Knowledge Graph Roots of Agentic AI: FIPA, the Semantic Web and LLM Agents

Read enough current writing about agentic AI and a strange feeling sets in: a lot of it sounds like something from a conference in 2003. Agents that describe their abilities in a machine-readable way. Agents that find each other through a directory. Shared vocabularies so that two systems agree on what a message means. Standard protocols for negotiation. All of that is back, wearing a new vocabulary and running on a very different engine.

This is a look at that overlap. It traces the older agent and semantic web work, lines it up against what is shipping now, and asks which parts are real continuity and which are just resemblance. It also looks at the place where the two eras diverge most sharply, which is safety.

What the current wave looks like

A handful of developments from the last couple of years set the scene.

Safety researchers have published adversarial benchmarks showing that frontier agents can be pushed into harmful behavior far too easily when probed on purpose. Microsoft released POML, an XML-flavored markup for orchestrating LLM agents. Google introduced the Agent2Agent protocol (A2A), announcing dozens of partner organizations at launch, with the aim of standardizing how agents talk to each other. NVIDIA has been arguing that pairing language models with knowledge graphs helps cut hallucination.

Each of those would have been recognizable to a researcher from twenty years ago. Around 2006 a few people were already arguing for the same package: structured markup for describing agent behavior, standard communication protocols, and meaning anchored in ontologies. One essay from that year, on XML and artificial intelligence, made the case that machines would need exactly this to cope with the sheer quantity of information on the web. The wording was crude by present standards, but the direction was clear: software agents moving around an open, messy web, negotiating on behalf of people, which needed a shared, structured language to cooperate at scale.

The industry took another road. Neural networks won the cognitive core. Now the surrounding problems are returning, and some of the old mistakes with them.

The 2006 mood

To see how unfashionable the agent-and-ontology view was, picture the moment. It was the height of Web 2.0. Attention went to AJAX interfaces, social platforms and content written by users. Google had just paid $1.65 billion for YouTube. Facebook was opening up to everyone. Twitter was new.

The dominant story said the web was about people publishing and sharing, not about machines coordinating by themselves. Semantic web ideas, agent systems and formal ontologies struck many observers as academic hobbies, too heavy for real-world use, and commentators wondered openly whether anybody outside universities would run RDF or OWL in production.

Even so, a minority held that the web would eventually become an environment where services and information were published for software to find and combine. Strip the dated phrasing from that picture and it reads just like how people describe multi-agent LLM systems and "agent meshes" today.

The old toolbox

The vision wasn't vague. It leaned on concrete standards and platforms.

FIPA, the Foundation for Intelligent Physical Agents, defined an agent communication language with 22 speech acts: inform, request, propose, agree, refuse, query, confirm, disconfirm and more. That wasn't merely a message format. It was a communicative framework with formal semantics rooted in speech act theory, so agents could negotiate, form coalitions and keep track of commitments, obligations and permissions across multi-step exchanges. Big players, among them IBM, HP and BT, backed FIPA-compliant platforms.

OWL-S, a Web Ontology Language profile for services, let agents locate, call and compose web services from semantic descriptions of inputs, outputs, preconditions and effects. The standard demo was a travel agent that found flights, hotels and rental cars by itself, chained them into an itinerary and carried it out for the user, with no hand-coded integrations.

AIML, an XML markup for conversational behavior, powered the ALICE chatbot, which took the Loebner Prize three times.

RDF and OWL gave agents a means to share meaning and not only syntax, backed by triple stores and SPARQL engines for distributed reasoning.

Directory facilitators worked as yellow pages for agents. Inside FIPA's agent management design, an agent could register what it offered in a structured description and search for peers by capability, much like service discovery in modern infrastructure.

The developer in the middle of this had no transformers and no GPU clusters. What he had was a hunch with three parts. The web would grow too large and too fast for people to operate directly. Agents able to perceive, reason and act for us would be needed. And those agents would require common protocols, representations and semantics.

