Architecture to Autonomy Back to posts
Frameworks · Platform Architecture

The Agentic Enterprise Needs a New Platform Stack, Not Just a Bigger Model

Software is starting to take actions, not just generate answers. Here is what that means for how you build.

By Samir Roshan Enterprise AI Infrastructure 7 min read
40%+
Agentic AI projects canceled by end-2027 (Gartner)
15%
Daily business decisions made autonomously by 2028
59%
Organizations with dedicated FinOps teams (Flexera 2025)
~20%
Workloads repatriated from public cloud to on-prem

For most of my career, platform architecture was about three things: reliability, cost discipline, and risk containment.

In the AI era, those fundamentals do not change. What changes is the actor.

Software is starting to take actions, not just generate answers. That is why "agentic AI" matters - not as a buzzword, but as a new execution layer inside the enterprise.

Gartner has already put a hard warning on the table: over 40% of agentic AI projects may be canceled by end-2027 because cost, unclear value, and risk controls do not keep up.

// Gartner Agentic AI Outlook
2025
Early adoption
Pilot-heavy
2026
Trough of risk
40%+ cancelled
2027
Consolidation
Standards emerge
2028
15% autonomous ops
Embedded in SW
// Framing

The Strategic Question Has Changed

OpenClaw iconOpenClaw is a market signal, not just a viral story. Every platform era has a moment when the future stops being abstract. OpenClaw's rapid rise - and its founder joining OpenAI - shows that autonomy is moving into the mainstream quickly.

Then came the security reality check. A "ClawJacked" vulnerability showed how quickly an agent runtime can become a control-plane security problem when local gateways and weak authentication patterns are involved.

I have been using OpenClaw to build multi-agent personal productivity applications, and while the outcomes can be fantastic, the behavior isn't always fully predictable.

Agents are privileged automation wearing a conversational interface. Treat them like that.

So the strategic question is no longer "Which model are we using?"

It is: What platform architecture allows humans and agents to work together safely, predictably, and at scale?

// Platform Evolution
2005-2015
Virtualization Era
Reliability, cost, provisioning speed. VMs abstract hardware.
2015-2023
Modern Application Era
Containers and Kubernetes extended the virtualization playbook from infrastructure abstraction to application abstraction, improving portability, policy control, and delivery speed.
2023-2025
AI Integration Era
Models embedded in applications. Inference pipelines, RAG, prompt engineering.
2025 -> NOW
Agentic Execution Era
Software acts autonomously. Identity, delegation, containment become mandatory.
// Architecture Requirements

What Actually Changes in Platform Architecture

Traditional cloud platforms optimized for elasticity, developer velocity, governance through policy, and resilience through engineering discipline. Agentic systems introduce four requirements that tend to be missing in today's enterprise stacks:

01
Delegation
What can an agent do on behalf of a human, and under what conditions? Scoped entitlements, intent-based authorization, and time-bounded access.
02
Verification
Can you prove what happened, why it happened, and who was accountable? Replayable session recording tied to identity, intent, and outcome.
03
Containment
How do you prevent tool access from becoming the shortest path to a breach? Blast-radius analysis, east-west movement controls, and tool classification.
04
Economics
How do you prevent runaway tool calls, token spend, and retries from turning autonomy into uncontrolled cost? Budgets, circuit breakers, and spend caps.
// Missing Layer

The Agent Control Plane

// Architecture Reference The Enterprise Agent Platform Stack: A Hierarchical Blueprint
The Enterprise Agent Platform Stack - Hierarchical Blueprint showing the Agent Control Plane, Integration layer, Experience layer, and Hybrid Infrastructure
This layered model shows how Identity, Policy, Budgeting, and Gate controls sit in the agent control plane between infrastructure and upper integration/experience layers.

Most enterprises have an infrastructure plane (hybrid), a runtime plane (Kubernetes, VMs), and a security plane (IAM, logging, SOC). What they often do not have is an explicit control plane for agents.

MCP (Model Context Protocol) is one example of how tool connectivity is becoming more consistent - which increases integration speed and the need for governance equally.

