Alibaba Cloud Bailian (with embedded AgentScope 2.0)

1. Introduction

1.1. Platform Positioning

Alibaba Cloud Bailian is the large-model service platform and agent development platform launched by Alibaba Cloud (Tongyi Laboratory). It adopts a two-track model of "closed-source commercial SaaS + open-source foundation framework": on the commercial side is the Bailian platform (smart-agent apps, workflow apps, and code-first apps — three forms); on the open-source side is the AgentScope framework — its 2.0 release (2026-05-25) completely rewrote the six core layers of Message, Tool, Workspace, Permission, Middleware and Service, making it the highest-engineering domestic open-source Agent foundation in this study.

Bailian's strategic position can be summarized as: use low-code to cover business staff, use workflows to cover process engineers, and use AgentScope to cover algorithm engineers — three roles each get what they need on the same platform, and the tiers can be bidirectionally connected. This "full-coverage" product structure, together with all six layers rated "strong", makes it one of only two platforms in this study with "no weak layer across all six layers", alongside Microsoft Agent Framework.

1.2. Basic Information Card

Version numbers and feature availability change rapidly with each release; this document reflects the point of retrieval in 2026-09.

1.3. Development Timeline

1.4. Position in the AI Harness System

Per the boundary table of the parameter sheets, Bailian is an Agent Platform (Harness's productized packaging), and it is the only domestic platform in which both tracks — "platform + open-source foundation" — reach production grade:

• Commercial side (Bailian): stacks UI, tenancy, billing, publishing and observability, covering all six layers L1–L6;
• Open-source side (AgentScope 2.0): as a standalone-deployable Agent Framework, it is Harness's complete reference implementation — permission system, context compaction, event streaming, and Agent teams are all first-class citizens;
• Comparison with Microsoft Agent Framework: the two are the only platforms in this study where all six layers reach "strong"; the difference is that MAF is a pure framework + cloud hosting, while Bailian is a two-track "cloud platform + open-source framework", and it closes the loop directly from evaluation (OpenJudge) to training (Trinity-RFT), forming a unique "evaluation-as-training-reward" chain.

2. Glossary

3. Feature Description

3.1. Three App Types and Their Combination

Key design: the three modes can be combined within a single app — workflow nodes can call agent groups, delegating judgment-heavy steps to collaboration among multiple subagents, while the other nodes still execute in fixed order. This is philosophically isomorphic to CrewAI's "Flows wrapping Crews" and Dify's "Agent Node": containing a probabilistic core inside a deterministic container, but Bailian makes the three forms first-class citizens on the same platform.

3.2. Agent 2.0 Planning Engine

The core change in Agent 2.0 is upgrading "tool calling" from a fixed order to autonomous planning:

• Knowledge base and MCP services are no longer called in a preset order; instead, the planning engine autonomously decides when to call and which one to call;
• Introduces a "Plan–Execute–Reflect" chain: intent understanding → task planning → tool calling → execution feedback → self-optimization, with the entire flow visualized;
• This upgrades smart-agent apps from a "configured chatbot" to a "planning-capable execution entity" — Bailian's platform-level expression of the third-generation Runtime form.

3.3. Memory and API Publishing

• Memory: short-term memory + long-term memory, maintaining context across sessions; on the open-source side, ReMe / Mem0 are additionally available;
• API publishing: one-click publishing of an app as a REST API, supporting streaming output; supports multi-turn conversation (via session_id or self-managed messages); knowledge base retrieval is controlled through rag_options (passing pipeline_ids);
• Observability: app observability records vector generation, retrieval, model calls, latency, token usage and running status.

3.4. AgentScope 2.0 Core Capabilities

AgentScope 2.0 (2026-05-25) completely rewrote the six core layers; main capabilities:

1. Model integration: Qwen, Anthropic, DeepSeek, Gemini, OpenAI + Grok, Moonshot; unified retry and fallback (Retry & Fallback);
2. Messages and events: unified Content Block + Event System — execution is observable, interactive and interruptible;
3. Permission system: allow / deny / escalate three-state decisions; filesystem tools check dangerous directories and sensitive files; command tools analyze high-risk commands, dynamic shell construction and destructive deletion; static analysis of shell pipelines;
4. Context engineering: Agent-class context compaction (configurable + offload / storage persistence) + tool-result compaction (large tool outputs summarized before feeding back);
5. RAG and long-term memory: file-based agentic memory / ReMe / Mem0 multiple backends;
6. Agent Service and Agent Team: hosts users, sessions, frontend; leader-worker multi-agent collaboration, each worker with an independent session;
7. Skills: a directory containing SKILL.md, registered to a toolkit or workspace — isomorphic to the Anthropic Agent Skills open standard;
8. Structured output: Pydantic structured_schema → structured_output;
9. Middleware: injects behavior at lifecycle points such as model calls, tool execution, and context compaction;
10. HITL: permission request confirmation + interruption flow.