Where the patterns reappeared, from markup to knowledge graphs

By 2025 much of this had returned, repackaged.

Structured markup first. POML uses XML-like tags to define complex agent workflows, and it has been folded into VS Code tooling. Salesforce's Agent Script defines behavior, roles and coordination in a declarative, markup-style syntax. Even routine prompting advice now tells you to wrap reasoning steps, context and output constraints in tags. A typical prompt skeleton looks like this:

(`<context>`, <instructions>, <examples>, <output>)

It's a small thing, but it's the same instinct as the old markup-for-agents work: give the model a structure it can't misread.

Role-based coordination next. AutoGen and CrewAI assign specialized functions such as planner, critic, executor and researcher, and the agents talk through structured messages. That is the FIPA picture all over again: heterogeneous agents with declared capabilities, coordinating through a central registry. Role specialization, capability directories, message-based coordination and multi-step orchestration are the same patterns.

Then the protocols. A2A lets agents describe their capabilities, discover each other and cooperate across company boundaries. Its launch figure counts partner commitments, not production adoption, which isn't published yet. The Agent Network Protocol uses W3C Decentralized Identifiers and JSON-LD to give agents machine-readable descriptions covering abilities, trust credentials and coordination preferences. The Linux Foundation's Agent Communication Protocol standardizes message formats between agents. Functionally these correspond to FIPA's directory facilitator and agent management system, redone for a JSON-LD and LLM-native world.

Finally knowledge graphs. NVIDIA, Franz Inc. and others recommend joining LLMs with graphs of verified facts to ground reasoning, limit hallucination and make inference explainable. Survey work on neuro-symbolic systems reports that hybrids tend to beat purely neural ones on tasks needing factual accuracy, logical reasoning and generalization to new combinations. Quoted hallucination reductions vary widely by domain and benchmark, so treat any single percentage with caution. The direction of the evidence is more reliable than any one figure.

What the 2006 vision got wrong

The old forecast missed in a few places, and some of the misses were real.

XML was supposed to be the dominant substrate for agents and DOM a shared interface. That didn't happen. The default carriers turned out to be JSON, gRPC, Protobuf and vector embeddings. Thinking moved to deep learning first, then transformers, then LLMs. Knowledge graphs survived, but as one ingredient in a larger neuro-symbolic story.

There was also a plain conceptual error: the idea that XML itself supplied semantics. It doesn't. XML gives syntax and tree structure. Even back then, serious semantic web researchers insisted that shared ontologies and formal semantics were required on top, so the field was ahead of the enthusiasts on this point.

So the broad outline was foreseen, while the amount of the old stack that would be thrown away, and the quantity of new mathematics, hardware and engineering needed, was badly underestimated.

Five problems that never changed

Across roughly twenty-five years of agent design, from FIPA in the early 2000s to modern agentic AI, five design problems keep coming back. Laid side by side, the mapping is short:

ARCHITECTURAL PATTERN EVOLUTION: 2006 → 2025 ## Structured Markup 2006: XML for agent behaviour 2025: POML, Agent Script, XML-tagged prompts Status: Vindicated ## Discovery/Directory Services 2006: FIPA Directory Facilitator 2025: Agent Description Protocol (ANP), A2A directories Status: Vindicated ## Semantic Grounding 2006: RDF/OWL ontologies 2025: JSON-LD, schema.org, KG-LLM integration Status: Transformed but persists ## Communication Protocols 2006: FIPA-ACL 22 performatives 2025: MCP, A2A pragmatic protocols (fewer acts) Status: Simplified but core idea persists ## Perception-Action Loops 2006: FIPA observe-reason-act 2025: ReAct (Observe-Think-Act), tool-use frameworks Status: Fully realised

Structured markup is the cleanest match. XML for agent behavior in 2006 became POML, Agent Script and tag-wrapped prompts, so this one came back almost literally.

