AI Agent Architect
Your AI agent can take action. Can you control what happens next?
I design, build and harden AI agents and workflows that interact with real systems—company data, internal tools, customer communications, code and transactions. My work starts where the demo stops.
Where the demo ends, my work starts
Most AI agents don't fail because the model can't produce an answer. They fail when that answer becomes a real action without the right permissions, evidence, approval or recovery path.
An agent that drafts an answer is one thing. An agent that can email a customer, update a CRM, modify code, approve a workflow, expose company data or trigger a transaction is a different engineering problem. Once agents can act, architecture matters—and these are the five questions I ask first.
What can the agent actually do?
Not what the prompt says it should do—what the tools, credentials and scopes let it do on a bad day.
Which inputs can it trust, and which instructions are authorised?
Retrieved documents, tool outputs and user messages all arrive as text. Very little of it is authorised instruction.
Where must a human approve?
Some actions should never execute on a model's confidence alone. The boundary has to be designed, not hoped for.
What happens when a tool call is wrong, duplicated or manipulated?
Retries, partial failures and injected instructions are normal operating conditions, not edge cases.
Can the action be traced, contained, reversed or replayed?
After the fact, someone has to answer what happened, on whose authority, and how it gets undone.
What I Work On
Python and API-first, framework-agnostic, and centred on the operational consequences of agent actions—not just the quality of model outputs.
Architecture
How agents reason, delegate, call tools and interact with the systems you already run.
Workflows
Turning an operational process into a reliable division of labour between people and agents.
Control
Permissions, action boundaries and the approval gates that stand between a plan and a side effect.
Reliability
Failure handling, idempotency, containment and recovery for when a tool call goes wrong.
Governance
Intent, provenance, evidence and auditability—so an action can be explained after execution.
How I Can Help
Four ways to bring an agent from prototype to something you can actually operate.
Production Agent Review
You already have an agent. I assess its architecture, action boundaries, permissions, failure modes, human handoffs and production risks, then hand you a practical remediation plan.
Agent Reliability & Control Sprint
A bounded implementation engagement. We take one consequential workflow and redesign, repair or build it so it can be tested, operated and maintained.
Agent & Workflow Architecture
Design a new agentic system around the actual business process: what people do, what agents do, what they can reach, and how consequential actions are bounded.
Fractional AI Agent Architect
Ongoing architecture and technical guidance for teams building agent capability without hiring a full-time specialist.
Open-Source Protocols & Tools
I build the infrastructure behind the ideas I work on with clients. Each project takes on a different part of the production-agent problem: how consequential actions are governed, how computation stays deterministic and auditable, and how unsafe changes get recovered.
PIC Standard
Provenance & Intent Contracts for AI Agents
An Apache-2.0, local-first, vendor-neutral standard for governing high-impact agent actions at the moment of execution. PIC requires an agent to declare its intent, impact, provenance, claims, evidence and proposed action before a consequential side effect occurs. The verifier checks whether the action is justified and fails closed when the required proof is missing or invalid. Integrations for LangGraph, MCP, OpenClaw and Cordum.
NCP
Deterministic execution for agent workflows
Not every step in an agent workflow needs a model. Neural Computation Protocol runs validation, routing and extraction as deterministic, sandboxed WASM units with no filesystem, network or ambient authority, and escalates to an expensive model call only when the work genuinely requires one. Every run stays auditable and replayable.
VibeRevert
Rollback and safety for AI coding agents
Checkpoints a project's pre-session state, including uncommitted work, then flags edits that touch payments, auth, databases, secrets or infrastructure. Risk findings are rule-based and inspectable, so no AI is judging the AI.
Writing
I write about agent security and production AI systems.
AI agents are a confused deputy with the keys to your kingdom
An LLM agent is a confused deputy by construction. Its interface is natural language, which carries no notion of who is authorised to do what, and the model's whole job is to turn a plausible-sounding sentence into a tool call. The article walks through what that means for systems that already hold real credentials.
Newsletter
Notes on agent architecture, control and things that broke in production.
