Agent runtimes have converged on the same architecture and nearly the same price, so the interesting question is no longer which one to buy. It is what the one you already have will and will not enforce — and where, precisely, the part you have to build yourself begins.
The failure is a budget decision
Let’s start with two numbers that shouldn’t be able to coexist.
On Terminal-Bench 2.0, the benchmark for agents working in a terminal, the best systems now hover around 84.7% of tasks solved. Impressive. Now stretch that same kind of work to 85 minutes and roughly 231 episodes per task — which is what Long-Horizon-Terminal-Bench, published in July 2026, measures — and the best model lands at 15.2%. The mean across the fifteen models evaluated: 4.3%.
The interesting part isn’t the drop. It’s the autopsy. Of the runs that never got resolved, 79% are timeouts: the agent was still working when its budget ran out. Another 19% are early exits — the agent gives up with the task incomplete — and only 3% are harness errors.
Read that again: almost none of it is the model being wrong. It is termination, budget and state. And those three things don’t live in the model; they live in the layer underneath.
About that layer there is a published position I share: agent runtimes have become a commodity, and the real constraint on agent programmes has moved to governance — the six pillars we’ll get to at the end. Both things are true, and they are not in tension. The runtime is a substrate. This article is about what that substrate actually enforces, and where it stops.
The commodity, stated once
I won’t re-litigate the thesis; one paragraph will do. Google’s Gemini Enterprise agent runtime, AWS’s Bedrock AgentCore and Cloudflare’s agent infrastructure have converged on the same shape — per-session isolation, scale-to-zero, active-CPU billing — and on nearly the same price: $0.085 per vCPU-hour at Google and $0.0895 at AWS, with idle I/O wait unbilled at both. Three hyperscalers within four percent of each other on price and undifferentiated on architecture: that is a commodity.
The corroborating signal comes from the other direction: OpenAI announced on 3 June 2026 that it is winding down Agent Builder and its Evals platform (read-only from 31 October 2026, shutdown on 30 November), while leaving the Responses API and the Agents SDK untouched. The churn is in the packaged layer above; the substrate, meanwhile, keeps consolidating.
But a commodity is not the same as a solved problem. Electricity is a commodity too, and you still want to know where the fuses are. You have to know what you’re standing on.
Seven primitives, and where each one stops
Here is the heart of the piece. For every runtime primitive, the same three-beat rhythm: the mechanism, what it enforces deterministically, and what it does not enforce — plus which governance pillar picks up the remainder. The distance between those last two columns is, exactly, the territory of agent governance.
1. Durable execution: the journal
The mechanism: the runtime records each step’s result in a journal and, after a failure, replays the recorded results rather than redoing the work. Temporal’s rule is that everything non-deterministic lives in Activities, which execute outside the replay path.
It enforces: that work survives crashes, deploys and rate limits, and — no small detail — that an LLM call is not silently paid for twice. A model call is a non-deterministic side effect with a price tag; replaying it is both incorrect and expensive.
It does not enforce: who authorised the run. The journal is the raw material of attribution (pillar 1), but a journal is not a delegation chain: logs tell you what happened, not who answers for it. And who owns that in your organisation today?
2. Sessions and hibernation: the cost floor
Two shapes dominate. The addressable actor with co-located storage — Cloudflare’s Durable Objects, where addressability is sticky routing — and the record-plus-microVM: in AgentCore, one microVM per session ID, with a 900-second default idle timeout and a hard 8-hour maximum lifetime. A hibernated object is not billed for duration.
It enforces: that an idle agent costs nearly nothing. That is what makes long-lived runs — and runs waiting on a human — affordable at all.
It does not enforce: spend per accountable principal. The runtime meters per session, for its own invoice. Bounded resources (pillar 4) need cumulative accounting per accountable human: one person’s twelve concurrent agents are a single budget, and the runtime neither knows nor cares.
3. Isolation and egress: the only place an injection is contained
There are four isolation tiers with order-of-magnitude differences: Firecracker-style microVMs (~125 ms boot, ~3 MB overhead per VM), user-space kernels like gVisor, containers, and V8 isolates that start in single-digit milliseconds.
