The Narrow-Waist Lesson: AI's Future Was Invented in 1974
Your CI pipeline says one thing, your security scanner says another, your compliance spreadsheet says a third, and the evidence that any of it is true lives in six different systems — most of which expire their logs before your next audit. Meanwhile your AI agents are writing code faster than any of those systems can keep up with. If you run an AI-first engineering org, this is the daily texture of your life: CI/CD, testing, security scanning, compliance, and evidence collection are fragmented, and the fragmentation gets worse every time you add a tool or an agent.
This is not a tooling problem you can buy your way out of one SaaS subscription at a time. It is an architecture problem, and it was solved once before — in 1974, for the internet.
The 1974 paper that designed the internet's middle
In 1974, Vint Cerf and Bob Kahn published "A Protocol for Packet Network Intercommunication" in IEEE Transactions on Communications 22(5) (doi.org). It is the paper that introduced what became TCP/IP, and its load-bearing design decision was not the packet format or the addressing scheme. It was the decision about what the middle of the network would refuse to assume.
The internet's middle layer knows how to do essentially one thing: deliver a packet from one address to another, best-effort, with no promises. It does not know what an application is. It does not know whether the bits are a bank transfer or a cat video. It does not know whether the underlying link is Ethernet, fiber, or a satellite hop. That ignorance is the feature. Because the middle assumes so little, anything can be built above it and any network technology can carry it from below. New applications arrived for fifty years without requiring changes to IP. New physical networks arrived without breaking the applications.
The internet scaled because its middle contract stayed small: many applications above, many networks below, one stable interface between them.
What the hourglass model actually claims
Micah Beck gave this shape its modern name and its modern analysis in "On the Hourglass Model," published in Communications of the ACM 62(7), July 2019 (doi.org). Beck's argument is worth stating carefully, because the hourglass is often cited as a vibe — "keep the middle thin" — when it is actually a claim about how complexity is allocated in a system that must grow at both ends.
In an hourglass architecture, the diversity of applications at the top and the diversity of substrates at the bottom are both unbounded and growing. The only way the system can absorb that growth without combinatorial explosion is a narrow waist: a minimal interface in the middle that both sides converge on. Every application does not need to know about every network; every network does not need to know about every application. Each side integrates with the waist once.
Beck's deeper point is that the waist is not merely small — it is stable, and its stability is what lets the two wide ends evolve independently and fast. The hourglass is not a diagram of simplicity. It is a diagram of where complexity is allowed to live: at the edges, never in the middle.
Now look at your engineering stack. CI systems, test runners, SAST and DAST scanners, SBOM generators, compliance frameworks, ticketing systems, deployment pipelines, and now half a dozen AI agents from different vendors. Today, most of these integrate point-to-point, or through dashboards that aggregate output without agreeing on what anything means. Every new tool is a new integration tax. Every new agent vendor is a new coordination tax. That is a system with no waist, and it behaves exactly the way Beck's model predicts: integration cost grows with the product of the two ends, not the sum.
The security half of the same lesson
One year after Cerf and Kahn, Jerome Saltzer and Michael Schroeder published "The Protection of Information in Computer Systems" in Proceedings of the IEEE 63(9), 1975 (web.mit.edu). It is the paper that codified the design principles every security engineer still works from: least privilege, fail-safe defaults, economy of mechanism, complete mediation, open design, separation of privilege, least common mechanism, psychological acceptability.
Read them as the security twin of the narrow-waist lesson. Economy of mechanism says keep the trusted part small enough to actually reason about. Complete mediation says every access crosses the check, not most accesses. Fail-safe defaults say a missing answer is a denial, not a pass. Saltzer and Schroeder were making the same structural argument Cerf and Kahn made: the part of the system everything depends on must be minimal, explicit, and impossible to route around.
This matters because the internet got the packet half of the lesson and skipped the protection half. The internet standardized packet delivery without solving identity, fraud, or trust — and we have spent five decades patching that omission with bolts-on. The agentic AI ecosystem is at the same fork right now, and it is choosing the same direction.
Connectivity is the easy half
The agent ecosystem is re-discovering the hourglass shape. The Model Context Protocol standardizes how a model-driven application reaches tools and context; the Agent2Agent protocol addresses communication between independent agents. These are genuine narrow waists for connectivity, and they are necessary.
