Most agent programs fail at the seams, not the model. This is the architecture I keep coming back to: five layers that turn agent capability into bounded autonomy — identity and task-scoped policy, a gateway that enforces it, an immutable event backbone, a live registry, and observability that reports business state rather than system health. Each layer links to the deeper argument for it.

OpenAI's misalignment report describes an AI agent that used DNS delegation to reach a public chatbot from a sandbox meant to be offline. The monitor fired a P0 in fifteen minutes. The run wasn't killed for another two and a half hours, because nobody was certain it crossed the line. The asymmetry is the point: an AI agent doesn't need certainty to test a boundary. Enforcement can't wait for it either. Bounded autonomy requires a fuse — boundary crossed, run dies — not a meeting.

Anthropic's cybersecurity-eval incident generalises far beyond cybersecurity evaluations: any system that infers its own scope rather than having it enforced is exposed the same way. Bounded autonomy requires controls that sit inline where actions happen — just-in-time access, explicit scope at tool and network boundaries, continuous observation, and the ability to stop, revoke, and investigate.

Frameworks give you routing, memory, and tool calls. They do not give you the arrangement — who has authority, what gets handed off, and when a decision becomes an escalation. Organizations solved these problems before agents existed, and the answers still apply.

Addy Osmani laid out the engineering primitives for loop engineering beautifully, but the article ends where the architecture decision begins. For agents running loops that touch regulated data and business-critical pipelines, the winners will not have the fastest loops — they will have the best control plane.

The Agent Autonomy Level (AAL) framework adapts SAE self-driving levels to enterprise AI. AAL-3 is the dangerous middle where humans wait at the margin for exceptions they are no longer primed to catch. The target is AAL-4: bounded autonomy, where the platform — not a human, not a wiki page — stops the agent the moment it steps outside its defined domain.

Observability is the first serious layer of AI in production, but once you can see what the system is doing, the harder question is whether it's still serving the business outcome it was put there to support. A system can stay within latency budgets, pass health checks, and still drift completely outside the intent it was supposed to operate within.

Gartner projects the average Fortune 500 will run over 150,000 AI agents by 2028, up from fewer than 15 in 2025, and only 13% of organizations believe they have adequate governance. Without a shared coordination layer, you are not running a multi-agent system — you are running a distributed system with no contract between its components.

AI evals are now a C‑suite priority. Learn how to link model performance to ROI, risk, and governance to win budget and drive adoption.

AgentOps is the critical framework for deploying and managing reliable AI agents across diverse applications. This post explores the core principles of AgentOps, the challenges of managing autonomous systems, and best practices for building secure, scalable, and compliant AI.