But the agent-specific control is not isolation: it is egress — the way out. Anthropic’s sandbox-runtime describes it with engineering precision: a deny-by-default allowlist, HTTP through a domain-validating proxy, other TCP through SOCKS5, kernel-level fencing for processes that ignore proxy environment variables, and credential injection so the secret never enters the context window.
It enforces: where bytes may go, deterministically, regardless of what the model believes.
It does not enforce: what those bytes mean. This is the exact seam with provenance conservation (pillar 3): the runtime can block a destination; it cannot know that the outgoing summary derives from the M&A data room.
And a dose of humility: an allowlist is only as good as the agreement between its parsers. Claude Code’s network sandbox was bypassed with a null byte in a SOCKS5 hostname: the policy filter read attacker-host.com\x00.google.com as ending in an allowlisted suffix while the OS resolver truncated at the null byte. Around 130 releases across five and a half months with the door ajar.
4. Context management: the invisible truncation
Compaction and context editing are now server-side primitives with published triggers: context editing fires by default at 100,000 input tokens; compaction at 150,000. They live in the runtime rather than in your application for reasons of pure prompt-cache economics: cache writes cost 1.25× or 2× base input, reads cost 0.1×, and every context edit invalidates the cached prefix. Trimming has a price, so the trimming gets coordinated where the cache is.
It enforces: that runs do not die of context exhaustion and that the token bill stays sane. The published reductions are serious: 84% fewer tokens on a 100-turn web-search evaluation with context editing, and 150,000 down to 2,000 tokens — 98.7% — by replacing tool round-trips with code execution.
It does not enforce: an auditable record of what was dropped. Silent truncation is structurally unobservable from the API-client side. And that is a closed evaluation loop problem (pillar 5): you cannot evaluate an output whose input you cannot reconstruct.
5. Human-in-the-loop: the pillar-6 primitive that already exists
This one deserves extra room, because it is the most useful contribution of the piece.
A human approval is the same primitive as crash recovery, aimed at a person: suspend an in-flight computation durably and indefinitely, then resume it with new input. LangGraph’s interrupt() persists via the checkpointer and waits indefinitely; step.waitForEvent() and step.sleep() in Cloudflare Workflows go up to 365 days; Temporal’s Updates are the right shape for an approval that must be acknowledged. And the decisive part: a waiting run costs approximately nothing. Cloudflare explicitly excludes waiting instances from its concurrency limits, and hibernating sessions are unbilled.
Here a public qualification is due on an argument that usually goes unchallenged: that synchronous approval is so expensive that teams end up disabling it — true — and that asynchronous review does not exist as a product — only half true. The mechanism is a commodity; the governance wrapper around it is not. Any serious runtime can hold a run suspended for 48 hours at a cost close to zero. What none of them ship is the ladder of autonomy tiers, promotion on evaluation evidence, and instant unilateral demotion. Earned autonomy (pillar 6) is cheaper to adopt than it looks: the expensive part is already on your bill.
Two correctness traps that will bite in an audit. One: in LangGraph, upon resumption the entire node re-executes from its beginning — not from the interrupt line — so side effects before the pause run twice unless they are idempotent; and resume values are matched by index. The other cuts the good way: forking a past checkpoint creates a new branch while the original history stays intact. That is how you do counterfactual review without destroying evidence.
6. Budget ceilings: advisory versus enforced
The other high-value subsection. Three independent ceilings exist: steps (recursion limits, max_turns), tokens, and time/retries. But the distinction that matters is not which one — it is whether it is enforced.
Anthropic’s task budgets inject a server-side countdown so the model finishes gracefully rather than cutting off mid-action. And the documentation itself is explicit: the budget is advisory, not enforced; the hard ceiling remains max_tokens.
That is a primary-source proof of something worth engraving: a budget the model is told about is a suggestion, and under prompt injection a suggestion is nothing. The ceilings that are actually enforced are the crude ones — max_tokens, step caps, timeouts — and they are per-call or per-run, not per-principal, and they do not attenuate across delegation hops. An agent without an enforced ceiling is an uncapped invoice with a plausible excuse.
