Home Book Blog Contact

August 28, 2026 · Field notes

Don't leave the agent unbounded

August 2 applied Article 50: you have to disclose the interaction and mark synthetic output. High-risk logging, human oversight, and conformity assessment remain December 2, 2027 for stand-alone Annex III systems. In the same thirty days, IBM’s Technology Lifecycle Services described a production platform that will not let a tool call run as a service account, and Hunt.io documented an operator who switched Hermes’s approval prompts off. A service-account token and an approval prompt the operator can disable leave the agent unbounded.

This is the latest Field notes post for Architecting Agentic Systems, covering the thirty days ending August 28, 2026. It reports what practitioners are saying, including framework choices the book stays neutral on. Where that signal lines up with a position the book argues, or cuts against it, I say so.

The envelope is a setting

r/AI_Agents spent August 23 on a thread titled “So an AI agent just hacked Thailand’s Finance Ministry”. Two days later, Tony Erwin published “Building Production Agentic AI at IBM”, a write-up of a supervisor-and-specialists platform that has been in production since fall 2025. The thread is about an operator who switched the approval prompts off. Erwin describes a service organization that will not let a tool call run as a service account. IBM put the bound in the dispatch path. The Hermes operator treated the approval prompt as a default and cleared it.

Five things a technical architect needs to know right now:

  1. August 2, 2026 applied Article 50 transparency (disclose the interaction, mark synthetic output) and opened general-purpose AI (GPAI) enforcement under Articles 88–94. The high-risk stack (logging, human oversight, conformity assessment) remains deferred to December 2, 2027 for stand-alone Annex III systems.

  2. Identity has to survive every hop. Substitute a service account once and each system of record is no longer applying the access control it would apply if that person queried it directly.

  3. Model Context Protocol (MCP) is useful in production when the tool is a service. Direct API calls inside each agent duplicate credentials and skip the gate.

  4. IBM had traces of individual runs and still lacked evals that would have shown whether a change made the fleet better. They shipped the platform and ran into that gap in production.

  5. An approval prompt the operator can disable is not a bound. The approval gate is the stop condition that makes the envelope reversible; Hermes’s YOLO mode removes it.

What August 2 required

Regulation (EU) 2026/1744 was published on July 24, 2026 and entered into force on July 27. It defers high-risk obligations for stand-alone Annex III systems to December 2, 2027, and those for AI embedded in regulated products to August 2, 2028. The new dates are fixed on the calendar and do not wait for standards to be ready.

What applied on August 2 is narrower, and it still changes the product. Article 50 requires that systems intended to interact directly with natural persons are designed so those persons are informed they are interacting with an AI system, unless that is obvious from the circumstances. Providers of systems that generate synthetic audio, image, video, or text must mark those outputs in a machine-readable, detectable form. Deployers must disclose deepfakes and certain public-interest texts. Generative systems already on the market before August 2 have until December 2, 2026 for the machine-readable marking. GPAI model duties have applied since August 2, 2025; the Commission’s dedicated enforcement powers over those models (Articles 88–94) apply from August 2, 2026.

The high-risk requirements the book maps onto architecture (Article 12 logging, Article 14 human oversight, Article 26 deployer duties, the stop control) have more time. The specification itself is unchanged. Classification under Article 6 still has to be done now; only the obligations that follow a high-risk label moved. An agent is high-risk when it performs an Annex III task (hiring, credit, essential services). How autonomously it performs that task does not change whether it is high-risk. Agents are AI systems under Article 3(1); there is no separate agent regime. The design that Praxikon lists for the years until those dates (scoped permissions, a documented in-the-loop or on-the-loop choice, logging, a kill switch, periodic review, a place in the register) is bounded autonomy and governance under other names, and it remains the right design where it is not yet the legal deadline.

A VentureBeat piece dated August 22 put the operational version of the same claim: the enterprises getting value from agents are limiting how much those agents can do alone. Narrow-scope agents, checkpoints before high-stakes actions rather than after them, and a decision log you can reconstruct without waiting for an incident.

Identity through every hop

Erwin’s TLS Agentic Platform is a supervisor routing to six specialist agents: case, asset, documentation, client management, contract, and High Availability Center of Competence (HACoC). The specialists cover support roles that used to assemble context across a dozen systems of record. Five of the six specialists were built by other teams; the asset agent runs in a separate environment. The front end is the TLS Concierge, a single place to ask questions that used to span those systems. The book takes no position on LangGraph, Agent2Agent (A2A), or MCP as products.

Agent boundaries are A2A so each specialist is independently deployable and can be versioned and tested on its own. In-process subagents would have been simpler and would have collapsed the ownership split the organization actually has. That is Chapter 9’s justified case for more than one agent: domain ownership and independent deployability, with a supervisor that routes.

Tools sit behind MCP servers so two agents that need case data do not keep two copies of the client and two sets of credentials. r/AI_Agents asked the same question this month as “Why use MCP when Agents can use APIs directly?”. Erwin’s answer from production is the service boundary: the team that owns the tool can evolve it without coordinating a release with every agent that consumes it. Direct API calls are fine for a single agent with one or two tools. They stop scaling the moment a second agent needs the same system of record. The harness is then dispatching through a governed tool surface.

On August 24, Marc Pope wrote up the July 28 Model Context Protocol spec, which landed a day before this window opened. The spec drops the session handshake so any instance can handle any request, and the tool server can sit behind a load balancer like any other HTTP service. Pope reports that the August 22 roadmap names proof-of-possession tokens (DPoP) and workload identity as the next layer. That is the same identity constraint Erwin already enforces on every hop.

