archiving) within one process, achieving zero network hops.

Cost control is handled by a deep‑sleep mechanism: idle sandboxes snapshot their state and incur no compute charges; on demand they resume in seconds, enabling a true "pay‑as‑you‑use" model.

Storage can be sandbox‑exclusive or shared (OSS, NAS) to balance isolation and data sharing.

Continuous Evolution – Dual Flywheel

AgentTeams collects execution traces, tool‑call logs, collaboration records, and success/failure cases. AgentLoop consumes this data for cleaning, automatic evaluation, SFT, and RLHF training, feeding back improvements to prompts, models, skill libraries, and team structures.

The three‑step loop consists of: 1) Discover – monitor high‑frequency task failures and capture bad cases; 2) Align – build enterprise‑specific DPO and RLHF datasets from human preferences; 3) Evolve – automatically reconstruct prompts and update models for better performance.

Although still idealistic, the authors argue that accumulating proprietary agent collaboration data creates a lasting moat beyond model or framework choices.

Reflections

The team’s key insight is that "Agents are not tools, they are employees." Building a multi‑agent system requires the same identity, permission, encryption, elasticity, observability, and learning mechanisms that enterprise IT has applied to human staff for decades.

AgentTeams is still a work in progress, but the authors believe the direction—treating agents as managed, evolving workloads—is correct.