From model hype to AI agent infrastructure
AI agent infrastructure is the collection of standards, security controls, catalogs, and operating system features that let autonomous agents safely discover tools, prove identity, and execute actions on behalf of users across many systems. After a year of agent demos focused on clever prompts and bigger models, the hard problems now live underneath the UI: how agents find resources at runtime, how their permissions are scoped, and how their actions are contained and audited. The goal is not more impressive conversation, but predictable behavior that fits into enterprise AI governance. Vendors are converging on a new stack: web‑scale discovery specifications, identity‑aware policy layers, sandboxed execution, and OS‑level security that treats agents as first‑class actors. The competitive moat is shifting from which model an organization runs to how boring, dependable, and controlled its agent environment is.
Agentic resource discovery: catalogs instead of hard‑wiring
Google, Microsoft, GitHub, and others are pushing Agentic Resource Discovery (ARD) as the missing search layer for tools and agents. Today, most agents are wired manually to each MCP server, API, or plugin, which does not scale as more services expose machine‑facing capabilities. ARD replaces that with a standard two‑step pattern: organizations publish an ai-catalog.json on their own domains that lists tools, agents, and MCP servers, and independent registries crawl these catalogs and answer natural‑language discovery queries from agents. Because the catalog sits on the publisher’s domain, domain ownership and optional trust metadata help agents verify who is behind a capability before calling it. According to Search Engine Journal, eleven companies, including Google, Microsoft, NVIDIA, Salesforce, and Snowflake, contributed to the open spec licensed under Apache 2.0. This turns agentic resource discovery into shared infrastructure instead of custom glue.
Tailscale Aperture and the rise of the agent security framework
As agents gain the power to click, call APIs, and move data at machine speed, governance becomes an agent security framework problem, not a prompt‑engineering one. Tailscale’s Aperture positions itself as a control plane for this new reality, adding a unified chat interface, universal data connectors for both MCP and traditional APIs, and sandbox support for higher‑risk actions. CEO Avery Pennarun notes that the risk comes from “giving any actor too much room to act without clear boundaries,” and that agents need “boring infrastructure around them – robust identity management, limited access controls, carefully tracked logs, and sandboxes.” Identity‑based policy lets teams decide which agent can call which service, from where, and under what conditions, while sandboxes keep misbehavior or prompt injection from spilling into production systems. This is enterprise AI governance expressed as network policy and isolation, not as a stack of redlined prompts.
Windows bets on OS‑level containment for agents
On the operating system side, Microsoft is recasting Windows as a trustworthy home for autonomous agents by pushing security down into the platform. A new Windows Developer Blog post introduces the Microsoft Execution Containers (MXC) SDK as a policy‑driven execution layer that abstracts over process isolation, session isolation, planned micro virtual machines, and Linux containers on both Windows and WSL. Developers describe in JSON or TypeScript what an agent may access, and Windows chooses an isolation level, with IT teams managing these policies centrally through Entra ID and Intune. Defender and Purview are positioned to give protection, observability, and an audit trail of agent behavior, while agents inherit broader Windows work such as Secure Boot, passwordless sign‑in, memory‑safe drivers, and post‑quantum cryptography in Insider builds. The message is clear: dependable agents start with OS‑level containment, identity, and manageability, not with another application‑level band‑aid.
Stripe Projects and the pressure to expose agent‑ready catalogs
Stripe’s new Projects protocol shows how commercial infrastructure is opening itself to agents on purpose. Projects gives AI agents four flows under user authorization: account creation at participating vendors, plan and product purchase using Shared Payment Tokens, provisioning and configuration of resources, and subscription management over time. At launch, cloud platforms like Cloudflare, Vercel, and Netlify allow an agent not only to pay for an account but also to configure DNS, deploy workers, bind domains, and change plans without human clicks. This effectively exposes each provider’s service catalog in an agent‑readable structure. Vendors that do not present their capabilities in structured catalogs will face growing pressure to rebuild onboarding, billing, and configuration so they can participate in this agentic commerce layer. As infrastructure providers, OS vendors, and security platforms race ahead, the winning agent ecosystems will be the ones that feel boring, predictable, and safe enough for real workloads.
