Blog Details

Why Agents Need a Cognitive Layer (And How to Build On Top of One)

We can get agents to use tools, follow instructions, coordinate through chains and graphs. What we can't easily do is get them to collectively improve at a task over time.

Why Agents Need a Cognitive Layer (And How to Build On Top of One)

The Thesis

Most multi-agent systems are disposable. You spin up agents, they do work, the output goes somewhere, and the agents disappear. Next time you run them, they have no idea what happened last time.

People solve this with RAG — shove past outputs into a vector database, retrieve them before each run. That works for lookup. It doesn't work for improvement. There's no mechanism for the system to tell good knowledge from bad, recent from stale, confirmed from speculative. Everything is flat.

What you actually want is a layer underneath your agents that behaves more like a brain than a filing cabinet. Something that scores what it knows, forgets what's outdated, strengthens what's been validated, and lets agents build on each other's work without someone curating the knowledge manually.

That's what I mean by "cognitive layer." It's the piece that turns a disposable agent pipeline into a system that actually gets better over time.

I'll walk through how to build on top of one. The reference implementation is in the SRE domain (incident response), and the cognitive layer is SenseLab, but the architecture applies anywhere agents do repeated investigative work.

Architecture

There are three layers. Each one has a specific job:

  • The orchestration layer is a council of agents. Not a chain — a group with defined roles that the orchestrator assigns work to depending on what it finds in memory. The agents are: triage (classifies the problem), memory (checks what we already know), specialist (pulls live data from tools), verification (stress-tests findings), and synthesis (writes the final analysis).
  • The tool layer is MCP (Model Context Protocol). Each specialist agent gets scoped access to specific infrastructure tools. An infra specialist can query Datadog and GCP. A code specialist can read GitHub commits and CI pipelines. The scoping is intentional — you don't want one agent seeing every tool available; it kills context window efficiency and introduces confusion.
  • The cognitive layer is SenseLab. It's a knowledge graph where entries have confidence scores, timestamps, authorship, and links to outcomes. Agents read from it before acting and write to it after completing work. Outcomes (did the fix work?) propagate back and update confidence scores on the knowledge that led to them.

The first two layers are swappable. You can use a different orchestrator pattern, different tools. The third layer — the cognitive layer — is what creates the self-improvement property. Without it, you have agents that do work. With it, you have a system that compounds what it knows.

The feedback loop

Every agent follows a protocol when interacting with the cognitive layer. There are five steps.

1. Read

Before doing anything, the agent asks: what does the system already know about this?

briefing(entity_path="myapp/checkout-service")
recall("myapp/checkout-service", "pattern-timeout-cascade")
search(query="connection pool exhaustion", min_confidence=0.5)

What comes back is ranked. High-confidence, recently-validated entries come first. Stale speculation sits at the bottom. The agent can decide how much to trust each piece based on its score and age.

2. Act

The agent does its actual work — pulls logs, checks metrics, reads recent deploys, whatever the investigation requires. It uses MCP tools to get live data and correlates it against what the knowledge graph said.

If the read step returned a 0.85-confidence playbook matching this exact failure, the agent can skip exploratory investigation and go straight to verifying whether the known fix applies here.

3. Write

After completing work, the agent writes structured findings back:

write("myapp/checkout-service", "pattern-pool-exhaustion",      
	"Connection pool exhaustion caused by N+1 queries from commit abc123. "      
	"Symptoms: 504s, p99 > 10s, pool_active hits ceiling. "      
	"Resolution: connection timeout config + query batching.",      
	confidence=0.75, memory_type="experience")

The confidence is 0.75 — this worked once, it hasn't been confirmed by a second incident yet. The memory_type is "experience" (something the agent actually did and observed), which decays slower than "belief" (a hypothesis).

4. Validate

Later, the outcome gets reported:

commit_outcome("checkout-pool-fix", "success")

Or "failure". The system links this outcome back to every read and write that contributed. It now knows which knowledge led to a good result and which didn't.

5. Propagate

Confidence scores update. A successful outcome pushes the contributing knowledge from 0.75 toward 0.9. A failure drops it. Knowledge that sits unvalidated for months drifts downward on its own — this is temporal decay.

No human made these adjustments. The system corrected its own knowledge base through use.

Cross-agent transfer

The cognitive layer isn't per-agent storage. It's shared. Agents read each other's work, and the system tracks those reads.

