The API Contract Is Broken
Here's something that keeps me up at night: the entire model we built distributed systems on — APIs as the boundary where policy lives — is quietly obsolete. Not deprecated. Not evolving. Broken.
APIs worked because they were narrow. You could only ask for what the endpoint explicitly defined, and only in the way it defined. That constraint was the whole point. It shrunk the behavior space down to something a human could reason about at 2 AM when something was on fire. Authentication, authorization, validation — all happened at the moment of request. You protected the gateway and you were done.
That was fixed logic. Input goes in, one predetermined output comes out. Simple. Secure enough.
Then agentic AI showed up and threw that entire paradigm out the window.
What Actually Constrains a Distributed System
The real constraint in distributed systems has never been access. It's execution.
With autonomous data movement and actions happening at machine speed, the question is no longer whether a single request is valid. It's whether an entire sequence of actions stays safe as it unfolds over time. That's a fundamentally different problem.
An agent doesn't follow a script. It reads a goal and determines the most likely sequence of actions to achieve it through dynamic reasoning. The contract isn't in the API documentation anymore — it's hidden inside the emergent behaviors of the model. You can't approve something ahead of time at a gateway if you can't predict what the agent will do next.
And detection-based tools? Logging, alerting, SIEM? They're useful for understanding what happened after the fact. But they don't stop anything. By the time you detect a bad sequence, it's already complete.
Why APIs Can't Hold Agentic Systems
Traditional API design assumed fixed logic. You knew what inputs would produce what outputs, so you could build guardrails around that predictable exchange. Identity was decoupled from infrastructure — systems communicated through stable contracts instead of raw network primitives.
Agentic AI replaced that with probabilistic decision-making. An agent reads a goal, reasons through possibilities, and executes a sequence that no one wrote down in advance. The behavior space exploded from something finite into something essentially unbounded.
Kubernetes already pushed infrastructure beyond perimeter security with ephemeral workloads. But agentic AI adds a deeper layer: genuine unpredictability. If you can't predict the next move, approval gates are theater. You're asking a bouncer to check IDs for people who haven't decided what bar they want to walk into yet.
The Kernel Is the Real Control Plane
All activity in a system eventually becomes kernel events. Processes start executing. Files get read and written. Network connections open and close. The kernel is where execution actually happens — which makes it the most accurate location for both observing and enforcing behavior.
eBPF changed everything here. It lets developers attach hooks into kernel events and capture detailed information about process, file, and network activity in real time. Minimal latency. Common view of execution across the entire system.
This isn't theoretical. Platforms like Cilium and Tetragon build on this foundation to enforce policy at the point of execution:
- Cilium enforces identity-aware policy at the networking layer, ensuring workloads communicate only along pre-established rules regardless of which physical or abstract nodes they reside on.
- Tetragon correlates file and process activity, enabling assessment and termination of behavior sequences before they complete.
The enforcement point has shifted. It's no longer at the boundary. It's where the action actually occurs.
Microsegmentation Means Something Different Now
Microsegmentation used to mean dividing networks into zones based on access rights. That's still useful, but it's only half the picture now.
The new definition is more granular: segmenting behavior based on allowable actions. Policies define what a workload can read, write, execute, and connect to — and those restrictions are enforced in real time at the instant an action is taken. Not after. Not with a flag and a ticket. In real time.
For agentic systems, microsegmentation becomes something like a runtime contract between autonomous entities and their environment. It constrains what agents can do while still letting them contribute to complex workflows. You're not blocking the agent from working — you're making sure it works within bounds that keep the system safe.
This is control without interfaces. No API gateway required. The policy lives in the kernel, where execution actually happens.
What This Means for Distributed System Design
The shift demands a rethink of how we architect constraints into distributed systems:
Runtime guardrails replace API gates. Instead of relying on request-level validation at a boundary, you need mechanisms that observe and enforce behavior as it unfolds. The control plane is the execution plane now.
Sequence safety matters more than request validity. A single valid request isn't the threat. It's the sequence — the chain of reads, writes, and executions that no single request would cause but together create a problem. Enforcement has to understand context across time.
Kernel-level visibility is non-negotiable. If you can't see what's actually executing, you can't constrain it. eBPF-based observability isn't optional anymore — it's the foundation for any meaningful security posture in autonomous systems.
Microsegmentation is behavioral, not just network-based. Defining what a workload can do — read this file, write to that socket, execute this binary — and enforcing those definitions at the kernel level is what keeps autonomous systems from becoming uncontrolled ones.
The evolution is clear. APIs made distributed systems predictable by limiting the behavior space. Agentic AI expanded that space beyond what API contracts can contain. Microsegmentation and kernel-level policy enforcement are the response — moving constraints from the boundary to the execution layer where they actually matter.
For more insights on AI infrastructure and distributed systems, check out Sakana's Fugu Packs Collective Intelligence Into One Model to Bypass Single-Vendor Risk and Thwarting AI-Driven Cloud Waste: How Spec-Level Policy Gates Tame Over-Provisioned Infrastructure.