Building an agent or a RAG is no longer the hard part
After shipping agents for large accounts and startups, the pain was not implementation. It was cost, permissions, and observability — especially access control.
Building an agent or a RAG is no longer the subject.
I have deployed them for large accounts and startups. The technical part is doable quickly by any developer.
I gave a post-mortem recently. Someone asked: "Honestly, what were your real difficulties?"
Not much on implementing agents or RAG technically. Everything on what sits around them.
The three hard layers
Costs and scale. For example Copilot changes its pricing grid, and you almost start missing the craft developers.
Permissions / access rights. Why does Micheline get access to submarine delivery contracts through a RAG agent? (Example chosen at random.)
Observability / guardrails. Who checks that the agent called the right tool? That it is not leaking secrets? That the request is authorised?
The hard part of enterprise AI is not building the agent — that is a few lines of code. It is everything around it.
We come back to classic problems. For me that is more proof that the subject is no longer the direct implementation, but which framework you put around it.
Of the three, rights are hell on earth. They expose a real organisational problem that cannot be solved by technique alone.
What is blocking you on your agents right now: costs, permissions, observability, or something else?