The Plumbing Before the Last OS
The model can already produce the compelling answer and the polished interface. Dependable delegation requires a less glamorous achievement: systems that make autonomous action accountable.
The limiting work is moving from model capability to identity, authorization, provenance, durable data contracts, and institutional permission.
An agent demo is easy to understand. State an outcome, connect a few tools, and watch the system do in seconds what previously required a morning of application switching. The loop collapses. The future becomes visible.
Production is where the invisible questions arrive. Which identity performed the action? Which permissions did it inherit? What information did it read? Which transformation produced the number? Who is accountable when the result is wrong? Can the action be reversed? Can another system reconstruct why it happened six months later?
These questions are not peripheral safety features. They are the operating system.
Illustrative, qualitative read of how close each prerequisite is to "solved." Red = hard blocker, amber = in progress. None is close to done — which is precisely where the work, and the opportunity, sit.
Authorization was designed for people
Most enterprise permission systems assume a person is present. A user signs in, clicks allow, and performs actions inside a known application boundary. An agent breaks that model. It may act across dozens of systems, continue after the original conversation ends, and make intermediate decisions no person explicitly approved.
Giving the agent the user's full authority is convenient and dangerous. Restricting every action to a new approval recreates the workflow the agent was meant to remove. The real problem is designing delegated authority: permission that is specific enough to be safe, broad enough to be useful, observable while active, and revocable when conditions change.
Data contracts decide whether answers mean anything
Generated interfaces and autonomous analysis depend on systems knowing what information exists and what it means. Most organizations do not have that substrate. They have undocumented schemas, duplicated metrics, spreadsheet exceptions, stale fields, and business definitions that live inside particular people's heads.
A fluent model can conceal this disorder. It can produce a coherent answer from incoherent foundations. That makes durable data contracts more important, not less: definitions, ownership, freshness, lineage, and the limits under which a value can be compared.
Traditional software often treats the audit trail as a record of events: who clicked what and when. Agentic systems require something richer. A useful record must carry the purpose of the action, the evidence used, the alternatives considered, the assumptions made, and the authority under which the system proceeded.
That provenance has to survive the journey. It must travel from source to analysis, from analysis to generated interface, and from recommendation to action. Otherwise the surface may tell a convincing story that the underlying systems cannot verify.
Accountability also has to be designed before deployment. A model provider, application vendor, organization, operator, and approving human may all contribute to one outcome. If responsibility is left ambiguous, every party can plausibly claim that the consequential choice occurred somewhere else.
Graceful failure matters more than perfect autonomy
Agents will encounter missing permissions, conflicting data, latency, unavailable services, and decisions outside their competence. The trustworthy system is not the one that never fails. It is the one that fails visibly, preserves context, narrows its authority, and hands the problem back without disguising the break.
A generated interface should therefore communicate the state of delegation: what the system completed, what remains unresolved, where confidence fell, and what action now requires a person.
Agents need scoped, revocable authority that remains distinct from the person who invoked them.
Systems need explicit definitions, ownership, lineage, and freshness before models can reason dependably.
Evidence, transformations, assumptions, and authority must remain attached to every outcome.
Failure states must preserve context and return control before uncertainty becomes action.
Capability will continue to improve, and interfaces will become easier to generate. Those advances are visible and reward fast iteration. Trust infrastructure advances differently. It requires agreement across systems, organizations, regulators, and professions whose incentives do not naturally align.
That slower work will determine where agents become dependable rather than merely impressive. The last operating system will not be built from a model alone. It will be built from the contracts that decide what the model may know, do, explain, and be held responsible for.