The first generation of agent infrastructure was organized around access to intelligence. Teams debated models, context windows, orchestration libraries, and tool calling. Those choices still matter. They are no longer the whole architecture.
As models become more capable and more interchangeable, the hard production questions move outward. What did the agent actually understand from a page? Who authorized the action it is about to take? Why did the runtime decide that a cached result, reusable plan, deterministic program, or cheaper model was qualified for this request?
Those are not model questions. They are contract questions.
My view is that the durable agent stack will be organized around three of them: perception, authority, and adaptation. Together they create an evidence plane between intelligence and action.
The perception contract
An agent cannot reason reliably about information it cannot identify.
The ordinary web delivers pixels, layout, scripts, navigation, ads, interaction state, and content in one bundle. A human can usually separate the article from the furniture. An agent must spend tokens and tool calls reconstructing that distinction. Even then, it may not know whether a string is a heading, a button, a price, a warning, or hidden navigation.
A perception contract says what structure was preserved. It identifies regions, elements, relationships, actions, provenance, and freshness in a representation that both a machine and an operator can inspect.
This is the role we have been exploring with Plasmate and the Semantic Object Model. The important idea is larger than any one format: perception should be a declared interface, not an accidental by-product of scraping presentation.
Without that contract, the rest of the stack reasons over ambiguous input.
The authority contract
Understanding an action is not permission to perform it.
Agent systems often collapse identity, capability, and authority into one tool definition. If the tool is present, the model may call it. That is a convenient development abstraction and a poor production control model.
An authority contract binds the agent, human or service principal, tenant, subject, action, consequence level, policy, and approval state. It answers a narrower question than “Can this code call the API?” It asks, “May this actor perform this action for this subject under the current policy?”
MeshGuard is our expression of that contract. It is designed around identity, declared actions, policy evaluation, delegation, trust, and queryable decision records at configured enforcement points.
The boundary matters. Governance cannot cover traffic that bypasses the enforcement point, and an audit record does not retroactively create authority. The contract has to travel with execution.
The adaptation contract
The most overlooked contract begins after an agent succeeds.
Production systems accumulate repeated work. Some requests are identical. Some share a stable plan but require fresh reads. Some contain a deterministic transformation wrapped in a small amount of live judgment. The economic temptation is to replace expensive reasoning as soon as repetition appears.
That is exactly when evidence must become stricter.
An adaptation contract defines when a different execution method has earned the request. It records the reference method, candidate method, identity and policy scope, replay evidence, current shadow evidence, side-effect boundary, confidence, fallback, and route explanation.
Punk is built around this contract. A reusable artifact is interpreted data rather than generated code. Replay compares it with eligible history. Shadow compares it beside current live traffic. Promotion and canary stages remain separate from proof. Every served route explains itself.
The goal is not to automate everything. The goal is to stop paying for organizational amnesia without turning past success into blind authority.
The three contracts constrain one another
These layers are not independent boxes.
A reusable plan is unsafe if the perception contract no longer identifies the same information. A policy decision is incomplete if the authority layer cannot identify the subject represented in the cache key. A correct artifact is ineligible if current permission or side-effect conditions differ from the evidence window.
That coupling is the point.
The evidence plane should let an operator follow one request across the stack:
- What information did the agent receive, and from where?
- Which identity and policy governed the proposed action?
- Which execution method served, what alternatives were rejected, and what proof qualified the decision?
- What can be revoked, replayed, quarantined, or rolled back?
An answer without that chain may still be useful. It is not yet an accountable production system.
Observability is a substrate, not the category
Tracing is necessary. It is also passive.
An evidence plane uses traces to make prospective decisions. It does not merely show that a model call happened. It determines whether a route is eligible, whether authority is current, whether a write must wait, whether a candidate should remain in shadow, and whether the system should fall back.
This is why I do not think the enduring category is “agent observability.” The stronger category is agent execution infrastructure: a layer that observes in order to govern and adapts only when the evidence permits it.
Intelligence will commoditize faster than trust
Model quality will keep improving. Prices will change. New protocols and harnesses will appear. The winning infrastructure should benefit from that movement instead of being erased by it.
Perception, authority, and adaptation compound differently. They accumulate semantic structure, policy decisions, accepted outcomes, failure evidence, and operating boundaries. That history belongs to the system operating the work, not to a single model invocation.
The strategic asset is therefore not access to intelligence. It is the organization’s ability to turn intelligence into trusted execution.
That is the evidence plane. And I believe it will become the defining layer of the production agent stack.
Questions readers ask
Why are model intelligence and observability not enough?
Intelligence can propose an answer and observability can record activity, but neither alone defines what the agent understood, what it was authorized to do, or why a different execution path was qualified.
Does one product need to own all three contracts?
No. The contracts should be explicit and interoperable. Separate systems can own perception, authority, and adaptation as long as evidence and identity remain aligned across their boundaries.