brgr.one

Tokens measure activity. They don't measure work. An agent doesn't answer. It works. Physics holds. Our metrics should too. A joule is a joule: on a steam engine, on a server rack, in a data center. Energy consumed is not the same as useful work delivered.

The model produces the score. The organisation owns the threshold. No score is not a pass. Mario respawns. Your payment run doesn't. Linux laptop. Qwen 3.5, two billion parameters, a small decision head on top. The model scores the available moves. No generated text.

TypeSafe introduced Jev: structured, probabilistic outputs rather than generated text. A decision model gives a proposed tool call a typed interface — is it grounded, should the workflow retry or escalate — often with a score. Authorization stays a policy decision. The enterprise standard is the control contract, not a decision model everywhere: record the proposed action, the model result, the policy version, and the disposition, and name the owner. The control can live inside the runtime. It must stay outside the model's discretion.

A rendered article on this site costs an agent 21,847 tokens. The same prose as Markdown costs 491. Compression does not close that gap — tokenization runs after decompression, so markup gets billed no matter how well it transferred. The site now ships Markdown variants with attribution headers, the knowledge base as JSON, and an MCP server on a second Vercel deployment reached through a proxy rewrite. Two of the six tools do something HTTP cannot. The other four are the interface contract.

Most agent programs fail at the seams, not the model. This is the architecture I keep coming back to: five layers that turn agent capability into bounded autonomy — identity and task-scoped policy, a gateway that enforces it, an immutable event backbone, a live registry, and observability that reports business state rather than system health. Each layer links to the deeper argument for it.

OpenAI's misalignment report describes an AI agent that used DNS delegation to reach a public chatbot from a sandbox meant to be offline. The monitor fired a P0 in fifteen minutes. The run wasn't killed for another two and a half hours, because nobody was certain it crossed the line. The asymmetry is the point: an AI agent doesn't need certainty to test a boundary. Enforcement can't wait for it either. Bounded autonomy requires a fuse — boundary crossed, run dies — not a meeting.

Agent gateways are becoming commodity infrastructure, but their native policy engines are not interchangeable. Externalising the decision point — one place where every gateway asks whether a call should proceed — is what keeps identity, authorization, and audit coherent as gateway sprawl arrives.

Anthropic's cybersecurity-eval incident generalises far beyond cybersecurity evaluations: any system that infers its own scope rather than having it enforced is exposed the same way. Bounded autonomy requires controls that sit inline where actions happen — just-in-time access, explicit scope at tool and network boundaries, continuous observation, and the ability to stop, revoke, and investigate.

Frameworks give you routing, memory, and tool calls. They do not give you the arrangement — who has authority, what gets handed off, and when a decision becomes an escalation. Organizations solved these problems before agents existed, and the answers still apply.

The strategic question is not which agent framework an organisation mandates. It is whether changing frameworks means rebuilding the controls that make agentic systems trustworthy. That is why delegated authority — enforced at a shared Agent Gateway layer — matters more than the framework choice.