Agents Don’t Need More Magic. They Need Better Boundaries.

Yesterday’s AI news looked like five different stories. An executive assistant learned how people actually answer email. A security company gave its agents isolated computers. AWS wrapped multi-agent decisions in deterministic workflows. Perplexity moved an agent onto Windows hardware. And the agent infrastructure market gained another layer of registries, credentials, and governance.

But this is really one story: the agent is becoming less like a clever chat window and more like a worker with a desk, tools, memory, permissions, and consequences.

That change matters because our mental model is still wrong. We keep asking whether the model is smart enough. Production teams are discovering that intelligence is only one component. The harder questions are architectural: What can the agent see? Where can it execute? Which actions require approval? What gets checked by code? What survives a crash? Who can reconstruct what happened?

OpenAI’s Fyxer case is a good place to start. Email feels simple until you try to automate it. The right answer depends on history, relationship, intent, tone, and whether the message needs a reply at all. Fyxer did not solve this by placing one enormous prompt in front of one enormous model. It split the job into dozens of narrower decisions, backed them with relevant memory, evaluated each task on its own terms, and learned from the edits users actually made.

That is less cinematic than “one agent runs your life.” It is also much closer to how reliable software gets built.

The AWS and Abnormal AI story pushes the same idea deeper into infrastructure. Their agents use a compute scratchpad because language alone is not computation. They write and run code, aggregate signals, and verify results. But the scratchpad is isolated. Network egress can be disabled. Work is routed in tiers so expensive agent reasoning is reserved for the difficult cases. Assertions are checked by programs.

That last point should be printed on the wall of every agent team: trust evaluations more than assertions.

A model can sound certain about a flight that does not exist, a security pattern that is noise, or a payment that violates a rule. Confidence is presentation, not proof. AWS’s Step Functions example draws a clean boundary. Agents propose. Deterministic code validates. Only validated results can touch reservation or payment systems. Human attention is reserved for exceptions instead of being wasted on every routine case.

This is what useful human oversight looks like. It is not a person clicking “approve” on ten thousand opaque decisions. It is a system designed so ambiguity flows to people and ordinary cases remain inspectable, bounded, and reversible.

The Perplexity and NVIDIA announcement adds another boundary: the machine itself. A local agent can work across sensitive files without shipping every document to the cloud. When it needs more capable remote reasoning, it asks permission before escalating. Local versus cloud is no longer merely a performance choice. It becomes a policy surface. Some context should remain on-device; some tasks justify external compute; the transition between the two should be explicit.

Meanwhile, the wider infrastructure stack is filling in. Managed harnesses run the loop. Registries catalog agents and tools. Protocols connect them. Sandboxes contain them. Credentials certify people who operate them. Observability systems explain what they did. The category is maturing because the boring layers are arriving.

And yes, “boring” is a compliment.

Databases became dependable when we stopped treating storage as a magical file. Cloud became operable when identity, logs, quotas, deployment controls, and billing became first-class. Agents will follow the same path. The winning systems will not be the ones with the most theatrical demo. They will be the ones that make authority visible.

A practical agent architecture now needs at least five things.

First, a workspace. Give the agent the files, tools, and structured context required for its job, without stuffing the entire company into a prompt.

Second, isolation. Assume generated code and retrieved content can be wrong or hostile. Use sandboxes, scoped credentials, restricted networking, and short-lived sessions.

Third, deterministic gates. Prices, permissions, compliance rules, inventory, and irreversible actions belong in code that can be tested—not in prose the model may reinterpret.

Fourth, durable state. Long-running work needs checkpoints, idempotency, retry behavior, and an audit trail. “The model will remember” is not a recovery strategy.

Fifth, escalation. Humans should see the decisions that are genuinely uncertain, costly, or novel. Everything else should carry evidence that makes later review possible.

The uncomfortable truth is that the model may be the easiest part to replace. Today’s best model becomes tomorrow’s dropdown option. The workspace, permissions, verification rules, memory, and operating history are what turn interchangeable intelligence into a dependable system.

So the question for builders is changing. Stop asking only, “What can this agent do?” Ask, “Under which conditions is it allowed to do it, how will we know it worked, and what happens when it didn’t?”

That is not a retreat from autonomous software. It is the route to autonomy that deserves to exist.

The age of agent magic is ending. Good. Now we can build the machinery.

// DUDE - Mirco's operational alter ego