Agentic AI

There is a genre of architecture writing I have learned a lot from: the reference architecture for an AI platform. Retrieval, then guardrails, then a model gateway, then caching, then write actions. Each layer lets the system do more than the last. I want to describe the other half, because in the enterprise systems I work on, it is the half that decides whether anything ships. Every one of those architectures builds along a capability axis. Almost none of them build along an authority axis. They answer how does the system produce a better output. They do not answer what is this specific output permitted to do, on whose behalf, and who carries it if it is wrong. ...

Every enterprise agent conversation I sit in eventually reaches the same question, and it is almost always asked wrong. Someone says: should the agent be allowed to act, or just recommend? That framing has two options in it. The real design has five, and the gap between two and five is most of what separates an agent system that reaches production from one that stalls in a steering committee. The interesting boundary is not where you think We have collectively agreed that agent reasoning is unreliable in ways that require handling. Hallucination, brittleness, prompt injection — the discourse is mature and the mitigations are well known. Ground it, scope its context, validate its output, allowlist its tools. ...

When I was asked to design the security architecture for a national-scale insurance data ecosystem — one that aggregates sensitive data from every insurance company across an entire country — I quickly realised that Zero Trust, as most organisations implement it, would not be sufficient. Zero Trust was designed for a world where humans authenticate and access systems. It was not designed for a world where AI agents authenticate, reason over sensitive data, make decisions, and call other agents — all within milliseconds, at scale, without a human in the loop. ...