The Moment an Agent Acts, You Operate an Autonomous System

The moment an agent acts, you stop running software. You're operating an autonomous system.

A year ago we asked ourselves three questions that nobody in the industry could answer cleanly: How many AI agents do we have? What are they allowed to do? What are they doing right now? So we started building.

Agents are arriving faster than governance can form. Gartner puts 150,000 agents per Fortune 500 enterprise by 2028 — up from 15 today. That's not 10×. Ten thousand times. Most organisations won't see the gap until they're already inside it. The question is how you structure control before that happens.

We didn't invent a framework. We adapted the SAE self-driving car levels to enterprise AI — the Agent Autonomy Level (AAL). The dangerous middle is AAL-3: the agent handles the full workflow end-to-end. The human doesn't drive — they wait at the margin, responsible for exceptions they're no longer primed to catch. Bainbridge called this the Irony of Automation in 1983: the more reliable the system, the faster vigilance degrades. With agents, that drift compounds at machine speed.

The target is AAL-4. Bounded autonomy. The agent acts — but the moment it steps outside its defined domain, the platform stops it. Not a human. Not a wiki page. The platform.

Building that platform is an engineering task, not a governance workstream and not a slide deck. A real-time policy engine that evaluates every agent action at runtime, against a live registry of boundaries, before anything reaches production. Four layers enforce that boundary: identity and access policy, an immutable event backbone, a live discovery registry, and a gateway every agent action passes through. If the payload doesn't conform, it doesn't pass.

These layers compose. An agent may have permission to write, but if the gateway rejects a malformed payload, the event never enters the system. Defence in depth, not a single chokepoint — enforced as code, versioned, peer-reviewed, deployed through the same pipeline as any other infrastructure change, with a commit history, a rollback, and an owner.

We presented this framework at Current 2026 in London. Martijn van der Pauw is building the platform side at Essent — the foundational layers that make bounded autonomy enforceable, not theoretical. Production components are running today.

My lens here is enterprise, so take it with that filter — but if your organisation can answer all three questions today, you're already ahead of 87% of the field.