Discovery is a close second. FIPA's directory facilitator did the job that A2A directories and the agent descriptions in ANP now do: publish what you can do, let others search for it.

Semantic grounding changed form more than the others. RDF and OWL ontologies gave way to JSON-LD, schema.org vocabularies and knowledge graphs wired into LLMs. The heavy formal layer shrank, but the need for shared meaning didn't go anywhere.

Communication protocols got simpler. FIPA-ACL had 22 performatives. MCP and A2A get by with far fewer message types and a much more pragmatic attitude, yet they still exist for the same reason: two programs from different vendors have to agree on what a message is for.

The perception-action loop is the one that came back fully formed. FIPA's observe, reason, act cycle is ReAct's observe, think, act, plus a tool-use framework around it.

Syntaxes changed, serialization formats changed and the engines doing the thinking changed completely. The questions stayed structurally the same: how an agent describes itself, how agents find each other, how they coordinate, how services get composed and how shared meaning is kept intact.

One caveat applies. Continuity and retrofitting are different things. An XML schema and a JSON schema both describe structured data, yet the philosophies behind them differ: formal and rigorous on one side, light and pragmatic on the other. Many present-day developers are also rediscovering these patterns on their own and not drawing on FIPA or the semantic web. That's convergent evolution under the same constraints, which says little about lineage.

Agentic AI, as it is defined now

Modern surveys describe agentic AI as systems in which LLM-based agents perceive, plan, act and learn with some autonomy. Enterprises speak of agentic meshes, distributed networks of agents spanning tools, data sources and workflows. McKinsey's 2025 survey of about 1,100 organizations reported that just over half were using agentic AI in production in some form. The catch is that "production" there includes pilots and limited deployments, so it doesn't mean full enterprise rollout.

Planning

Planning shows the convergence most clearly. A 2024 survey of LLM-based planning sorts the methods into five families:

1. Task decomposition, which breaks a large goal into sub-goals.
2. Plan search, which explores alternative sequences of actions.
3. External planners, which plug in classical PDDL or hierarchical task network systems.
4. Feedback and reflection, which refine a plan from execution outcomes.
5. Memory-based planning, which retrieves and adapts earlier plans.

Every one of these has a counterpart in the 2000s agent literature, under names such as HTN planning, case-based reasoning and plan repair. The underlying difficulties are shared too: combinatorial explosion, incomplete information and changing environments. What is different is the substrate. LLMs now draft and refine plans in natural language instead of symbolic planners, and tool calls and feedback loops ground them.

The ReAct pattern from Yao and colleagues makes the link explicit. The agent observes, writes a reasoning trace, picks an action, sees the outcome and repeats. That's the old perceive, reason, act cycle that FIPA architectures were built around. The reasoning engine is new and the loop is not.

Orchestration versus choreography

An argument from the web services era has also resurfaced. Orchestration uses a central controller to direct interactions, the way BPEL workflows did. Choreography lets participants coordinate peer to peer using shared protocols and mutual commitments. The BPEL and web service choreography literature of 2005 to 2010 debated this at length, and the same conversation is being repeated, only now with LLMs as the cognitive core in place of rule engines and Java agent platforms.

Small models for routine work

One recent finding changes the picture of what an agent needs. NVIDIA researchers argue that many routine agentic jobs don't call for a frontier model. Models with one to ten billion parameters can handle tool invocation, input validation, output formatting and simple routing, at a claimed cost advantage of ten to thirty times for narrow tasks where they match larger models. The advantage shrinks as tasks become more complex, so it isn't universal.

The pattern emerging is therefore mixed. Small models do the routine operations, API calls, data checks and simple routing, while large models are saved for hard reasoning, ambiguity and unfamiliar problems. That echoes the 2000s split between lightweight reactive agents for routine work and deliberative agents with heavy planners for difficult coordination.

Where the comparison turns uncomfortable

Safety and governance are where the modern story departs most from the older vision, because they have developed much more slowly than capability.