  • Agent Identity as First-Class Principal
    Dedicated identities, scoped entitlements, short-lived credentials, separation of duties
  • Policy That Evaluates Intent, Not Just Access
    Not just "can this identity call the API" - but "should this action be allowed right now?"
  • Tool Registry with Classification
    Gate tools (read vs write, low vs high impact), make approvals explicit
  • Session Recording and Replay
    Replayable evidence: what the agent saw, decided, and executed
  • Budgets and Circuit Breakers
    Rate limits, spend caps, and stop conditions for abnormal behavior
// Enterprise Platform Layers
Application
Application Layer . LLM Orchestration . Interfaces Agents live here
NEW ↓
Agent Control Plane . Identity . Policy . Tools . Audit MISSING
Security
Security Plane . IAM . SIEM . SOC . Policy
Runtime
Runtime Plane . Kubernetes . Containers . Serverless
Infrastructure
Infrastructure Plane . Hybrid . Private DC . Public Cloud
Key insight
The Agent Control Plane is the missing layer between LLM orchestration and security/runtime infrastructure. Without it, governance is ad-hoc.
// Infrastructure Strategy

Why Private Cloud Keeps Showing Up in AI Conversations

Private cloud is not coming back because anyone misses 2015. It shows up because agentic systems amplify the value of data sovereignty, predictable economics, and tight security controls close to systems of record.

// Hybrid-by-Design Pattern
PRIVATE CLOUD / ON-PREM Governed Data Sovereignty PDPA Regulated Work FSI Healthcare Agent Execution Controlled tools Inference Core Steady workloads AGENT CONTROL PLANE POLICY BOUNDARY PUBLIC CLOUD (ELASTIC) Burst Compute Spiky workloads Global Reach CDN Edge Experimentation Training R&D Transient Tasks Non-sensitive ELASTIC CAPACITY LAYER
Stable core, governed data
Elastic burst, lower sensitivity
Policy-governed boundary

Flexera's 2025 cloud research reflects the broader shift toward cost discipline: 59% of organizations report dedicated FinOps teams, and about one-fifth of workloads were repatriated from public cloud back to on-prem in the prior year. Placement becomes a policy decision, not a developer convenience.

// Security

Start with the Reality: Tools Are Code Execution

If an agent can open tickets, change firewall rules, trigger deployments, approve refunds, or query sensitive data - it has operational power. That power needs guardrails. OWASP's Top 10 for LLM applications is a practical baseline, especially prompt injection, insecure output handling, and supply chain risk.

Singapore published a dedicated Model AI Governance Framework for Agentic AI in January 2026, pushing the conversation toward bounded autonomy, accountability, and lifecycle controls.

// OWASP LLM Top Risk Areas for Agents
Critical Risk
Prompt Injection
Attacker manipulates agent reasoning through crafted inputs, redirecting tool calls to malicious ends.
Critical Risk
Excessive Agency
Agent granted permissions or capabilities beyond what the task requires, expanding the blast radius.
Critical Risk
Insecure Tool Use
Unvalidated tool outputs fed back into the model, enabling chained exploits across systems.
High Risk
Supply Chain Risk
Third-party MCP servers, plugins, or tool libraries introduce untrusted code paths.
High Risk
Sensitive Data Leakage
Agent retrieval pipelines surface data the requesting context should not have access to.
Medium Risk
Unbounded Cost
Runaway retry loops, token burn, and chained tool calls with no spend cap or circuit breaker.
// Modern App Architecture

Modern Applications Must Become Agent-Proof

APIs were built assuming human intent. Agents introduce volume, retries, chaining, and ambiguity at a scale no human generates. If you want your app architecture to survive agents, these areas need hardening - not as a slowdown, but as the foundation of safe speed.

Idempotency
Compensating actions for safe retries
Input Validation
Strict contracts, no implicit trust
Policy Gateways
Aware of identity, intent, impact
Deep Observability
Actions tied to identity, intent, outcomes

The Six Questions Your Platform Must Answer

Agentic AI will not fail because models are not smart enough. It will fail when enterprises cannot answer these basic questions after something goes wrong.

01Who authorized this action?
02What data did it touch?
03Which tools did it call?
04What controls approved or denied it?
05Can we replay it end to end?
06What did it cost to reach the outcome?
VERDICT If your platform cannot answer those questions cleanly, you do not have an AI platform yet. You have an experiment.
The Bottom Line

Treat Agent Autonomy as a Platform Capability. The winners in this era will be the enterprises that make accountability the default - not a remediation task after an incident. Architecture is the answer.

Related posts

Continue with adjacent thinking threads.

Back to all posts Connect on LinkedIn Subscribe via RSS

Views expressed here are my own and do not represent the views of any current or former employer, client, or affiliated organization.