Here's a concrete example:

  • Week 1. An infrastructure specialist investigates a timeout cascade. It finds connection pool exhaustion as the root cause. Writes the pattern to the knowledge graph with confidence 0.7.
  • Week 2. A code specialist encounters something similar on a different service. It reads the infra specialist's finding via read_from(agent_a). It correlates that pattern with a recent commit that introduced unbounded queries. Confirms the fix works. Outcome: success. Confidence on the original pattern rises to 0.9.
  • Week 3. A security specialist gets an alert on yet another service. The knowledge graph now has a 0.9-confidence pattern, validated by a different agent in a different context. The security specialist reads it, confirms it applies, resolves the incident in minutes instead of hours.

The cognitive layer tracked all of this — who wrote what, who read from whom, which reads led to good outcomes. That's institutional knowledge building itself, without anyone writing a runbook or updating a wiki page.

Why this isn't just a database

You could store agent findings in Postgres. Stuff them into Pinecone. The technical difference:

  • Confidence scoring. Raw storage treats everything the same. A hallucinated hypothesis from three months ago sits next to a validated fix from yesterday. The cognitive layer scores each entry and adjusts those scores based on real outcomes.
  • Temporal decay. Old knowledge that hasn't been reconfirmed should carry less weight. If no agent has validated a pattern in six months, its confidence drifts down. This prevents the system from calcifying around early (and possibly wrong) conclusions.
  • Decision traces. The layer stores not just conclusions but the reasoning path — what was read, what tools were called, what hypotheses were considered and discarded. A future agent can retrace the logic. This matters for debugging: when the system gives bad advice, you can trace exactly where the bad knowledge entered.
  • Provenance. Every entry has an author (which agent wrote it), validators (which agents confirmed it), and a usage history (which agents read it and what happened). This is an accountability graph. You can audit knowledge flow.
  • Outcome propagation. This is the mechanism that makes the system self-correcting. Without it, you're writing to storage. With it, success strengthens knowledge and failure weakens it — automatically, on every use.

The SRE implementation

The reference implementation is an incident response system that runs on your machine against your actual infrastructure. The repo is at github.com/raia-live/sre-sample.

SRE is a good fit for this architecture because:

  • Failures repeat. Most incidents are variations of problems that have happened before. A system that remembers past incidents has an obvious advantage.
  • Multiple specialists need to collaborate. An incident might involve infrastructure, application code, and deployment state all at once. Different agents with different tool access can investigate in parallel.
  • Outcomes are clear. Either the fix worked or it didn't. This makes the feedback loop unambiguous.
  • Time-to-resolution matters. If the system can go from "full investigation" to "confirm known pattern + resolve" on recurring failures, the value is immediate and measurable.

To run it you need an LLM API key (Anthropic or OpenAI) and a SenseLab account (senselab.ai). You point it at your infrastructure through MCP configs — Datadog, GCP, GitHub, Jira, PagerDuty, whatever you use — and start it with docker compose up or make dev.

The first few incidents are fully exploratory. By incident ten or fifteen, common patterns are already stored with validated playbooks. The system is noticeably faster on repeat failure modes without anyone changing a line of code.

If you're building something similar

The pattern generalizes. Anywhere you have agents doing repeated investigative work — security triage, code review, support escalation, compliance checks — the same architecture applies.

A few things I'd do from the start:

  • Put the cognitive layer in first. Before you optimize orchestration or add more tools, get agents reading and writing structured knowledge. The self-improvement loop is where the leverage is.
  • Score everything. No entry goes into the knowledge graph without a confidence level. This forces agents to be explicit about how certain they are, and it gives future agents a way to decide how much weight to put on prior findings.
  • Close the outcome loop. If you skip this, the system can't self-correct. Most people build the agents, build the tools, and then never wire up the part where results feed back into knowledge. It's the most important step.
  • Let things decay. Unvalidated knowledge should lose influence over time. Without decay, early (bad) entries accumulate permanent authority. With decay, only knowledge that keeps getting confirmed stays relevant.
  • Track who said what. Provenance matters when things go wrong. If the system starts giving bad recommendations, you need to trace which agent introduced the bad knowledge, which agents validated it (incorrectly), and why the confidence got high.

SenseLab handles the decay mechanics, scoring, propagation, and provenance as infrastructure. Your job is to write agents that follow the protocol: read before acting, write after completing, report outcomes. The layer does the rest.

Author :
Bruno Andrade
Bruno Andrade
Category :
Cognitive layer
Date :
June 4, 2026
Length :
5 Min read
Share :
Smarter Agents.
On Every Run.

Free tier. No credit card. Connect in minutes.

Sign Up
White circular shape with a subtle drop shadow on a transparent background.