An agent deleting a production database (and the backups) isn’t a sci-fi failure. It’s a boundary failure, and it starts with a human handing out credentials and permissions without a safe execution model to contain what happens next. In this episode of #F5's Pop Goes the Stack, Lori MacVittie and and our Chief Product Officer, Kunal Anand, unpack why today’s agents are either dangerously overpowered or so constrained they’re barely useful, and what needs to change to make them viable. They dig into the current reality of “agent” features in mainstream tools, especially how Copilot-style agents often feel like chatbots trapped behind walls: limited access, weak integration, and poor continuity when context windows overflow. Kunal shares two painful examples: voice-mode work that produced the right output but didn’t persist a transcript or draft, and an inbox assistant that can’t actually read the inbox without copy-paste, making it useless for real workflow automation. The core point is that system prompts aren’t constraints, they’re guidance, and guidance fails the moment a goal-driven system tries to “do the thing” by any means necessary. That’s why Microsoft’s move to build agent permission primitives directly into Windows is a meaningful shift: controls need to be enforced at the OS and runtime level, not politely suggested to the model. They also touch on practical workarounds, like exporting a long chat as a PDF to carry context forward, and why isolation and blast-radius reduction are still table stakes. The takeaway is straightforward: agents in production are still the exception, not the norm. Most enterprises are deploying AI-enabled applications first, while keeping agentic automation largely in employee workflows. Until we get real, enforceable boundaries and better UX for authority and approval, treating agents as production-grade operators is a risk most teams can’t justify. Chapters: 00:00 Welcome to Pop Goes the Stack 00:45 When agents eat your homework: The database deletion wake-up call 01:55 Microsoft Build: Agent permission primitives built into Windows 04:13 System prompts aren’t constraints—agents optimize for “do the thing” 05:03 Lori’s agent reality: Copilot “agents” are chatbots with handcuffs 06:46 Kunal’s Copilot fail: Voice mode, no transcript, no draft 10:26 “Copy/paste your emails” — why inbox agents aren’t real yet 11:38 What we actually need: Boundaries (draft-only, queue deletes, etc.) 12:32 Pro tip: Save the old chat as a PDF to restore context 14:22 Kunal’s workaround: Isolated devices + local models + Tailscale 17:31 Core takeaway: Agents aren’t production-ready—use isolation 19:04 What’s real today: #AI apps in prod, agents mostly for employees 22:04 How much of AI usage is virtue signaling? Learn how you can stay ahead of the curve and keep your stack whole with additional insights on app security, multicloud, AI, and emerging tech: https://go.f5.net/bgry3nkt More about F5: https://go.f5.net/jygs00tc Read our blog: https://go.f5.net/bt18sent Follow us on LinkedIn: https://go.f5.net/cnd9pk1f

 72      3