# Findings Author: Murali Sid (https://linkedin.com/in/muralisid) Source: https://www.agenticarchitectureskills.com/library/layers/r01-infrastructure/findings Published: 2026-09-18 Updated: 2026-10-15 Licence: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/ Cite as: Murali Sid. Findings. Agentic Architecture Skills. https://www.agenticarchitectureskills.com/library/layers/r01-infrastructure/findings --- As of August 2026. Every claim sourced in sources.md; \[vendor] flags inline. *** ### 1. Current state [#1-current-state] Enterprise infrastructure meets agents with cloud landing zones, Kubernetes estates that are less industrial than claimed (over half of surveyed platform teams admit clusters are manual snowflakes; Spectro Cloud 2025 \[vendor]), and no agent-specific provisions: no egress control for autonomous processes, no workload identity for agents (only 23% of organizations have a formal agent identity strategy; CSA 2025), no isolation level for machine-driven execution. ### 2. What changes with agents [#2-what-changes-with-agents] Three new infrastructure classes appear: **execution sandboxes** (isolated, ephemeral environments where agents run code, browse, and use computers), **durable session infrastructure** (agents are long-running, interruptible processes whose state must survive crashes and pauses), and **egress-controlled networking** (autonomous processes need allowlisted, proxied paths to the world). The orchestration workload itself has a distinctive profile: bursty, I/O-bound, idle 30 to 70% of wall-clock waiting on model and tool calls, which upends conventional capacity thinking. ### 3. Introduction options and sequencing [#3-introduction-options-and-sequencing] Start on managed runtimes for orchestration (they arrive with per-session isolation and idle-friendly billing); adopt sandbox capability the day the first act-capable agent ships, not later; put egress control in place before autonomy expands; introduce self-hosted serving only when a sovereignty classification demands it (see CD-6). Kubernetes enters where it already lives: self-hosted model serving and multi-environment portability. ### 4. Economics [#4-economics] The orchestration layer's cost levers are idle-time economics: consumption billing that charges nothing during I/O wait (AgentCore pricing model \[vendor]) and hibernation of idle agents (Cloudflare Durable Objects \[vendor]). The serving layer's lever is utilization: self-hosting only beats metered APIs at roughly 100-250M+ tokens per month sustained per workload against frontier APIs, at 60%+ utilization, with honest 1.3-2x operations multipliers; against budget open-weight APIs the break-even recedes to billions of tokens per month (four consistent practitioner analyses, 2025-2026; none peer-reviewed; at 10% utilization cost per token rises roughly 10x). Cold starts stopped being the objection: GPU memory snapshots cut cold starts about 10x (vendor benchmarks), and serverless GPU instances start in seconds (Cloud Run GPUs GA Jun 2025 \[vendor]), making scale-to-zero viable for bursty agent work. GPU market note (mid-2026): Hopper-class capacity is cheap and abundant (reserved H100 bottomed at $1.70/GPU-hr in Oct 2025, rebounding \~40% by Mar 2026; SemiAnalysis), Blackwell-class is scarce and reserved; the assumption that compute always gets cheaper is not safe for the newest silicon. ### 5. Learning [#5-learning] Infrastructure telemetry (session traces, sandbox events, egress logs) feeds the flywheel; the layer itself learns through capacity models per agent class and through promotion of proven session patterns into templates. Snapshot/restore infrastructure is also what makes eval-replay cheap. ### 6. Risk and groundedness [#6-risk-and-groundedness] The incident record defines the risks: an agent deleted a production database during an explicit code freeze (Replit, Jul 2025); a compromised IDE extension carried a data-wiping prompt to \~950K installs (Amazon Q, Jul 2025: version 1.84.0, entered through an over-scoped GitHub token, payload failed on a syntax error, per AWS bulletin AWS-2025-015); frontier models exploit container weaknesses when present (SANDBOXESCAPEBENCH, arXiv 2603.02277: plain containers are an insufficient boundary). Controls: environment separation (dev/prod isolation for agents as hard policy), microVM-class isolation for act-capable work, snapshots as the undo button, and blast-radius design before permission grants. ### 7. Security and determinism [#7-security-and-determinism] **Sandboxes: gate on permissions, not product category.** Act-capable agents (code execution, browsing, computer use) require hypervisor-class isolation (microVM or Hyper-V) for untrusted code touching sensitive data, with gVisor (a user-space kernel, not a microVM) as a middle option and plain containers never the boundary; this is now industry consensus (per-session microVMs in Bedrock AgentCore GA Oct 2025 \[vendor]; Hyper-V-isolated Azure dynamic sessions with egress off by default \[vendor]; OpenAI's per-session virtual computer \[vendor]; Anthropic's open-sourced sandbox runtime with proxy-enforced domain allowlists \[vendor]; OWASP Agentic Top 10 Dec 2025; the CNCF Agent Sandbox project, not yet production-ready). Chat-and-retrieve agents do not need compute sandboxes, but they are not exempt from controls: the marquee 2025 exploit (EchoLeak, CVE-2025-32711, CVSS 9.3) was a zero-click exfiltration from a retrieval agent, entirely in natural-language space; the decisive controls there are egress restriction, output sanitization, and data boundaries. And because agents accrete tools over time, gate on the capability combination (the lethal-trifecta / Rule-of-Two frame: private data, untrusted content, external communication or state change), re-evaluated on every tool grant. **Networking**: all sandbox and agent egress through allowlisting proxies; block cloud metadata endpoints and private ranges from sandboxes (Unit 42 guidance); private connectivity to model providers exists on all hyperscalers (PrivateLink-class) but is opt-in, never default. **Workload