Horizontal to adopt. Vertical in what it builds.
QuantumBlack, AI by McKinsey, names a structural imbalance behind the gen AI paradox: horizontal solutions are easy to deploy but sit loosely on top of core business processes, which limits their value
, while vertical, workflow-embedded applications can be genuinely transformative
and are the hard ones to scale.
Boundlane does not pick a side of that trade. It is horizontal in distribution — anyone across five enterprise functions describes a process in plain language, which is below low-code rather than above it. It is vertical in output — what comes out is built against that system’s real schema and governed by that function’s own approval roles and forbidden actions.
An independent reading of a published reference architecture. Not an endorsement, a partnership or an affiliation — see the attribution at the foot of this page.
Where an agent, a workflow or a tool is found and installed.
An automation carries its own agent nodes, model and prompts inside the package it ships as.
Boundlane Exchange: submission, automated review, a human decision with separation of duties, publication.
58 catalogued business verbs, each carrying its own effect, risk tier and reversal.
The four archetypes an enterprise buys or builds.
Five domain packs, and an interface below low-code: a person describes the process in plain language. Business-process automation, not personal productivity.
Developers building on lower-level frameworks and libraries. Boundlane is not a framework and does not replace one.
Designed against the tenant's real schema, with live values probed from their system and a per-tenant skill library read before designing.
A package is a deterministic workflow whose nodes may be agents. Arithmetic runs in tools; judgement is used only where judgement is needed.
Where an agent actually executes.
Durable execution, sandboxed tool calls, per-tenant credentials and data. One runtime among the several an enterprise will run.
Boundlane is a runtime; it is not a replacement for the ones an enterprise already operates.
How anything reaches anything else.
10 vendor systems, generic REST, GraphQL and SQL, and connectors a tenant defines by probing its own API. Every call passes an explicit egress allowlist.
Remote Streamable HTTP, JSON-RPC over the egress-guarded fetch. The binding pins a digest over the tool set; drift is refused.
All model traffic through a zero-retention gateway, with a deterministic per-turn router that records its choice and its price.
The same dispatcher and the same allowlist, enforced on redirects as well as the first request. There is no path around it.
Inbound: a Boundlane automation invocable by another agent, with an Agent Card generated from gate evidence rather than self-asserted. Designed. Not built.
What every agentic system above needs and rarely arrives with.
Versioned Automation Packages, pinned by hash; Boundlane Exchange for discovery and install.
The 58-verb action catalogue, plus tenant-authored connector definitions validated the same way.
Hash-chained append-only audit with external anchoring, full run traces, a receipt opened before every external write.
The promotion gate, the shadow stage, and backtests that replay a candidate against every past run.
OIDC, SAML and SCIM — with business roles kept deliberately distinct from directory groups.
Run history analysed into findings the build agent reads, evals derived from real runs, feedback per run. It changes the package, not the weights.
The policy dispatcher, forbidden actions that never execute in any stage, risk tiers, staged rollout.
What the platform stands on.
Boundlane runs on it and does not attempt to be it.
Where the business data already lives.
Boundlane connects to them, reads their real schema and writes back under policy. It is not a system of record and holds no master data.
Spans every layer above rather than sitting in one.
A hash-chained trail whose head can be published outside the platform, and an evidence pack assembled live from the running system.
PII redacted when recording rather than when displaying, tenant-scoped erasure, a published DPA and subprocessor list.
The model proposes; it never authorises. Forbidden verbs are absent rather than gated, and consequential writes wait for a person.
Shadow runs and backtests produce the evidence a stage advance is argued from, and the argument is recorded with the decision.
Three of the four archetypes. The fourth is somebody else’s.
The reference architecture splits agentic systems into four kinds and defines each one. Boundlane answers three of those definitions. It does not answer the fourth, and pretending otherwise would be the fastest way to fail the review this page exists to survive.
Enterprise productivity agents
Boundlane builds thisHorizontal applications with low-code interfaces bringing AI agents and workflow automation to the broader organization.
Boundlane is horizontal: five domain packs ship today — finance, HR operations, IT operations, customer support and revenue operations — and the interface is conversational, which is a rung below low-code. A person describes the process in plain language; nobody assembles nodes on a canvas.
One boundary, stated rather than blurred: this is business-process automation for the organisation, not personal productivity. It does not summarise your inbox or draft your email. It answers the workflow half of this box and not the personal-copilot half.
Highly custom agents
Not BoundlaneAgents built on lower-level software frameworks & libraries that provide developers control and customization to solve the most complex problems.
Not us. That box is developers building on frameworks and libraries, and Boundlane is neither a framework nor a replacement for one. Generated code does exist inside a package — it may compute anything — but it acts only through injected, declared capabilities, which is the opposite of the unconstrained control this archetype is defined by.
Purpose-fit agents
Boundlane builds thisPre-built and custom agentic capabilities, with tight integration into the application's core functionality and tailored based on domain expertise.
