Something fundamental has changed
For a long time, we knew how to control software because the system itself did not change between definition and execution. You could describe what it should do, define who was allowed to run it, and rely on the runtime to enforce that contract. Even when systems became distributed and complex, that core assumption held: the thing you defined was the thing that executed.
That assumption is now quietly breaking.
What we are calling agents today are not systems that execute predefined behavior. They are systems that construct behavior as they run. A request does not move directly into execution. It is interpreted, reshaped, and gradually made concrete. By the time the system acts, it is no longer executing what was originally described. It is executing what it has decided that description means.
That decision is not incidental. It is the system.
The stack is already there
Once you start looking for it, the structure is hard to miss. Every agent system, regardless of how it is presented, is composed of layers that interact to produce behavior.
At one end, there is a user’s intent, often incomplete and shaped by context that is never fully expressed. That intent is mediated through a harness that organizes how the system reasons about the task, how it decomposes it, and how it decides what to do next. Beneath that, there is an environment that determines what is actually possible, including memory, tools, interfaces, and execution boundaries. At the foundation sits the model, generating decisions under uncertainty.
What matters is not any one of these layers in isolation. It is the way they interact. The system is not the model. It is not the runtime. It is not the workflow. It is the relationship between them.
The system is defined in motion, not in code
In traditional systems, behavior is defined before execution. Even when systems are dynamic, they operate within boundaries that are known ahead of time. That is why control can be applied locally. If each step is valid, the system is assumed to be correct. In agent systems, that logic does not hold.
Behavior emerges through a sequence of transformations. A vague request becomes a more structured intent. That intent becomes a plan. The plan becomes execution. At each step, the system reduces ambiguity, but it does so by introducing interpretation. It fills in what was not specified, resolves what was unclear, and makes decisions that were never explicitly defined.
Those decisions accumulate. And once they accumulate, they shape what the system is capable of doing.
This is where things begin to drift
The failure mode is subtle because nothing appears broken at the level we are used to inspecting. The system uses valid credentials. It calls legitimate tools. It operates within the permissions it has been given. Each individual step can be explained and justified.
And yet the overall behavior can still be wrong. What went wrong was not the execution. It was the path that led to it.
Somewhere along the way, the system made a decision that slightly expanded its scope, or interpreted a constraint too loosely, or inferred something that was never intended. Each of these steps looked reasonable in isolation. Together, they formed a plan that no one explicitly approved.
By the time that becomes visible, the system is already acting on it. Execution does not create the mistake. It simply makes it real.
The split in the stack makes this visible
As the ecosystem evolves, this dynamic is becoming harder to ignore. Some systems are focusing on defining behavior more precisely, trying to bring structure to intent and workflows. Others are focusing on making execution more robust, ensuring that whatever is decided can be carried out reliably.
This separation is natural. We have seen it before in other systems, where control and execution become distinct layers as complexity grows.
But in agent systems, that split exposes something that was previously hidden. Between defining what should happen and making it happen, there is a transformation that neither layer fully governs. That transformation is now the most important part of the system.
Why neither side can solve this alone
Trying to solve this purely at the level of definition runs into a limit. Intent is not something that can be fully specified. There will always be context that is missing, constraints that are implied but not stated, and tradeoffs that cannot be captured upfront. No matter how detailed the specification becomes, it remains incomplete.
Trying to solve it purely at the level of execution runs into a different limit. Execution can enforce what exists, but it cannot correct how that thing came into existence. Once the system has committed to a plan, the role of execution is to carry it out, not to reinterpret it.
Both approaches improve the system. Neither addresses the transformation between them.
The missing layer is the one that governs construction
The only place left to intervene is the process by which the system becomes concrete. Not by eliminating it, but by shaping it.
This requires a different way of thinking about control. Instead of focusing on whether individual actions are allowed, the system must reason about whether the sequence of decisions that produced those actions remains within acceptable bounds. The goal is not to ensure that every possible plan is correct, but to ensure that incorrect plans cannot form in ways that matter.
That distinction is important. It shifts the problem from predicting behavior to constraining it.
From correctness to containment
In deterministic systems, control is about correctness. You verify that each step matches what was expected, and the system converges to the right outcome.
In agent systems, there is no single expected outcome. There is a range of possible behaviors, and the system selects one of them. Control, in this context, becomes less about guiding the system to a specific result and more about ensuring that it stays within a valid space.
The system is allowed to explore. But it is not allowed to expand its capabilities as it becomes more certain. That boundary is what prevents small, locally reasonable decisions from accumulating into globally incorrect behavior.
When that boundary exists, the system stabilizes
Once the process of construction is constrained, everything downstream becomes easier to reason about. Execution can be enforced because the system is no longer free to act outside what it has already committed to. Behavior becomes traceable not just in terms of what happened, but in terms of how it came to happen.
The system does not become deterministic. But it becomes bounded. And that is enough.
What this implies for the stack
The agent stack is not just expanding. It is becoming structured in a way that requires a new kind of control. Not a control that replaces existing layers, but one that connects them.
Without that layer, the system remains a collection of components that behave correctly in isolation but unpredictably as a whole. With it, the system becomes something you can reason about end to end.
We are no longer building systems that execute code. We are building systems that construct themselves as they run. And unless we learn how to control that construction, we are not really controlling the system at all.