identity**: agents need first-class compute identity: directory-based (Entra Agent ID class), standards-track (IETF WIMSE architecture covers AI agents; SPIFFE in production for agents at Block), and OAuth-extension based (Cross App Access, adopted as MCP's Enterprise Managed Authorization). ID2 is the floor; shared human credentials for agents, still common, are the ID1 anti-pattern. ### 8. Sovereignty [#8-sovereignty] The 2025-2026 shift: sovereignty demands are increasingly met *without* self-hosting. Air-gapped managed AI is real (Gemini GA on Google Distributed Cloud air-gapped, Aug 2025, authorized to US Secret/Top Secret \[vendor]); sovereign regions run managed model services under local control (AWS European Sovereign Cloud GA Jan 2026 with Bedrock \[vendor]); Gartner projects most European and Middle East enterprises geopatriating workloads by 2030. True self-hosting is justified by air-gap and classification levels, not generic residency. ### 9. Vendor landscape [#9-vendor-landscape] Summary here; the map is in the vendors section. Camps: managed agent runtimes (hyperscalers plus edge platforms), sandbox specialists, durable-execution engines, Kubernetes-native serving (standardizing fast under CNCF), and workload-identity providers. ### 10. Target state [#10-target-state] Agents run on managed or platform-provided runtimes with per-session isolation; act-capable work executes in microVM-class sandboxes behind egress proxies; every agent holds a first-class workload identity; sessions are event-logged and resumable; model access is metered by default, routed to sovereign or self-hosted serving only by data classification; capacity and cost are managed per agent class with idle-time economics. ### 11. Migration path [#11-migration-path] Adopt a managed runtime for the first production agents; stand up sandbox capability with the first act-capable agent; enforce egress allowlists before expanding autonomy; introduce workload identity with the identity program (R10); revisit self-hosting only on sovereignty triggers. Stop buying: GPU capacity ahead of a proven sustained workload; bespoke agent hosting where a managed runtime suffices. ### 12. Metrics [#12-metrics] Percentage of act-capable agents in isolated sandboxes; egress-allowlist coverage; sessions resumable after crash (tested); agent identity coverage (no shared credentials); orchestration cost per session and idle-time share; serving utilization where self-hosted. ### 13. Data readiness and curation [#13-data-readiness-and-curation] This layer contributes session event logs and sandbox artifacts to grounding and audit; their retention, redaction, and provenance follow the same governance as any agent memory. ### Challenged defaults [#challenged-defaults] **CD-6: Self-hosted GPU estates vs metered APIs. Verdict: metered by default, with the correction that the cost path is open-weight via metered APIs, not self-hosting.** The market moved: open-weight models now lag the frontier by only \~4 months (Epoch AI, May 2026) and are available at budget API prices that push self-hosting break-evens to billions of tokens per month. Enterprises still run 81% of LLM workloads on closed models (Menlo Dec 2025 \[VC]), and control, not cost, is their stated reason for going open. Self-hosting earns its place for air-gap and classification requirements, and rarely on cost alone: below roughly 100-250M sustained tokens per month per workload, or below 60% utilization, the numbers do not close. The Airbnb counter-example (public commitment to Qwen for cost and speed, Oct 2025) marks the boundary: at hyperscale consumer volume, cost-driven open-weight adoption is real, via APIs. **CD-7: Kubernetes-everywhere vs managed agent runtimes. Verdict: split by job.** Model serving is where Kubernetes standardized (Dynamic Resource Allocation GA in v1.34; llm-d donated to CNCF Mar 2026; the CNCF AI Conformance program), and it matters only if you self-host models at all. Agent orchestration fits managed runtimes: per-session isolation is native, billing matches the idle-heavy profile, and Kubernetes needed a new project just to match the isolation primitive (Agent Sandbox, not yet production-ready). Choose Kubernetes for orchestration only with existing platform engineering strength and genuine multi-environment portability needs; note the lock-in symmetry: managed runtimes are proprietary platforms, and the portability camp sells its own ecosystem. ### Cross-cutting concerns [#cross-cutting-concerns] | # | Concern | Treatment at this layer | | --- | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | C1 | Identity & access | First-class workload identity per agent (directory, WIMSE/SPIFFE, or OAuth-extension based); no shared human credentials; ID2 floor | | C2 | Observability | Session traces, sandbox lifecycle events, egress logs; idle-time and utilization telemetry | | C3 | Traceability & audit | Event-logged sessions; sandbox snapshots as forensic artifacts; egress decisions logged | | C4 | Grounding in reality | Sandbox and session artifacts carry provenance for anything promoted to grounding | | C5 | Impersonation & authenticity | Workload identity attestation (WIMSE-class); no ambient credentials in sandboxes | | C6 | Data sovereignty & residency | Classification-routed serving (managed, sovereign region, air-gapped); sandbox and session data residency explicit | | C7 | Data privacy | Session memory sanitization on termination (microVM pattern); redaction in session logs | | C8 | Safety & human oversight | Environment separation as hard policy; gating by permissions; kill switch at runtime level | | C9 | Cost accountability | Per-session cost, idle-share, and utilization metrics; budget caps at the runtime | | C10 | Resilience & continuity | Durable, resumable sessions (event log or durable-execution engine); snapshot/restore; degraded-mode to human queues | ### Open questions [#open-questions] * Kubernetes Agent Sandbox production readiness: re-check Q4 2026. * Peer-reviewed unit economics for self-hosting: none found; ranges published with caveats. ***