7. Sub-agents: the boundary nobody guards
Orchestrating several agents buys wall-clock time and context headroom at roughly 15 times the tokens of a chat interaction (versus 4 times for a single agent), so it needs a case-by-case justification. But the architectural point is a different one: a sub-agent’s result is untrusted input to the orchestrator. A prompt-injection channel inside your own system, one hop removed from your controls. Some harnesses now scan sub-agent output for instruction-shaped patterns before the parent reads it.
It enforces: process and storage isolation between sub-agents.
It does not enforce: attenuation of authority down the chain. Recursive delegation is where pillars 1, 2 and 4 fail together, and no runtime handles it, because no protocol on a standards track can yet say “this sub-agent may spend X, until Y, on behalf of Z.”
What no runtime can do, whichever one you buy
Three structural limits, stated once and without anaesthetic.
It enforces at the perimeter of bytes, not the semantics of meaning. It can block a destination; it cannot know the output crossed a sensitivity boundary. The incident record is a provenance record: EchoLeak (CVE-2025-32711, June 2025) and GeminiJack (Noma Security, December 2025) both moved content across a sensitivity boundary inside a context window and out through an unconstrained output channel. Neither is fixable with a better allowlist.
It cannot express delegation. OAuth’s on-behalf-of covers one hop. Cross-organisational delegation exists only as an IETF problem statement. And the attenuating-agent-tokens draft — the mechanism you would need for “spend at most X, until Y, on behalf of Z” — is an individual Internet-Draft at revision -01, not adopted by the OAuth working group. No runtime can enforce what no protocol can say.
Model-layer defences do not converge. NIST CAISI’s analysis of a large public red-teaming competition (~400 participants, 250,000+ attack attempts, published March 2026) found at least one successful attack against all thirteen frontier models tested, with success rates spanning roughly 0.5% to 8.5%. Guardrail vendors advertise catching ~95% of attacks; as Simon Willison puts it, “in web application security 95% is very much a failing grade.” A probabilistic filter in front of a deterministic capability is not a boundary.
And here, the handoff that gives all of the above its point:
Everything above is buyable, and most of it you already have. What is not buyable is the layer that says which human answers for this run, what this agent was permitted to do, what it read before it wrote, how much it could spend across every hop, whether it has been evaluated lately, and whether it has earned the right to act without review. Those are the six pillars of agent governance — attribution, least capability, provenance conservation, bounded resources, closed evaluation loop and earned autonomy — and they sit on top of exactly the substrate we have just walked through.
What to ask before you sign
These are runtime-procurement questions; the governance self-assessment is a different list for a different day. Bring these to the meeting:
- Show me the event log and the replay. Which operations are treated as side effects, and which get re-executed?
- Do you bill active CPU or wall clock, and what does an alive-but-idle session cost per hour? On published rates the fleet arithmetic is brutal: a held-open default sandbox runs about $0.166/hour; a pinned actor about $0.0056; a hibernated one, zero. Across 10,000 concurrent sessions that is roughly $1,660/hour versus $56 versus nothing.
- What does a run waiting 48 hours for human approval cost? Can I fork a completed run to inspect what would have happened?
- Name the isolation tier. Where is the egress allowlist enforced — proxy, kernel, or prompt?
- Which limits are enforced and which are advisory: token budget, step ceiling, hard timeout? Where is the metering chokepoint the agent cannot route around?
- When compaction drops context, what is written down about what was dropped?
- What crosses the sub-agent boundary, and is sub-agent output treated as untrusted input?
And the design rule worth more than the rest combined: keep the session and the sandbox separate. The session is cheap, hibernates and lives long; the sandbox is expensive and should be created lazily, snapshotted, and torn down between tool calls. Most billing scares in agent fleets come down to this one mistake.
The gap does not close with a better model
Back to the beginning. The gap between 85% and 15% is not closed by a better model: the same models produce both numbers. It closes when someone owns the budget, the boundary, the evidence and the gate. The runtime you already have gives you the enforcement points for the first two, partial material for the third, and the suspend primitive for the fourth. The rest is governance. And governance is, precisely, the part that does not commoditise.
Ideas over codebases; evidence over hype.
Leave a Reply