But connectivity is the easy half. As of the 2026-07-28 revision, MCP's HTTP authorization framework is optional and OAuth 2.1-based. A2A 1.0 Agent Cards may be JWS-signed, and a verified signature can establish card integrity and provider origin — but signing is optional and is not a global agent identity system. What remains incompletely standardized is the hard list: delegated authority across agent chains, capability attenuation, work-item authority, policy inheritance, revocation, evidence provenance, replay protection, reputation, and end-to-end accountability from principal to agent to tool to outcome. A May 2026 arXiv v1 measurement snapshot found flaws across 119 testable real-world OAuth-enabled MCP servers — a snapshot, not a universal property of MCP deployments, but a signal about where the industry is placing its attention.
In other words: the protocols will connect your agents. They will not, by themselves, tell you what an agent was authorized to do, what it actually did, what evidence exists that the result was checked, or who signed off. If you adopt the connectivity layer and stop there, you get the internet's outcome: a wonderfully connected system with trust bolted on afterwards.
One evidence envelope, one coordination plane
Koinessa's position, argued in full in section 2.1 of the white paper, is that an AI-first engineering organization needs to own its own waist rather than wait for the industry to standardize the missing half. Concretely, that means two things.
First, one tool contract above the models. Koinessa exposes 366 registered tools behind one search contract (live). Agents from six vendors — Kimi, Claude, Grok, Codex, local Ollama, and Ollama Cloud — discover capability through that same local contract, whether they run on frontier cloud APIs or on customer-controlled compute. The waist has been exercised by an arrival, which is the real test of any hourglass: the sixth provider descriptor, Devin CLI, registered onto an existing transport kind with no new transport code — it reached the same tool contract through one configuration stanza. That is what a working narrow waist looks like operationally: a new edge plugs in without the middle changing.
Second, one evidence contract below the verification layer. Rather than letting CI, scanners, and compliance checks each emit their own report format into their own silo, every consequential action produces one evidence envelope. The evidence bundle for an agent-produced change binds the source revision, the agent session and model, the work authorization, the tool versions, the checks executed with their canonical states, the policy profile that interpreted them, the approvals, and the final artifact digest — one chain from intent to deployment. And the canonical states are fail-closed in the Saltzer and Schroeder sense: the verification model distinguishes PASS, FAIL, SKIPPED-NOT-APPLICABLE, INFRASTRUCTURE ERROR, TOOL MISSING, and EVIDENCE INVALID (live), so a missing scanner can never be misread as a clean scan. Fail-safe defaults, applied to pipelines.
The Devin case is instructive from the outside too. The vendor's own topology has "command execution, file edits, and repository access" running on machines the customer operates over outbound-only HTTPS while the agent loop stays in the vendor's cloud — and since 2026-07-31, its MCP tools execute from the vendor's servers rather than the session's machine. Whatever you think of that placement, it draws exactly the seam this post is about: capability discovery and organizational state meet at a boundary, and somebody owns it. The narrow-waist lesson says you should own it locally, on infrastructure you control, behind persistent shared memory — not rent it per vendor.
This is one instance of a broader pattern we keep finding in the systems literature — the seven lessons from fifty years of systems post walks through all of them, and the architecture overview shows how the evidence envelope and the coordination plane fit with the other components.
The takeaway
The fragmentation you feel across CI, testing, scanning, compliance, and evidence is not a purchasing failure. It is the predictable state of a system with no narrow waist — every new tool multiplies integrations, and every new agent multiplies coordination surfaces. Cerf and Kahn showed in 1974 that the fix is a minimal, stable middle contract; Beck showed that this is a general law of systems that must grow at both ends; Saltzer and Schroeder showed the middle must also fail closed and mediate completely. Agentic AI needs the same move, and the vendor protocols are only delivering the connectivity half.
The practical answer is to build the missing half yourself: one tool contract every agent discovers capability through, one evidence envelope every consequential action produces, one coordination plane every vendor plugs into — local-first, human-gated, fail-closed. The full argument, with the snapshot data and the complete reference trail, is in section 2 of the Koinessa white paper.