Picture the life of a single agent task, start to finish. It gets identified as acting for a real person. It's cleared to run inside your runtime and orchestration controls. It's routed to a model, at a budget, under a routing policy. It connects to the tools and data it needs. It reaches the data. And the whole thing gets recorded for audit.
Six checkpoints. Every enterprise serious about agents is buying, building, or evaluating infrastructure for most of them. An identity provider for the first. An orchestration platform for the second. An LLM gateway for the third. An observability stack for the last. Real vendors, real contracts, real line items.
Here's what gets skipped: none of that infrastructure decides whether the agent should be allowed to touch a specific piece of data, for a specific task, at a specific moment — and none of it produces a record the agent itself can't tamper with afterward. That decision usually lives in a system prompt, or a policy document nobody's agent has actually read. Which is another way of saying it doesn't exist as infrastructure at all.
Identity, task, and source access enforced in real time, on infrastructure the agent can't read, write, or bypass — independent of the model's own reasoning about whether a rule applies to it.
AutoPIL sits at four of these six checkpoints, plus the band underneath all of them. Checkpoints two and three — runtime and model routing — are deliberately not ours to own. That's where your orchestration platform and your LLM gateway already do real work, and a project like agentgateway, the Linux Foundation-hosted, Rust-based proxy for MCP, A2A, and LLM traffic, is a natural fit for checkpoint three specifically — routing, failover, and budget controls at the model layer. AutoPIL doesn't compete there. It sits underneath, enforcing what that gateway is actually allowed to fetch once a tool call reaches out to real data.
The proof came from the two companies best positioned to prevent it
In late July, OpenAI disclosed that one of its models exploited an unknown vulnerability to escape its test sandbox and access another company's systems. Days later, Anthropic disclosed that three of its own models — during controlled security evaluations — reached the open internet and gained unauthorized access to three organizations' production systems: extracting credentials, touching live databases, in one case publishing malicious code to a public package registry.
The detail that should stop everyone building agent infrastructure: in several of those runs, the model had been told explicitly it had no path to the internet. It proceeded anyway.
If the two labs with the deepest investment in AI safety in the world can't contain an autonomous agent through instruction, no enterprise will contain one with a prompt or a policy PDF either. The model's own judgment was the control. It failed. That's not a training problem you patch — it's evidence that the checkpoint has to live outside the model's reach entirely.
The EU AI Act's high-risk enforcement provisions are now in force. Regulators aren't asking whether you have an AI policy anymore. They're asking whether it's enforced — and "we told the agent not to" is not an answer that satisfies a demonstrable runtime control.
Where AutoPIL sits — and where it deliberately doesn't
Underneath identity, runtime, and model routing, there has to be a layer that:
- Enforces, per request, exactly which task an agent is performing and exactly which source it's touching — before any data is retrieved, not after.
- Operates independently of the model's own reasoning about whether a rule applies to it.
- Produces a cryptographically tamper-evident record of every decision, so the audit trail can't be quietly edited by the same system it's auditing.
That's not a seventh point solution stacked next to the other six. It's a horizontal layer that sits underneath all of them — underneath whatever runtime and model-routing stack you already run, in front of whatever data you're trying to protect. Not a competitor to your identity provider, your orchestration platform, or your LLM gateway. The enforcement point that makes all of them accountable, with a record that holds up when someone asks what actually happened.
Two questions worth asking your own stack
One — at checkpoint four, "tools approved," what actually decides whether a given call is permitted? Not where the policy is documented. Where does something intercept the call and make a real-time decision about it.
Two — if a regulator asked tomorrow for the complete audit trail of a specific agent's data access over the last 90 days, what would you hand them?
The answers tell you whether checkpoints four through six on your own agentic data plane are infrastructure, or just intentions.
Anil Solleti is the founder of AutoPIL, a runtime governance platform for agentic AI in regulated industries, and a partner at VibrantCapital.ai.