Why Your Enterprise Tech Stack Isn’t Ready for AI Agents — Christopher Lovejoy & Saul Howard
Enterprise agent requirements should shape the foundation, not be bolted onto a working POC. Design audit, sensitive-data access, human escalation, and evals into the architecture.
A four-week agent POC can meet speed and accuracy targets yet stall on compliance. In regulated environments, an audit trail must record every action, data access, and authorization; sensitive data may also be prohibited from leaving the customer’s environment.
The proposed foundation has **four architectural principles**: an immutable action ledger, schema-driven object storage beside orchestration, equivalent action interfaces for humans and LLMs, and evals treated as a first-class system property. Build back toward POC capability on those primitives.
A four-week agent POC can meet speed and accuracy targets yet stall on compliance. In regulated environments, an audit trail must record every action, data access, and authorization; sensitive data may also be prohibited from leaving the customer’s environment. The proposed foundation has **four architectural principles**: an immutable action ledger, schema-driven object storage beside orchestration, equivalent action interfaces for humans and LLMs, and evals treated as a first-class system property. Build back toward POC capability on those primitives. Event sourcing makes writes and retrospective interpretation easier but makes reads and projections harder. The patterns come from healthcare deployments, and the talk does not show that they alone satisfy every regulatory framework, integration constraint, or prompt-injection threat.
This shifts enterprise agent readiness from proving task performance to proving every action, access, and authorization can be governed inside deployment constraints. It makes auditability, local data handling, shared action schemas, and evals foundational rather than post-POC additions. The event-sourced design supplies concrete primitives but also introduces projection complexity and does not by itself establish regulatory compliance or resistance to prompt injection.