To safely experiment with autonomous AI agents, run them on dedicated, always-on hardware like a Mac Mini. Grant them segregated resources like their own email accounts and heavily restricted virtual credit cards to create a secure sandbox and limit potential damage.

Instead of building one monolithic AI application, this architecture promotes creating smaller, specialized AI services. The Model Context Protocol (MCP) allows an AI agent to discover and use these tools on the fly, treating them like microservices rather than hardcoded functions, which enhances flexibility and scalability.

Instead of using local machines like Mac Minis, host client agents in isolated cloud virtual machines (e.g., via Orgo). This provides a secure, sandboxed environment and allows you (and your own management agent) to remotely access, debug, and update all client agents from a single platform, making fulfillment vastly more efficient.

The 'out of the box' architecture, where an agent's logic runs separately from its sandboxed execution environment, is more complex but offers superior security and reusability. This prevents agent secrets from being exposed in the execution environment and allows leveraging existing developer setups.

Instead of direct API calls, build Model-Controlled Program (MCP) servers. They act as better guardrails for the AI, allowing it to interact with external data more effectively and even suggest novel use cases based on API documentation.

While starting with a vertically integrated system is fine, enterprises inevitably need two key components: an LLM Gateway to manage and route traffic to various models, and an MCP Gateway to securely connect those models to real-world systems.

To address security concerns, powerful AI agents should be provisioned like new human employees. This means running them in a sandboxed environment on a separate machine, with their own dedicated accounts, API keys, and access tokens, rather than on a personal computer.

An MCP server must not run with its own powerful credentials. To prevent a "confused deputy" attack, the end-user's identity must be passed through the agent to the MCP server, which then authorizes every action against that specific user's permissions, not the server's.

As agents become more complex, their infrastructure needs expand beyond simple compute. Demand is growing for networked sandboxes allowing agent-to-agent communication, sidecars for services like proxies, and fine-grained control over network egress for security and logging.