A rendered article on this site costs an agent 21,847 tokens. The same prose as Markdown costs 491. Compression does not close that gap — tokenization runs after decompression, so markup gets billed no matter how well it transferred. The site now ships Markdown variants with attribution headers, the knowledge base as JSON, and an MCP server on a second Vercel deployment reached through a proxy rewrite. Two of the six tools do something HTTP cannot. The other four are the interface contract.

Most agent programs fail at the seams, not the model. This is the architecture I keep coming back to: five layers that turn agent capability into bounded autonomy — identity and task-scoped policy, a gateway that enforces it, an immutable event backbone, a live registry, and observability that reports business state rather than system health. Each layer links to the deeper argument for it.

OpenAI's misalignment report describes an AI agent that used DNS delegation to reach a public chatbot from a sandbox meant to be offline. The monitor fired a P0 in fifteen minutes. The run wasn't killed for another two and a half hours, because nobody was certain it crossed the line. The asymmetry is the point: an AI agent doesn't need certainty to test a boundary. Enforcement can't wait for it either. Bounded autonomy requires a fuse — boundary crossed, run dies — not a meeting.

Agent gateways are becoming commodity infrastructure, but their native policy engines are not interchangeable. Externalising the decision point — one place where every gateway asks whether a call should proceed — is what keeps identity, authorization, and audit coherent as gateway sprawl arrives.

Anthropic's cybersecurity-eval incident generalises far beyond cybersecurity evaluations: any system that infers its own scope rather than having it enforced is exposed the same way. Bounded autonomy requires controls that sit inline where actions happen — just-in-time access, explicit scope at tool and network boundaries, continuous observation, and the ability to stop, revoke, and investigate.