Autonomy Is Earned. Most Enterprise AI Agents Haven’t Earned It.

Matthew Oostveen has a specific term for the failure mode that keeps him up at night: “contextual amnesia.” And it’s not the one enterprises are preparing for.

Everyone worries about the AI agent that says something wrong. Oostveen, who is the vice president and chief technology officer for Asia Pacific and Japan of Everpure (formerly Pure Storage), worries about the one that hallucinates meetings that never happened, references identities that don’t exist, and constructs a coherent internal fiction that has quietly decoupled from the actual state of your business.

Not because the model is bad. Because there is no rock-solid, persistent data state anchoring it to reality. “Your AI agent isn’t the problem,” Oostveen says. “Your infrastructure is.”

The agent's amnesia problem

Before you can understand Oostveen’s argument, you need to understand what he calls contextual amnesia.

An agent makes a bad call. A human corrects it. The agent acknowledges the correction, nods its digital head, and then makes the exact same mistake twenty minutes later. Not because the model forgot. Because there’s no durable state layer to write the correction into. No persistent memory that survives context windows, session resets, or the next API call.

Multiply this across thousands of daily agent interactions, and you don’t get an intelligent system. You get an expensive one that repeats expensive mistakes on a loop.

The more unsettling failure mode is what Oostveen describes as long-running agents hallucinating not just words, but reality itself. They invent meetings. They reference colleagues who don’t exist. They construct a coherent internal fiction that has quietly decoupled from the business's actual state.

The fix is not a better model but a durable, queryable state.

The agent architecture CDOs should be building

Ask most platform teams where agent memory lives, and they’ll say: “the vector database.” Oostveen has a polite but firm response to that: you’re doing it wrong.

A vector store alone is a dumb cache. It holds semantic patterns without business context. An agent that retrieves from it might find the most relevant answer, but not the most economically defensible one. It will prioritize helpfulness over survival. It will give your customer a discount that it has no authority to give.

A sane memory hierarchy, Oostveen explains, looks more like this:

• Transactional stores that hold the “active mission” — the current operational truth, live system-of-record data, and the state an agent is actually operating against right now. This is where decisions get grounded.
• Vector systems manage the semantic library — patterns, historical interactions, and contextual embeddings that let agents adapt quickly across similar situations.

Critically, beneath everything sits an immutable audit log. Every autonomous decision an agent makes gets written here, with full decision lineage. It should include which data blocks were retrieved, which context drove the action, what the agent did and why. When an agent hallucinates an event, this log is how you prove it, reverse it, and make it learn from it.

Mixing operational and analytical loads on the same tier is a common anti-pattern Oostveen flags. So is ignoring data locality like feeding a latency-sensitive agent from a batch-oriented data lake. This is the architectural equivalent of asking a Formula 1 driver to navigate via a map printed last Tuesday. The GPU sits idle. The agent waits. Margins erode.

The fix Everpure reaches for here is a unified, high-concurrency flash layer. This is something architected to handle the “chatty” RAG patterns and rapid metadata queries that agents depend on.

Judgment is not just a model problem

Here’s the concern Oostveen is willing to say out loud: the model is not the primary source of an agent’s judgment; infrastructure is.

Data contracts define what an agent is allowed to see. Policy-as-code defines what it’s allowed to do. Observability layers expose whether it’s actually staying within those boundaries in real time. Together, these create what Oostveen calls the “procedural guardrails,” the infrastructure-encoded rules that shape agent behavior before the model even renders a decision.

What infrastructure cannot do is substitute for nuanced reasoning. When a situation falls outside the policy envelope, like when it's genuinely ambiguous, contextually complex, and requires ethical trade-offs, you’re back in the domain of model design, evaluation, and alignment. But that reasoning is only as good as the real-time feedback loops feeding it. A brilliant model operating on stale, low-quality data is not brilliant. It's confidently wrong.

The observability strategy matters as much as the model strategy. Log the decision lineage at the storage layer. Expose real-time “alignment scores” to SRE and risk teams — not as a post-mortem tool for assigning blame, but as a continuous signal for infrastructure tuning. When an agent drifts, you want to catch it in motion and not in the wreckage.

The surveillance time bomb

Context is the lifeblood of agent usefulness. Rich interaction history, transaction records, user preferences, etc. — these are what transform a generic LLM into something that feels like institutional memory. But it also hides a trap.

Build enough context, retain it long enough without governance, and you’ve constructed a surveillance dataset. This can be a regulatory time bomb ticking under your infrastructure. GDPR, PDPA, and other emerging AI liability frameworks do not forgive the enterprise that built an unbounded behavioral archive because its agents needed “more context.”

Oostveen has a prescription: design a deliberately “forgetful” tiering strategy. Retain high-level interaction history for agent continuity. Automatically purge or mask PII before it sediments into long-term storage. Give agents the wisdom they need without handing regulators the evidence they’re looking for.

The goal is context without surveillance. Continuity without liability. It requires intentional architecture — not something you retrofit after a data subject access request lands in your legal team’s inbox.

Autonomous brakes

Perhaps the most practical intervention Oostveen advocates sits at the data-plane level: autonomous brakes. Before any agent touches pricing, discounts, or operational levers, the infrastructure must enforce hard limits.

Rate limits on discount authority. Cost-aware retrieval filters that prevent an agent from taking an action whose downstream cost exceeds a defined threshold. Reinforcement signals that detect deviation from business objectives and override the agent before the error propagates.

An agent that’s “helpful” without these controls is a liability. Its instinct is to please. Your instinct, as a CDO or platform head, should be to constrain that instinct with architecture before it costs you margin you’ll never recover.

The readiness checklist

Before your organization grants an AI agent the authority to move money, change a product configuration, or update a customer record, Oostveen offers three non-negotiable boxes to tick:

• Objective alignment. Can the agent pursue the right business outcome (like profit, compliance, operational integrity) rather than simply optimizing for user satisfaction? If it can’t reliably choose margin over popularity, it doesn’t get operational authority.
• Durable state. Can it remember and learn from mistakes across sessions, context windows, and system restarts? If corrections evaporate at the end of a conversation, the agent isn’t learning. It is performing.
• Infrastructure resilience. Can the underlying storage and retrieval layer actually keep pace with the agent’s decision velocity? An agent is only as fast as its slowest data retrieval. An agent is only as reliable as the persistence layer beneath it.

“Autonomy without these foundations isn’t a strategy,” Oostveen says flatly. “It’s just a fast way to lose money.”

Image credit: iStockphoto/Deklofenak