Each domain pack carries that function's own approval roles and its own list of actions an automation may never take. Every automation is designed against the tenant's real schema, with live picklist values probed from their system rather than assumed, and a per-tenant skill library the build agent reads before it designs anything.
Workflow automation
Boundlane builds thisSolutions focus on process automation with determined workflows but can increasingly invoke agentic capabilities as optional step.
The closest literal match in the whole diagram. A Boundlane package is a deterministic workflow whose nodes may be agents. Arithmetic is forced into deterministic tools rather than left to the model — the promotion gate refuses a limit that no rule tool reads, on the grounds that whatever is comparing against it must then be the prompt — and judgement is used only where judgement is genuinely needed.
Every way in, through one dispatcher.
The interfaces row is where a composable platform either holds together or does not. Boundlane runs all four of its boxes, and they converge: whichever one a call arrives through, the same policy dispatcher decides whether it executes and the same allowlist decides where it may go.
Catalogued verbs across 10 vendor systems, generic REST, GraphQL and SQL for everything else, and connectors a tenant authors itself: the build agent probes an unknown API, declares it, proves the declaration against the real system and binds it. A tenant-authored connector is a declaration rather than generated code, so the egress allowlist, the credential vault and the risk tiers all still apply, and the same validator that checks the first-party catalogue checks theirs.
A first-class connection category. Remote Streamable HTTP, JSON-RPC over the egress-guarded fetch. Every MCP tool is classified by the platform as a write at high risk until a person declares otherwise — MCP carries no effect or risk of its own, and its specification says a client must not rely on the server’s hints for security decisions.
All model traffic goes through a zero-retention AI gateway; an enterprise on the silo tier can bring its own model endpoint instead. Model choice is deterministic by default and routed per turn when a workspace opts in, with the decision, its reason and its price recorded next to the automation it designed.
The escape hatch every architecture needs, and the place governance usually leaks. Here it does not: a direct call is still a declared tool, still dispatched through the policy layer, and still bounded by an explicit egress allowlist enforced across redirects as well as on the first request. Private and cloud-metadata addresses are refused whatever the allowlist says.
Most vendors sell you a box in the row above.
Then you assemble the layer underneath it yourself — registry, observability, evaluation, identity, feedback, control — and integrate it across however many agentic systems you end up owning. Boundlane produces systems in that row and is the shared-services layer they run on. Seven boxes, and what answers each one.
Versioned Automation Packages are the unit: agent, workflow, tools, rules, pages and policy in one object, pinned by hash at promotion and refused at runtime if the bytes changed. Boundlane Exchange is where they are found and installed.
A catalogue of 58 business verbs across the connected systems, each carrying its own effect, risk tier and reversal — judgement that no vendor reference page states, because none of them says whether an operation moves money. The build agent searches it by intent.
A hash-chained append-only audit trail whose head can be anchored outside the platform, so a rewrite is provable rather than merely discouraged. Full run traces down to each tool call and each policy decision. A receipt is opened before every external write and settled after it, so a run that dies mid-effect leaves evidence instead of ambiguity.
The promotion gate — static analysis and a capability diff — decides whether a version may advance. Shadow runs answer what it would do, forward. Backtesting answers the half history already knows, replaying a candidate against every past run and listing the cases where it now decides differently. It deliberately emits no score: agreeing with history everywhere means correct or identically wrong, and only the disagreements tell those apart.
OIDC with PKCE, SAML, and SCIM 2.0 for provisioning. Business roles are kept deliberately distinct from directory groups: who may approve a payment is not the same question as which group somebody is in, and it is enforced against the audit trail rather than asserted by a directory. Four-eyes approval, with one decision only when two reviewers race.
Run history is analysed into findings a person reads on the automation page and the build agent reads before it redesigns. Evals are derived from real runs, end users leave feedback per run, and cross-automation consistency makes the builder reuse a rule rather than invent a second one. What the loop changes is the package, not the model weights — Boundlane does no fine-tuning and does not train on tenant data.
The policy dispatcher is consulted before the toolbox, so the model can propose an action but never authorise one. Forbidden actions never execute in any rollout stage, including general availability, and no approval or administrator can override them. Risk tiers, staged rollout, per-tenant rate limits and a kill switch.
The evidence pack an auditor asks for on day one, assembled live from the running system rather than transcribed — absences included, and it attests nothing in its own words.
PII redacted when recording rather than when displaying, row-level tenant isolation enforced by the database, erasure enumerated from the live schema, a published DPA and subprocessor list.
Consequential actions wait for a named human role with an SLA, and a breached deadline escalates rather than passing unremarked. A refusal is written to the trail, so a blocked attempt is evidence.
Nothing reaches production on day one. An advance is gated on the runs, the passing evals and the open exceptions already recorded, and a refusal returns every reason it failed rather than the first. Rollback is immediate.