3.5. App Observability

Observability on the Bailian platform side covers: vector generation, retrieval, model calls, latency, token usage, and running status; you can expand the full call chain per request to locate whether a problem is in the model, retrieval or tool node; built-in runtime logs, Trace chains and an API gateway make every step traceable, debuggable and rerunnable.

4. Platform Architecture

图 4-1｜百炼平台分层架构（Agent 2.0 核心 × 五层栈）

数据来源：基于本文分析绘制的示意图。

4.1. Bailian Platform Layering

┌──────────────────────────────────────────────────────────┐
│ 用户交互层   控制台 / API / 网页应用 / IM 机器人             │
├──────────────────────────────────────────────────────────┤
│ 智能体核心引擎  Agent 2.0                                   │
│  规划引擎：意图理解 → 任务规划 → 工具调用 → 执行反馈 → 自我优化 │
├──────────────────────────────────────────────────────────┤
│ 工具层                                                     │
│  知识库（RAG）/ MCP 服务（20+ 云端、50+ 本地）               │
│  内置工具（代码解释器、文件解析、图像生成）/ 插件              │
├──────────────────────────────────────────────────────────┤
│ 模型层        Qwen3.7-Max / Plus 等 150+ 模型              │
├──────────────────────────────────────────────────────────┤
│ 基础设施      上下文压缩 / 断点续跑 / Vault 密钥管理          │
│              运行日志 / Trace 链路 / API 网关                │
└──────────────────────────────────────────────────────────┘

4.2. AgentScope 2.0 Core Layers

AgentScope 2.0 completely rewrote the six core layers of Message, Tool, Workspace, Permission, Middleware, Service:

• Message: unified Content Block / DataBlock (supporting base64 and URL data sources), covering text, images, files, tool calls, tool results, model thinking, and user-confirmation state;
• Tool: tools rebuilt based on ToolBase — _bash, _edit, _glob, _grep, _read, _write; tools are connected to the Workspace, with file / Shell tools uniformly executed in the Agent's Workspace;
• Workspace: provides the execution environment, managing tools, MCP servers, Skills and offloaded context;
• Permission: Agent-class built-in permission checking — consulting the permission system before every tool call — a design that makes governance a runtime default behavior;
• Middleware: lifecycle interception points, isomorphic in design to the Microsoft Agent Framework Middleware pipeline (see 09-autogen.md);
• Service: Agent Service hosts users, sessions, Agent teams and the frontend.

4.3. Processing Flow of a Smart-Agent App Request

1. The user initiates a request via the console / API / IM bot;
2. The planning engine understands intent and generates a task plan (Agent 2.0 chain displayed visually);
3. Tools are called according to the plan: knowledge base retrieval (RAG), MCP services, built-in tools or plugins — each pass goes through the permission system before calling;
4. Large tool outputs are fed back to the model after tool-result compaction;
5. Execution feedback enters the reflection stage, re-planning when necessary;
6. The entire process is reported through an event stream (Event System): text deltas, tool calls, confirmation requests, etc. — interactive and interruptible;
7. Runtime logs and Trace chains are persisted for observability, debugging and rerunning;
8. Long tasks run across hours, relying on checkpoint resumption and Vault secret management.

5. Harness Design

5.1. Overview of Six-Layer Capabilities

5.2. L1 Context Engineering Layer

Bailian's distinguishing feature in L1 is the dual-compaction mechanism:

• Conversation-history compaction: AgentConfig exposes compaction configuration, and the compacted history is persisted by the offload / storage base modules — compaction does not merely discard, it keeps an auditable archive;
• Tool-result compaction: large tool outputs are summarized before being fed back to the model — this precisely hits the real pain point of agent scenarios (a single file read or web scrape can overflow the context); among all 14 platforms, only a few implement this explicitly;
• Combined with the full RAG flow, ReMe / Mem0 long-term memory, and on-demand Skill loading, L1's mechanism density reaches a level on par with Google ADK (compaction / rewind / resumption) and Microsoft Agent Framework (Harness Agent auto-compaction).