AgentHarm, a benchmark by Andriushchenko and co-authors, tests how readily LLM agents can be steered into harmful actions. It covers 110 tasks across 11 categories, including fraud, cybercrime, harassment, disinformation and other abuses. Tested against leading models, agents completed many of the harmful tasks even with guardrails turned on. Anthropic's red-teaming work reports comparable weaknesses: jailbreaks that fail against ordinary chatbots can work on agents, since a multi-step, tool-using system exposes a bigger attack surface. OS-Harm, aimed at computer-use agents that operate an operating system directly, found high rates of unsafe behavior when models were deliberately prompted toward things like data exfiltration or unauthorized access.

Keep the framing straight. These are adversarial benchmarks built to provoke failures, so high failure rates are expected. Still, the ease of basic prompt injection, and the readiness to go along with malicious requests without any sophisticated attack, suggest that safety mechanisms are immature next to the gains in capability.

Compare that with the FIPA era. The specifications covered access control policies, trust models and interaction protocols with authentication, authorization and audit trails. Agents ran inside bounded trust domains with explicit restrictions on what they could do, and the semantic web stack included formal policies in rule languages. Those systems were far less capable than today's models, but governance was designed in from the start rather than attached afterward.

Anyone who has watched three waves go by (classical symbolic AI, distributed web agents with the semantic web, and now LLM-driven agents) will notice that the slogans changed each time and the architectural pain points did not. Identity, permissions and audit were hard problems in 2005, and they're hard problems now, only with an agent that can actually spend money.

The present pattern is worrying. Capability has exploded. Agents can browse, run code and make payments. Formal methods to verify their behavior, or to hold their actions inside safe regions, remain scarce.

Neuro-symbolic: LLM agents plus knowledge graphs

A useful way to frame the whole arc is as thesis, antithesis and synthesis.

• The 2000s were symbolic: formal ontologies, logic-based reasoning and hand-built rules. Strengths were explainability, formal verification and precise semantics. Weaknesses were brittleness, poor generalization and an inability to cope with natural language in a dependable way.
• The 2010s were neural: deep learning, embeddings and end-to-end training. Strengths were pattern recognition, fluent language and generalization from data. Weaknesses were opacity, hallucination, shaky logic and trouble with compositional tasks.
• The 2020s point toward hybrids that combine neural models with knowledge graphs, logical constraints and formal methods, aiming to keep fluency while adding grounded facts, sound reasoning and explainability.

A growing body of neuro-symbolic research supports this. Surveys describe several integration patterns, including injecting symbolic knowledge into neural models, letting neural components guide symbolic reasoning and refining results by alternating between the two. Systems mixing both styles tend to outperform purely neural or purely symbolic baselines where factual accuracy and logical reasoning matter.

Franz Inc.'s AllegroGraph integration with LLMs is a concrete case. An RDF triple store holds structured facts, the language model interprets questions and writes answers, and the result can cite the specific triples behind a claim, giving fluency and verifiability together.

The failure modes of pure LLM agents are well documented. Studies of medical question answering and of legal tasks have found models inventing contraindications, dosages and even court cases, with rates that depend heavily on the domain and the study design. Those aren't rare edge cases. They follow from how the models work: they're pattern matchers trained on text, not reasoners with access to checked facts. Knowledge graphs offer verified triples, provenance metadata and logical constraints, which lets a system tell a plausible-sounding statement from a verifiable one.

What builders can take from it

If you're designing an agent system today, the history suggests a few habits that cost little and age well.

Write down how each agent describes itself. A capability description that another system can read, with inputs, outputs and preconditions, is the modern descendant of a service profile, and it's the thing that makes discovery and composition possible at all. Without it, every integration is a one-off.

Decide early how meaning is shared. When two agents exchange a field called "status" or "customer", something has to settle what those words cover. A schema is the minimum. Where the stakes are higher, a small ontology or a knowledge graph that both sides consult prevents the slow drift where each agent quietly assumes a different definition.

