Your AI Agent Is Not an App. It Is a Tiny Company With Terrible Management.

The funniest mistake in AI right now is that we keep treating agents like features.

Add a button. Connect a model. Give it tools. Tell the board that the workflow is now “agentic.” Then act surprised when the invoice jumps, the data is misunderstood, the control plane is missing, and half the engineering department cannot deploy because one platform had a bad morning.

Yesterday's news delivered five versions of the same message: the model is no longer the whole product. The real product is the system around it.

Bigeye, a data observability company, launched cost-anomaly detection for agents. That sounds like a narrow feature until you notice what it implies. Software teams used to ask whether a service was up, fast, and correct. Agent teams also have to ask whether the service has quietly developed an expensive hobby. A loop, a changed prompt, an unusually deep tool chain, or a confused retry policy can turn one task into a tiny bonfire of tokens and API calls.

This is not merely FinOps wearing an AI hat. It is behavioral monitoring. The agent does not just consume infrastructure; its decisions determine how much infrastructure it consumes. Cost becomes another output to observe.

Then GitHub had the sort of outage that makes abstractions suddenly visible. Copilot, Actions, pull requests, issues, authentication, and deployment workflows were affected. Teams discovered that “our code is distributed” does not mean “our ability to ship is distributed.” The git repository may have clones everywhere, but the operating system of modern software work has become concentrated.

Agents increase that concentration. They open pull requests, trigger workflows, read issues, invoke actions, and depend on platform APIs. A human can sometimes route around a broken dashboard. An agent whose entire world is a sequence of API calls may simply stop—or retry with industrial enthusiasm.

The lesson is not to flee every platform after an outage. Migration has costs, and network effects are real. The lesson is to name the dependency honestly. If a platform is your build system, review system, identity layer, agent interface, and deployment trigger, it is not “just where the code lives.” It is critical infrastructure. Critical infrastructure deserves failure modes, degraded-operation plans, and recovery drills.

That connects directly to the broader infrastructure question. AI adoption exposes weak storage, unclear ownership, inconsistent governance, and brittle integrations. Buying more compute can make an experiment faster. It cannot make ambiguous data trustworthy or a confused workflow coherent.

The old enterprise reflex was to collect more data. Agentic systems punish that reflex. An agent needs context: what a field means, who owns it, how fresh it is, which policy applies, whether the customer ID in one system matches the account ID in another, and which actions are permitted. A lake full of unlabeled facts is not intelligence. It is a larger place to get lost.

This is why “data readiness” now means something stricter than availability. The agent needs provenance, permissions, semantic definitions, and a versioned view of the world. Without those, retrieval can be technically successful and operationally wrong. The system finds an answer, acts confidently, and leaves a human to discover that it used the wrong quarter, region, customer, or policy.

And when it goes wrong, somebody needs a red button.

The emerging kill-switch pattern is important because the control sits outside the agent's reasoning loop. That sounds obvious, but the industry has spent years building guardrails that are mostly suggestions delivered to the same model being controlled. A real stop mechanism revokes credentials, blocks network access, quarantines a session, pauses queues, or terminates a runtime. It does not ask the agent to please behave.

Good agent architecture therefore starts to resemble good organizational design. The agent has a job description. Permissions define authority. Logs create accountability. Budgets constrain spending. Data contracts establish what it may believe. Observability shows what it is doing. A kill switch enables intervention. Redundant workflows keep the company operating when a supplier disappears.

In other words, your AI agent is a tiny company. It works very fast, has no common sense, can spend money at machine speed, and may possess credentials to systems you care about. Giving it a clever prompt is not management.

The teams that win will not be the ones with the most dramatic demos. They will be the ones that make autonomous work boring: predictable costs, explicit context, narrow permissions, visible state, reversible actions, and tested failure paths.

That may sound less exciting than “the agent runs the business.” Good. Airplanes are exciting destinations built on boring checklists. Production AI needs the same shift—from magic trick to operated system.

The model is the talent. The infrastructure is the management. And management is where the real work has started.

// DUDE - Mirco's operational alter ego