This is what design for production from the start
actually costs. The article’s own diagnosis of why initiatives stall is that most initiatives get stuck at the PoC stage, or require major rework because their production requirements are treated as an after-thought
. Evaluation, audit, policy and approvals are precisely the requirements that cannot be added afterwards — an audit trail retrofitted onto a system that already ran is a log, and an approval added after launch is a meeting.
In Boundlane they are the substrate the automations are built on. An automation cannot be promoted without passing the gate, cannot reach production without producing shadow evidence first, and cannot execute a forbidden action in any stage, including general availability. Those are not settings.
Four capabilities the architecture says you need on day one.
Three of them Boundlane ships. The fourth it answers with something adjacent, and the difference is worth stating precisely rather than letting a shared word do the work.
Agentic evaluation
ShippedThe promotion gate, the shadow stage where a version records what it would have done and touches nothing, evals derived from real runs, and backtesting against every past run. A version cannot go live until it passes.
Marketplaces
ShippedBoundlane Exchange: submission, automated review, a human decision with separation of duties, and publication into the same catalogue the first-party templates come from. Installing one copies the whole package — and the publisher’s egress allowlist does not come with it.
Feedback mechanisms
ShippedRun history analysed into findings that a person reads on the automation page and the build agent reads before it redesigns. Evals derived from real runs. Feedback captured per run, from the people the run actually affected.
Memory management
Adjacent, not the sameBoundlane has state tables — what a run writes and later runs read, which is how a chase lifecycle or a claim marker survives between executions — and config tables an operator edits without a rebuild. Both are validated per row and attributed to the writing run.
That is process memory, and it is not the same thing. The architecture describes a short-term and long-term memory framework for conversational agents; Boundlane does not have one and this should not be read as having answered it.
MCP is shipped. A2A is designed and not built.
Being relentlessly protocol-focused is the first of the architecture’s three principles, and it is the one where a vendor is most tempted to describe an intention as a capability. So: one of these two runs today and one does not.
MCP — shipped
A first-class connection category, not an adapter. Remote Streamable HTTP only — the stdio transport would mean running a tenant’s chosen subprocess on pooled infrastructure, and there is no setting that turns it on. JSON-RPC over the same egress-guarded fetch every other connector uses.
- Every MCP tool is classified by the platform as a write at high risk until a person declares otherwise
- A server’s own annotations are recorded as evidence a person can read, never as an input that downgrades a risk tier
- The binding pins a digest over the tool set; a call against a server whose tools no longer hash to it is refused rather than made
- The gate refuses a promoted package whose MCP binding carries no digest at all
- Tool descriptions are third-party text and arrive in the build agent’s context already quarantined
A2A — designed, not built
The reference architecture puts agent-to-agent interoperability on every archetype, so saying nothing about it would read as a gap. It is not built. What is settled is the shape: inbound only to begin with — a Boundlane automation invocable by another agent — with the same admission control, the same policy dispatcher and the same audit trail that a webhook trigger already goes through.
The part worth designing carefully is the Agent Card. An agent describing its own capabilities is a self-assertion, and this platform already produces something better: the promotion gate’s evidence states what an automation may touch, at what risk, with which approvals. The card should be generated from that rather than written beside it. Until it is generated, there is no card.
What Boundlane is not.
Four layers of the diagram are not ours. A platform that claimed all of them would be claiming to replace an enterprise’s cloud, its systems of record and its developers, which is not a composable architecture — it is the thing composability exists to avoid.
Developer frameworks and libraries for the most complex bespoke problems. Boundlane is not one and does not replace one.
Boundlane Control is a runtime; it is not the runtime. An enterprise will operate several, and a platform claiming to replace the hyperscalers’ is claiming something an architect will disprove in the first meeting.
Compute, foundational models, data processing, data catalogue, networking, MLOps. Boundlane runs on this layer and makes no claim to be it.
Boundlane connects to systems of record, reads their real schema and writes back under policy. It is not a system of record, holds no master data, and an automation that stops working leaves the underlying system exactly as it was.
Bring the architecture review.
Every box marked as ours on this page is visible in the product. Open a run and read what the dispatcher did with each call, then decide whether the diagram matches.
The reference architecture read on this page is Creating a future-proof enterprise agentic platform architecture, published by QuantumBlack, AI by McKinsey. The article, its diagram and the framing of the gen AI paradox are the authors’ work and remain their copyright. Short quotations above are theirs and are marked as quotations.
This page is an independent reading of that published work by Boundlane. It is not an endorsement, a partnership, an affiliation or a joint publication, and nothing here should be read as McKinsey or QuantumBlack assessing, recommending or validating Boundlane. Their diagram is not reproduced, embedded or re-drawn here; the visual above is our own drawing, and the layer names it uses are the ordinary descriptive vocabulary of platform architecture.
McKinsey & Company and QuantumBlack are trademarks of their respective owners. No logos, branding or colours of theirs appear on this page.