Client: Wallafan.com — Content creator monetization platform (Microsoft for Startups | NVIDIA Inception)
Case Study: An agent allowed to speak, but not to publish
Posting publicly under a client's name is a consequential action: it is immediate, attributable and effectively irreversible. So the agent was never given the ability to do it.
The Trust Boundary
I built an engagement agent for the client's X workflow. The boundary was drawn at the architecture level, not bolted on afterwards. The agent was authorised to reason and propose:
- •Discover emerging trends relevant to the brand
- •Select candidate posts and state why each one qualified
- •Draft a reply and recommend a specific action
It held no posting credential. Publication stayed with a human, who reviewed a plan in which every proposed action arrived with the reasoning that produced it. The agent could be wrong without the client being wrong in public.
Client-reported X analytics over the first two weeks of operation.
Proposal Sample
What the human actually approved. Each entry names the trend, cites the real post it responds to, states why the agent judged it worth engaging, and proposes a specific action. That last part is the point: an action arriving without its justification is an action nobody can review.
Proposed Reply:
"Those dogs know the feeling! Crazy how tiny the payout is when our data's been the main course for years."
Stated Reasoning
Playful post about the Facebook privacy settlement uses hot dogs and a Pepsi to telegraph a small payout. Resonates with creators who have been exploited by platforms.
Proposed Reply:
"That's barely enough for coffee... and doesn't come close to compensating for years of data mining. Creators deserve better deals than this."
Stated Reasoning
Vents about the paltry payout from the Facebook settlement. It's authentic and relatable to anyone who filled out the claim.
💡 Proposed Original Post
"A reminder: the real payout is owning your audience, not renting it from big platforms. #FacebookSettlement #CreatorRights"
Why this one worked
Not because the model was clever, but because the action boundary was decided before the build. The agent got autonomy over judgement and none over execution. Many agent failures reduce to the same decision, made the other way round.
Where Actions Land
Agents rarely fail in isolation. They fail in the systems they are allowed to touch—each one with its own blast radius.
Notion
Internal knowledge & docs
Slack
Internal comms
HubSpot
Customer records
Salesforce
Pipeline & contracts
X (Twitter)
Public communication
Gmail
Outbound to customers
About Fabio
AI Agent Architect. I make production agents controllable, auditable and safer to operate.
Greater Tarragona Area — working with teams across Europe and beyond
"I help product, engineering and operations teams design, review and harden AI agents that interact with real systems: company data, internal tools, customer communications, code, payments and operational workflows. My approach is Python and API-first, framework-agnostic, and centred on the operational consequences of agent actions rather than the quality of model outputs alone. Where appropriate, systems are deployed using the client's own accounts, infrastructure and data controls, to reduce lock-in and preserve operational ownership."
Who I Work With
Product, engineering and operations teams building, deploying or hardening AI agents that interact with real systems—especially when those agents can send, publish, modify, execute, expose data or trigger a transaction.
Engagements range from production-readiness reviews and workflow rescue to bounded implementation sprints and fractional architecture.
Creator of PIC Standard
Protocol and threat-model design, Python reference implementation, schemas, cryptographic evidence verification and conformance assets
Founder & Product Architect
Built Wallafan end to end: product strategy, architecture, full-stack development and payment integrations
CEO at MadeInPluto since 2014
More than a decade of shipping and operating software before the agent era, from Tarragona, Catalonia
Expertise
Principles
Fail closed on consequential actions: when the required proof is missing or invalid, the action does not execute.
Framework-agnostic: the architecture outlives whichever model or SDK is current this quarter.
Operational ownership: your accounts, your infrastructure, your data controls, no lock-in.
Send Me the Workflow
Send me the workflow and the action you are least comfortable letting the agent take. I will tell you where I would inspect first.
Book a Call
Bring a real workflow
20 minutes, no deck
Connect with me
Agent architecture & security notes
Subscribe to my newsletter
Stay updated
Notes on production agent systems
Based in Greater Tarragona, working remotely
I work with founder-led product teams, software companies and technical service businesses across Europe and beyond. Remote by default; on-site where an implementation genuinely needs it.