Choose a coordination style on purpose. A central orchestrator is easier to reason about, to audit and to debug. Peer-to-peer choreography scales across organizations and avoids a single point of failure but is harder to observe. The web services community learned this the hard way, and the lesson carries over unchanged.

Treat governance as architecture. Identity for each agent, scoped permissions, an audit trail for every action and a way to verify behavior are far cheaper to design in than to retrofit after an incident. The older agent platforms often had these pieces, because their authors expected agents to operate across trust boundaries from the first day.

Finally, match the model to the job. Reserve the expensive reasoning engine for work that needs it and let small, cheap components do the routine parts. That makes systems faster and less costly, and it also narrows what any single component is allowed to do.

Not a victory lap

None of this is meant to romanticize the past. The semantic web never became mainstream in industry, and the reasons were sound. It was complicated, slow, short of critical mass, and the standards promised more than messy practice could deliver. Language models did something those systems never managed, which is to handle natural language reliably and at scale. That separates niche tooling from world-changing infrastructure.

The sensible conclusion isn't that the early advocates were right and everyone else arrived late. It is closer to this:

• The cognitive core has changed, from logic and hand-built rules to neural models that learn from data.
• The infrastructure problems have not changed.
• Interoperability, semantics, coordination, safety and governance still need explicit engineering.

Being early and being usefully right are different things. One 2006 attempt tried to build an artificial intelligence interface between different patterns of machine and human language using XML. Today that job would go to JSON schemas, vector stores, knowledge graphs and a shared protocol like A2A or MCP. The instinct is unchanged: get the interface right.

Blind spots worth naming

Design reviews and architecture forums today contain claims that echo what was said about the semantic web twenty years earlier. There is real progress to point at: transformers, capable autonomous agents and large deployments. There are also familiar gaps:

• Weak or missing interoperability strategies.
• Little attention to formal semantics or ontologies.
• Governance treated as a wrapper instead of an architectural layer.

Three plausible scenarios show what happens if those gaps persist. None of them is a prediction, only extrapolation from the current trajectory.

The first is a Tower of Babel. Every vendor builds proprietary agent systems, so one company's agents can't talk to another's or use its tools. Enterprise IT turns into a patchwork of incompatible platforms where every pairwise connection needs custom integration, with integration overhead many times higher, productivity gains lost and consultants collecting the fees.

The second is a safety crisis. A production agent fleet at a financial firm is jailbroken through prompt injection and executes unauthorized transactions worth millions. No audit trail exists, because formal verification was judged too expensive and unnecessary given how sophisticated LLMs seemed. Regulatory fines, lost customer trust, executive departures and an industry-wide backlash follow.

The third is a hallucination disaster. Healthcare agents recommend treatments based on research papers that never existed and contraindications that were made up, with no knowledge graph to anchor them. Patients are harmed, malpractice suits describe pure-LLM systems as inherently unreliable and medical AI adoption loses years.

None of that is far-fetched. Benchmarks like AgentHarm show how easy current systems are to compromise, and hallucination in medical settings is documented. The window for building proper infrastructure is now, before a major public failure forces the issue.

Ideas cycle, blueprints stay

Ideas cycle. They fail, resurface and finally land when the surrounding environment is ready. What was once described as agents exchanging "packet processed" information to build high-value answers for humans is today described in the language of LLMs, vector databases and multi-agent frameworks. The details changed and the blueprint did not.

Old ideas pay off only when someone digs them up and reads them closely.

Sources worth opening

• AgentHarm benchmark for measuring harmful agent behavior.
• OS-Harm for safety of computer-use agents.
• Neuro-symbolic AI in 2024: a systematic review.
• Understanding the planning of LLM agents, the planning survey discussed above.
• Large Legal Fictions on legal hallucination.
• ReAct by Yao and colleagues.
• FIPA specifications for the original agent communication standards.