A library recommendation agent's older version is being retired after a security review found it used an overly broad tool permission set, and the team needs to formally deprecate it without breaking dependent workflows. What should they rely on?
Select an answer to reveal the explanation.
Short Explanation
Retiring a flagged agent version without breaking things downstream is like phasing out an old product line, not yanking it off the shelf mid-sale with no notice. Agent Registry's lifecycle governance is the controlled phase-out: mark the version deprecated so anything depending on it can see the change coming and adapt. Deleting it outright, or blocking it with an ad hoc traffic rule, both skip that controlled, visible step.
Full Explanation
Agent Registry's lifecycle governance supports marking a specific agent version deprecated in a structured, visible way, which lets dependent workflows detect the deprecation and migrate deliberately rather than failing unexpectedly, satisfying both the security goal of retiring the flagged version and the operational goal of not breaking things that rely on it. Immediately deleting the flagged version's deployment removes it entirely with no transition period, which addresses the security concern but directly conflicts with the stated requirement to avoid breaking dependent workflows that may still be calling it. Skill Registry governs individual skills and their vetting, but the issue here is a permission set at the agent level, not a specific skill being flagged, so Skill Registry isn't the mechanism that tracks or communicates an agent version's deprecation status. Agent Gateway can block traffic to a specific version through an ad hoc rule, which might stop new invocations, but it's a traffic-control workaround rather than a lifecycle state change, and it wouldn't give dependent workflows the same structured signal that a proper deprecation status provides for planning their migration. A scope caveat: deprecation should typically include a defined sunset window rather than an indefinite parallel-running state, so the flagged permissions don't linger in production longer than necessary. As an operational check, an architect can query Agent Registry for the version's status and confirm it shows as deprecated with a documented migration path for any workflow still referencing it.