A rendered article on this site costs an agent 21,847 tokens. The same prose as Markdown costs 491. Compression does not close that gap — tokenization runs after decompression, so markup gets billed no matter how well it transferred. The site now ships Markdown variants with attribution headers, the knowledge base as JSON, and an MCP server on a second Vercel deployment reached through a proxy rewrite. Two of the six tools do something HTTP cannot. The other four are the interface contract.

Most agent programs fail at the seams, not the model. This is the architecture I keep coming back to: five layers that turn agent capability into bounded autonomy — identity and task-scoped policy, a gateway that enforces it, an immutable event backbone, a live registry, and observability that reports business state rather than system health. Each layer links to the deeper argument for it.

OpenAI's misalignment report describes an AI agent that used DNS delegation to reach a public chatbot from a sandbox meant to be offline. The monitor fired a P0 in fifteen minutes. The run wasn't killed for another two and a half hours, because nobody was certain it crossed the line. The asymmetry is the point: an AI agent doesn't need certainty to test a boundary. Enforcement can't wait for it either. Bounded autonomy requires a fuse — boundary crossed, run dies — not a meeting.

Agent gateways are becoming commodity infrastructure, but their native policy engines are not interchangeable. Externalising the decision point — one place where every gateway asks whether a call should proceed — is what keeps identity, authorization, and audit coherent as gateway sprawl arrives.

Anthropic's cybersecurity-eval incident generalises far beyond cybersecurity evaluations: any system that infers its own scope rather than having it enforced is exposed the same way. Bounded autonomy requires controls that sit inline where actions happen — just-in-time access, explicit scope at tool and network boundaries, continuous observation, and the ability to stop, revoke, and investigate.

Frameworks give you routing, memory, and tool calls. They do not give you the arrangement — who has authority, what gets handed off, and when a decision becomes an escalation. Organizations solved these problems before agents existed, and the answers still apply.

The strategic question is not which agent framework an organisation mandates. It is whether changing frameworks means rebuilding the controls that make agentic systems trustworthy. That is why delegated authority — enforced at a shared Agent Gateway layer — matters more than the framework choice.

Frank White's Overview Effect describes the shift astronauts experience when a collection of separate places becomes one connected system. The same shift matters for AI: the question is not just whether AI can make a task faster, but whether that speed improves the system — or moves cost, risk, and complexity somewhere else.

A Databricks benchmark showed a leaner Pi harness using roughly 3x less context per turn and delivering more than 2x lower task cost at comparable quality. The deeper enterprise implication is control: if every team builds its own agent wrapper with a different tool set, permission model, and safety prompt, you don't have a platform — you have a fleet of fragmented runtimes.

MCP's newest spec removes the requirement that every request return to the same server — the same architectural move that let HTTP scale. It is a real step forward, but state, identity, and execution continuity now have to be bound explicitly in the application and platform layer instead of relying on protocol-managed sessions.