Most integration pain comes from systems calling each other directly: N sources × M consumers of coupling, failure that cascades, and every launch blocked on every dependency. Event-driven architecture inverts it — producers emit typed domain events onto a backbone, consumers subscribe and maintain their own read models. Nobody polls anybody.

The payoffs are isolation of failure (a slow upstream never takes your front-end down), independent deployability (new consumers subscribe without upstream change requests), and replayability — read models become disposable, rebuilt from history instead of migrated. I've shipped this shape at broadcaster scale (ABC's DigiStream pipeline) and museum scale (the Powerhouse Content API).

When content or commerce lives inside the system that renders it, every new channel is a rebuild. Headless design separates the two: sources of truth stay specialised (CMS, collection system, CRM), a platform API exposes one stitched contract, and every 'head' — web, in-gallery, apps, partners — consumes the same thing.

The discipline that makes it work is treating the API contract as the product. Channels come and go; the contract compounds. At Powerhouse this is what lets a website, an exhibition interactive and a partner feed all render the same object without three integrations.

A single AI chat session is a tool; a system of agents is infrastructure — and it needs the same architecture discipline as any distributed system. The shape I've converged on: an orchestration layer that routes work to specialist agents in parallel lanes, a queue that lets work proceed without a human present, and persistent memory so no session starts amnesiac.

The load-bearing decisions are the boundaries: agents own file domains so they never write over each other, autonomy is fenced by non-negotiable rails (no direct pushes to main, no secrets in commits, stop-and-explain on repeated failure), and every autonomous change lands behind the same CI and review gates a human's would.

Identity is where security posture and user experience meet, and both fail when every application solves login alone. The pattern: one authentication authority (an IdP like Auth0), every application reduced to a standards-based client, and — crucially — a clean split between authentication (who is this, verified) and the business system of record (who is this, to us).

Get that seam right and the rest follows: MFA and session policy set once, organisation-scoped access instead of per-app role tables, and new properties onboarding in hours because auth is configuration, not code.