When Agents Talk to Enterprise APIs: Bilateral Contracts and Runtime Boundaries

Over the past few months, as part of an ongoing exploratory project on agent safety and runtime boundaries, I've been experimenting with how autonomous agents interact with backend services and APIs. It is very much an early-stage exploration — not a finished product, not a proposed standard, and certainly not something that has undergone formal outside security audits. Still, while experimenting with multi-agent workflows and tool invocation, I kept running into an uncomfortable design pattern: In many contemporary agent setups (whether using LangChain, custom scripts, or standard Model Context Protocol (MCP) servers), the runtime hands an LLM an API token or a set of tools with direct execute permissions. If the model generates a function call, the framework executes it directly against backend services. That setup makes me nervous. An LLM cannot provide formal mathematical guarantees about its own behavior. A prompt injection, a subtle context shift, or a sudden hallucination c