Identity maps most directly onto Chapter 6 and Chapter 14. Propagate or exchange the caller’s token at every hop. Never substitute a service account. The moment one delegation drops the user, each system of record is no longer applying the access control it would apply if that person queried it directly. Salesforce then sees the platform, not the person.

Tracing stalled on internal roadmaps that moved; they eventually cut over to Langfuse and wish they had done so earlier. Evaluation coverage arrived after the changes it should have guarded. When agents started producing subtly wrong answers in certain cases, the team did not always have the scaffolding to know it had happened, let alone catch it before users did. Erwin treats an evaluation framework as load-bearing infrastructure that needs to exist before consequential changes start. A third gap sat above tracing and evaluation: the first use case was the Technical Escalation Manager getting up to speed on a case. They never measured how long that prep took before the Concierge existed, so value was argued from anecdotes.

That eval gap had a second cost. The platform team built a skills-based harness into the shared library every agent already imports (persistent AGENTS.md, runtime-loaded skills, subagents with their own context, summarization). Stakeholders liked it, and most agents still are not on it, because they belong to other teams with their own backlogs, and reworking a functioning agent reads as schedule risk. Without a representative eval set across the fleet, Erwin could show that a deep agent handled a hard query well, but not that it handled a representative set measurably better than what was already running. He could not get the other teams to migrate without that eval, and he could not build the eval without a representative set. The skills layer is the right runtime boundary. Putting the harness on the import path did not migrate the fleet.

The bottleneck now is a data factory: finding the system of record, negotiating access, arranging authorization, and wrapping the result as a tool the agent can actually call. The instinct in fast-moving teams, he writes, is to stamp out more agents. Prototypes mocked the MCP endpoints and were useful for validating behavior. The prototypes were not production until the data flowed, and no amount of graph design short-circuits that work. Chapter 8 and Chapter 14 locate the same bottleneck: grounding is an input concern, and the write path into the tools the agent can see is where most production programs actually stall.

Peers without a hierarchy

The forums spent the last week of August asking whether agents beat deterministic workflows and whether multi-agent systems are overused. r/LangChain asked a stop-condition version of the same problem: whether production agents need a separate conclusion-state layer, or whether good workflow design makes the extra layer unnecessary.

On August 13, Anthropic’s Frontier Red Team published “Patterns and problems in emerging multiagent systems” (Hacker News, three days later). Agents work together, the team found, when they treat one another as tool invocations with well-defined inputs and outputs. They stumble as long-lived peers with their own goals and no hierarchy between them. Coordination does not emerge from a stronger model, or from aligning each agent in isolation.

That is the distinction Chapter 9 already makes. Erwin’s supervisor-and-specialists platform is the justified case: domain ownership, independent deployability, a supervisor that routes. The overuse thread is still asking whether more agents help. The paper measured the other case: long-lived peers sharing a forum, with no hierarchy the envelope can enforce.

The approval that was switched off

The August 23 thread is titled as a completed hack of Thailand’s Finance Ministry. The primary source is Hunt.io’s report, written with Bob Diachenko and published July 23, a few days before this window opened; the thread is how that report entered the practitioner conversation. Hunt.io captured three open directories on a Hong Kong staging host (July 9–13). The directories held exploit code, webshells, session material, and logs from Hermes, an open-source persistent agent.

Those logs show the operator enabled YOLO mode, which bypasses approval prompts for commands the system would otherwise treat as dangerous, and then tasked the agent with privilege-escalation reconnaissance (LinPEAS), kernel-vulnerability scans, service enumeration, and filesystem traversal of ministry hosts. Hunt.io notified ThaiCERT and Thailand’s National Cyber Security Agency on July 15; both acknowledged receipt. The ministry has not confirmed a breach. BleepingComputer, writing the next day, contacted the ministry and ThaiCERT and had no confirmation either; some recovered artifacts, it notes, show targeting rather than a completed compromise. Initial access is not in the recovered files. Some of the staged implant (“Hades”) has no recovered artifact showing it reached a ministry machine.

The operator had an approval gate and turned it off so the agent could run unattended. That gate is the stop condition that makes the envelope reversible, and it is how in-flight oversight actually interrupts a run. YOLO removes the gate. Chapter 11 treats unbounded tool access as a failure of the envelope; the model’s judgment never entered into the decision to disable the prompt. The human still supplied the objectives. Hunt.io recovered a password wordlist of abbreviations for interior departments and programs, not generic dictionary terms, and shellcode with hardcoded paths into the ministry intranet: knowledge the agent did not have on its own. The operator still aimed the agent. YOLO only removed the wait between steps.

What to take from the month

SignalWhat the field is sayingWhere the book puts it
August 2 applied disclosureArticle 50 and GPAI enforcement applied; high-risk logging and oversight remain December 2, 2027Governance and the stop control remain the design through December 2027
Identity through every hopNever substitute a service account; one dropped token relocates authorization into the platformGovernance over the call path; enterprise identity at the tool
MCP as a tool serviceDirect APIs duplicate credentials; a server lets the tool team evolve on its own schedule; the July 28 spec makes that server statelessHarness action dispatch; the tool surface is a boundary
Peers without a hierarchyAgents coordinate as tool invocations; peer swarms do not grow a dispatch path on their ownControl: ownership and a supervisor that routes
Evals before the changeA shared library does not migrate a fleet; without a representative eval set, a better pattern stays unadoptedTrace and evaluation as load-bearing from the start
Data access is the long poleAgent factories stall on systems of recordIngestion and grounding on the write path into tools
YOLO removed the waitUnattended mode skipped the approval prompt; the operator still aimed the agentBounded autonomy; disabling the gate is a failure mode

Sources

Community threads (live, July 29–August 28, 2026):

Production and research:

Regulatory:

← Field notes