5.3. L2 Tools and Execution Layer

• MCP in three transports (StreamableHTTP / SSE / STDIO) + dynamic loading / unloading of Anthropic Agent Skills — the open-source framework's follow-on to the Skills open standard;
• All six built-in file and Shell tools execute within the Workspace, forming a "tools–environment–permissions" closed loop together with the permission system;
• Task tools (TaskCreate / Get / List / Update) support plan tracking for long tasks.

5.4. L3 Orchestration and Control Layer

• Three-form combination is the biggest structural advantage of this layer: the determinism of workflows and the autonomy of agents can be freely apportioned within a single app;
• Agent 2.0's Plan-Execute-React chain makes the planning process visible, partially addressing the tension of "autonomous planning being unpredictable";
• On the AgentScope side, dynamic graph orchestration primitives such as MsgHub and pipeline syntactic sugar are provided, and the Agent Team's leader-worker pattern covers multi-agent collaboration;
• Model-layer Retry & Fallback ensures an outage of a single model does not block the task.

5.5. L4 Memory and State Layer

• Automatic compaction of short-term memory + three backends for long-term memory (file-based agentic memory / ReMe / Mem0) + RAG form a complete memory stack;
• Checkpoint resumption is the key mechanism on the Bailian platform side: it supports multi-hour cross-step automation tasks, and together with Vault secret management resolves the credential-security problem of long tasks — sharing the "durable execution" tier with LangGraph's Checkpointer and MAF's Foundry Hosted recovery.

5.6. L5 Evaluation and Observability Layer

This layer is the most original part of Bailian:

• Platform side: app observability records vector generation, retrieval, model calls, latency, token usage and running status; expanding the call chain per request can locate whether a problem is in the model / retrieval / tool node;
• OpenJudge: 50+ production-grade judges systematically measure agent lifecycle, tool use, code, math and multimodal output;
• Trinity-RFT closed loop: evaluation verdicts can be converted into training rewards and fed back to the model through reinforcement fine-tuning (Explorer / Trainer / Buffer decoupling) — turning "evaluation" from an "acceptance step" into a "training signal", a design unique among all 14 platforms;
• Comparison reference: LangSmith excels at observability and evaluation-set management, and OpenAI Agents SDK excels at out-of-the-box tracing, but only Bailian connects evaluation and training.

5.7. L6 Governance and Security Layer

The combination of "three-state permission decisions + shell static analysis" ranks alongside Claude Agent SDK's layered permissions and Microsoft Agent Framework's Middleware / Filters as cutting-edge L6 practice in this study.

5.8. Concrete Expression of Three Internal Tensions

6. Real-World Cases

Case 1: YuYi Technology — maternity-and-baby e-commerce customer service overhaul (vendor figures)

Overhauled customer service for maternity-and-baby e-commerce based on the Qwen large model, achieving precise intent recognition, customer-service efficiency improved by more than 40%, and building a data closed loop. The source is a retelling on the Alibaba Cloud product page (China Economic News Net); it is vendor self-reported and has not been third-party independently verified.

Case 2: AgentZoo / Alias smart-agent apps

Smart-agent apps targeting finance, data science, speech, Q&A and other domains; the Alias general-purpose agent platform can build digital assistants (low-relevance source, details).

Platform-scale figures (must be cross-checked when citing)

Some materials describe Alibaba Cloud's agent-business base using "penetration into 50+ public-cloud industries, 1 million+ cumulative enterprise customers"; note in particular: Volcano Engine also released figures of the same magnitude (50+ industries, 1 million+ enterprise customers) in its promotional figures for Coze (see 06-coze.md). Neither vendor's statistical basis, timing, or target has been disclosed, and the identical figures cannot be cross-verified; when citing, label as "vendor self-reported, basis not independently verified".

Part where no public quantitative data was found: apart from the single YuYi Technology case, no further named enterprise landing cases were found, and no case obtained third-party independently verified effectiveness data — stated as-is, without filling in the gaps.

7. Summary

7.1. Strengths

1. No weak layer across all six layers: alongside Microsoft Agent Framework, it is one of only two platforms in this study where all of L1–L6 reach "strong";
2. Dual-compaction L1: conversation-history compaction + tool-result compaction, directly hitting the real pain point of agent context bloat;
3. L5 exclusive closed loop: OpenJudge 50+ judges + Trinity-RFT converts evaluation verdicts into training rewards, connecting evaluation and training;
4. Open-source + commercial two-track: AgentScope 2.0 can be deployed independently, while Bailian provides commercial backing; low-code and high-code connect bidirectionally, covering different roles within an enterprise;
5. Cutting-edge L6: three-state permission decisions + shell static analysis build governance into runtime default behavior;
6. Alibaba Cloud ecosystem synergy: ECS / RDS / OSS cloud foundation + DingTalk / WeCom integration + Xinchuang adaptation (Kunpeng / Ascend).

