Morgan Stanley Reworks Its API Program for AI Agents With Architecture as Code

Morgan Stanley is rebuilding how it governs the interfaces that its software and AI agents rely on, using a model-driven approach known as Architecture as Code. Engineers Jim Gough and Andreea Niculcea laid out the work in a presentation, describing how the bank applies CALM, or Common Architecture Language Model, to keep its API estate consistent as agentic workloads spread across the firm. The pitch is straightforward: when agents, not just humans, call internal services, the old spreadsheet-and-review style of API management stops scaling.

The mechanics matter more than the slogan. CALM lets teams describe services, dependencies and interfaces as machine-readable architecture models that live in version control alongside the code they describe. From there, Morgan Stanley wires in the Model Context Protocol, an emerging standard for connecting models to tools and data, and Agent-to-Agent communication, which lets autonomous agents hand work to one another. Gough and Niculcea framed these as complementary layers rather than competitors: MCP for tool and context access, A2A for coordination between agents.

The governance piece is where the approach gets teeth. Rather than relying on periodic architecture reviews, the bank enforces its rules through automated gates in the deployment pipeline. If a service drifts from the modelled contract, or if an agent-facing interface does not meet the defined standard, the pipeline blocks it. That turns architecture documentation from a static artifact into an active control, which matters for a regulated institution that has to show auditors why a system behaves the way it does.

Scale is the other half of the story. The presentation covered zero-downtime platform upgrades, the kind of change that lets the underlying infrastructure evolve without taking agent workflows offline. For a firm running trading, advisory and back-office systems, an upgrade window that disrupts an agent mid-task is not an inconvenience; it is a risk event. Keeping the platform live while the architecture underneath it changes is what makes agentic automation viable in production rather than in a demo.

The broader signal for the AI industry is that enterprise adoption of agents is becoming an infrastructure problem, not just a model problem. Protocols like MCP and A2A are gaining traction precisely because firms need standard ways to expose tools and let agents collaborate, and vendors building agent platforms will increasingly be judged on whether they fit into existing architecture-as-code and CI/CD pipelines. Morgan Stanley's work suggests the winners will be the tools that slot into governance regimes banks already trust.

What to watch next is whether CALM and similar architecture-model formats get adopted beyond a handful of large financial firms, and whether MCP and A2A settle into stable, interoperable standards or fragment into vendor-specific dialects. Gough and Niculcea did not publish adoption numbers, so it remains unclear how much of Morgan Stanley's API estate now runs through this pipeline. The open question is whether automated architecture gates can keep pace with how quickly agent frameworks are changing.