How to Build a Governed Agent Stack

Alexander Polomodov and Mikhail Trifonov explain why an agent stack is not a simple build-versus-buy choice. Leadership owns leakage, secret, and harmful-action risk; developers judge tool quality. The organization should retain the elements that define its risk and competitive advantage.

The stack has five parts: harness, model, tools, identity, and boundaries. The harness runs the loop, tools create effects, identity establishes the actor, and the sandbox limits network and files. Open source does not mean local inference, self-hosting does not make actions safe, and broad MCP privileges increase exposure.

Eight configurations map trade-offs across TCO, lock-in, freshness, and responsibility, from an air-gapped stack to SaaS or an external planner with an internal executor. A model gateway controls data paths, regions, and budgets; a tool gateway validates identity, policy, and effects.

A README, issue, email, or tool result can carry prompt injection. Policy must run outside the model through sandboxing, deny-by-default egress, least privilege, short-lived credentials, separated read and write powers, audit, and a kill switch. Trust zones, internal access, scale, and mature evals—not a client brand—determine the configuration.