This deep dive expands on the Loop Asia conversation with Akhil Bhaskar, AWS.

In the S3E7 conversation, Akhil Bhaskar names three boundaries an agent needs before you can trust it with anything real — a knowledge boundary, a resource boundary, a tool boundary. He says it almost in passing, inside a longer answer about extending Backstage to agentic AI. For a CTO or Head of Architecture staring down a board mandate to "do something with AI," that sentence is the whole design brief.

Why the model isn't the control point

Generative AI's value is the creativity, and that same creativity — "the hallucinations," as Bhaskar puts it — is what businesses can't tolerate in a system built for predictability. His answer isn't to suppress it. It's to stop treating the model as the control point. Agentic AI, in his description, behaves like "microservices plus plus": modular, domain-oriented, assignable. That reframe matters: it's a governance problem you already know how to solve, not a new discipline invented from scratch.

What each boundary actually constrains

Knowledge boundary — what the agent can see. Not what the model was trained on, but what context and system state get pulled into its working memory at run time, and whether that's more than the task requires. An agent handling billing disputes that can also see HR records isn't a capability. It's a liability sitting quietly until an audit or a breach finds it.

Resource boundary — what it can consume or change: compute, API volume, spend, and, critically, write access to systems of record. Read access to a CRM and write access to the same CRM are two different risk profiles wearing the same name in a demo.

Tool boundary — what actions it can actually take. This is what Bhaskar's "is it allowed to go there" question is really asking. An agent that drafts an email and one that sends it are not the same system, even with identical reasoning underneath.

The part most roadmaps skip

Bhaskar goes further than most vendor pitches on explainability. For regulated environments — banks, telcos, governments — bounding the agent isn't enough. You need to reconstruct, after the fact, what it did, why, and what came out. That has to shape how reasoning steps and tool calls are captured from day one, because you can't retrofit an audit trail onto decisions nobody recorded.

The catalog is still the answer

Bhaskar's conclusion loops back to where the conversation started: "that comes back to hygiene." His prescription isn't a new AI governance platform — it's the same discipline that handled Log4j, extended to a new asset class. Every agent picked up from a marketplace, every skill it's given, every boundary it operates within, goes on the list.