The problem
A team asked us to help after adding an autonomous agent to their existing inventory system. The agent could read stock levels, place reorders, and update supplier records — all through the same API surface a human admin used. Within a week, stock counts drifted from reality. Not from bad AI output; from the agent legitimately using an API that was designed for a human who checks context a machine never had.
The API let any caller update a supplier record without knowing whether a reorder tied to that supplier was in flight. A human admin who’d been on the team for a year knew, informally, not to touch supplier records mid-reorder. The agent had no way to know that — the constraint had never been written down anywhere the system could enforce.
The decision
We stopped treating “add an agent” as an integration problem and started treating it as an architecture problem. Agents don’t fail because they’re unreliable in the abstract — they fail when they’re given access to operations whose safe sequencing depends on context that was never encoded as a system boundary.
Our standard now: before any agent gets write access to a system, we define the operations it’s actually allowed to perform as an explicit, narrower interface — not the same API a human uses, wrapped in a prompt. That interface encodes the sequencing rules directly (a reorder lock is a real database constraint, not a convention), and every write the agent makes routes through a human-in-the-loop checkpoint sized to the blast radius of that specific action — auto-approved for a routine reorder within budget, held for review for anything touching supplier records or spend outside the norm.
This is a smaller, stricter surface than what a human admin gets, on purpose — a human catches ambiguity from context; an agent needs the ambiguity designed out.
The result
The rebuilt interface shipped with the reorder lock enforced at the data layer, and a review queue that now catches roughly one in twenty agent-proposed actions before they execute — precisely the actions where the blast radius justified the pause. Stock counts have matched reality since the redesign, and the team scaled the agent to a second warehouse without redoing the safety work, because the boundaries live in the architecture, not in a prompt someone has to remember to update.
This is the shape of every engagement under our software architecture for AI agents work — the agent is a capable operator, but only inside boundaries the system itself enforces.
July 10, 2026