7.2. Weaknesses

1. Limited international influence of the open-source ecosystem: AgentScope's community size and international awareness lag behind LangGraph / ADK;
2. Average depth of third-party model integration: multi-model support is Qwen-centric, and the optimization level of non-Qwen models is unknown;
3. High privatization cost (third-party evaluation figures): the enterprise-subscription threshold and privatization deployment cost are unfriendly to SMEs;
4. Insufficient case disclosure: only one quantitative case with a named enterprise, and it is vendor self-reported;
5. Unclear version correspondence between platform and open-source foundation: the synchronization mechanism between Bailian's embedded AgentScope version and the open-source community version has no official explanation;
6. Cloud-locking tendency: deep reliance on platform capabilities such as Vault, checkpoint resumption and app observability raises migration costs.

7.3. Applicability Boundary

7.4. Selection Recommendations

• Trade-off with Microsoft Agent Framework (both strong across all six layers): Microsoft-ecosystem (.NET / Azure / Foundry) enterprises choose MAF; those in Alibaba Cloud / Xinchuang ecosystems, needing Chinese scenarios and a self-controllable open-source foundation, choose Bailian. The two are highly isomorphic in Middleware, permissions and durable execution, so the mental cost of a team migrating between either side is manageable.
• Trade-off with Dify / Coze: choose Bailian for a deep evaluation system and high-code control; choose Dify for extreme low-code and a global community; choose Coze for ByteDance-channel distribution.
• Open-source strategy: if a team wants to "validate with open source first, then scale on the cloud", the AgentScope → Bailian path fits the domestic compliance environment better than LangGraph → LangSmith.
• Must confirm before adoption: the real enterprise-edition quote (official figures missing); the synchronization cadence between Bailian's embedded AgentScope and the community version; the actual performance of non-Qwen models in your scenarios.

Information-Gap Statement

1. Named-enterprise landing cases: only the single YuYi Technology case was found (customer-service efficiency +40%, vendor self-reported) with no third-party independent verification; more cases were not found, so no gaps were filled in.
2. Official pricing figures: beyond the basic free quota + pay-as-you-go, the enterprise edition "50,000–500,000/year" is a third-party evaluation figure.
3. Functional parity across AgentScope language versions: Python is a first-class citizen, but no list of the feature gaps in Java / TypeScript / Go was found.
4. Exact version correspondence between the Bailian platform and AgentScope: not officially explained, marked [To be verified].
5. The "50+ industry penetration, 1 million+ enterprise customers" figures: vendor self-reported, and identical to Volcano Engine's (Coze) figures, so they cannot be cross-verified.
6. MLPS Level 3 / ISO27001 / watermark forensics: third-party evaluation figures, and no original official compliance statement was found, marked [To be verified].
7. The specific implementation of Bailian's sandbox: the console mentions sandboxed execution, but the isolation mechanism (container / VM / process-level) has no public details.
8. Version timeliness: both AgentScope and Bailian are in a period of rapid iteration, and all version and feature descriptions in this document are as of the point of retrieval in 2026-09.

8. References

1. Flow Agent 大模型服务平台百炼 — Alibaba Cloud console. https://bailian.console.aliyun.com/?tab=app#/app-center
2. 百炼平台零代码构建智能体全流程 — Alibaba Cloud developer community. https://developer.aliyun.com/article/1742574
3. 阿里云百炼大模型服务平台全解析 — Alibaba Cloud developer community. https://developer.aliyun.com/article/1757601
4. Agent 2.0 时代来了，首批「工业级智能体」正在核心位置上岗 — VergeX. https://www.vergex.cn/5019.html
5. AgentScope — Official site (sub-project ecosystem). https://agentscope.io
6. AgentScope 2.0 Frequently Asked Questions (FAQ). https://agentscope.io/blog/agentscope-faq
7. 更新日志 - AgentScope（2.0.3 文档）. https://docs.agentscope.io/versions/2.0.3/zh/release-notes
8. AgentScope 2.0: From Transparent Development to System Engineering（六大核心层重写、权限系统）. https://java.agentscope.io/v2/en/blogs/agentscope-v2-release.html
9. FAQ - AgentScope（1.0.21 文档，含与 Spring AI Alibaba 关系）. https://docs.agentscope.io/versions/1.0.21/en/others/faq
10. 项目参数卡 v1.0（Agent Platform 定义与六层能力模型）— 本项目内部基准文件.