Stockholm MLOps Fall Bash #38: The Agent Era Is Becoming an Infrastructure Era
Stockholm, Sweden | August 20, 2026 | IBM Stockholm
Insights by Stockholm MLOps
“The person authorizes the agent to act as them.”
— Fredrik Warfvinge, HashiCorp
That sentence captured one of the biggest changes happening in AI.
For the past few years, most of the industry has been obsessed with what models can do. Can they reason? Can they write code? Can they use tools? Can they understand images? Can they plan?
At Stockholm MLOps #38, those questions felt increasingly downstream from the real problem.
Once AI stops being something you prompt and starts becoming something that remembers, plans, acts, accesses systems, modifies software, runs locally or interacts with hardware, the model is no longer the system.
The difficult part becomes everything around it.
How does an agent authenticate? What is it allowed to do? Who gave it that authority? What should it remember? What should it forget? Where should inference happen? How do we know generated software actually works? What happens when an agent drifts away from its intended purpose?
Across seven very different presentations, the same architecture slowly appeared.
Identity. Memory. Authorization. Local inference. Verification. Domain knowledge. Human approval. Physical feedback.
The strongest signal from Stockholm MLOps #38 was therefore not simply that agents are becoming more capable.
The agent era is becoming an infrastructure era.
Summary: Key Insights From the Event
AI is moving from prompting toward delegation. As soon as we delegate work rather than request answers, identity, permissions and accountability become infrastructure problems.
Agents are becoming operational identities. Static API keys designed for applications look increasingly inadequate for autonomous systems that act on behalf of humans.
Memory and context are separating into different architectural layers. Persistent AI needs mechanisms for remembering, forgetting, sharing state and controlling what survives.
Local inference is becoming a genuine production architecture. Running models directly on phones and laptops changes assumptions about latency, privacy, infrastructure cost and sovereignty.
AI generation is accelerating faster than verification. As agents create software faster, production systems need equally scalable ways of proving that what they create actually works.
And across almost every talk, the moat was moving away from raw model capability toward domain knowledge, context, workflows and the infrastructure surrounding the model.
What This Event Was Really About
A year or two ago, an AI infrastructure event could revolve around model selection, prompt engineering, RAG, benchmarks and context windows.
Stockholm MLOps #38 felt noticeably further along.
The speakers largely accepted capable models as a given. Their problems began after the model became capable.
Fredrik Warfvinge from HashiCorp exposed the security consequence. An agent acting on behalf of a person is fundamentally different from an application making an API request. If Alice asks an agent to access Bob's resources, the system may eventually need to establish which person delegated which authority to which agent for which specific action.
“This allows you to see in the audit logs exactly who authorized the bot or the agent to fetch which information.”
— Fredrik Warfvinge, HashiCorp
And when the action becomes sensitive, simply knowing the identity of the agent is not enough.
“The AI agent realizes, I need to escalate my privileges outside of the agent.”
— Fredrik Warfvinge, HashiCorp
HashiCorp demonstrated a system in which that escalation could trigger explicit human approval and create a credential for the approved action.
“Vault would mint a one-time-only credential for the agent to do this one specific action essentially.”
— Fredrik Warfvinge, HashiCorp
That is a radically different security model from giving an application a powerful API key and hoping it behaves.
Mattias Ask from Squidler approached the same transition from the human side.
If everyone has access to increasingly similar foundation models, what makes your AI different from mine?
His answer was not a better prompt.
It was you.
“You are what makes AI great. Your opinion, your taste, your experience, that's really what matters.”
— Mattias Ask, Squidler
A persistent agent accumulates context about the person it works for. It develops memory, plans work and continues operating beyond an individual conversation.
“If we're not providing our own personal context into the AI, it's going to be very generic.”
— Mattias Ask, Squidler
That immediately creates another infrastructure problem: memory.
Johannes Sommer from Semvec attacked one of the assumptions emerging around long context windows.
“LLMs do not remember, like they carry around the context, and this comes with certain problems.”
— Johannes Sommer, Semvec
A context window tells a model what it can inspect right now. A memory system has to decide what persists, what matters, what can disappear and what should be available later.
And Semvec introduced a particularly interesting idea:
“It selectively forgets.”
— Johannes Sommer, Semvec
That sounds counterintuitive in an industry obsessed with bigger context windows and storing everything. But forgetting may actually become a feature.
Persistent agents cannot accumulate everything forever. Cost increases, relevance deteriorates and retention itself can become a governance problem. A mature memory architecture may therefore be defined as much by what it intentionally forgets as by what it remembers.
Then Seto Elkahfi from Onde Inference changed another assumption entirely.
Why should inference automatically happen in a data center?
“The mission is to free the intelligence from the data center.”
— Seto Elkahfi, Onde Inference
Seto demonstrated inference directly on an offline iPhone. Model weights were loaded into the device's memory and inference happened without a trip to a cloud provider.
That changes several things simultaneously.
Sensitive information can remain on the device. Products can continue operating without connectivity. Network round trips disappear. And instead of the provider paying for every inference call, some computation happens on hardware the customer already owns.
“Zero latency meaning that you don't have the cloud round trip to OpenAI or Anthropic server.”
— Seto Elkahfi, Onde Inference
“And zero cost. It's your user's device pretty much.”
— Seto Elkahfi, Onde Inference
The cloud does not disappear. But it becomes one execution environment among several.
And then Adam Dunkels from Groundrun brought the entire conversation back to physical reality.
“Building connected products is hard. It's really, really hard, and especially making them good.”
— Adam Dunkels, Groundrun
Coding agents can generate software extraordinarily quickly. But connected products span firmware, radios, apps, backends, sensors and physical devices. Those systems eventually have to work somewhere models cannot bluff their way through: reality.
Groundrun's answer was beautifully simple.
“We put hardware in the loop.”
— Adam Dunkels, Groundrun
An agent can generate engineering work, execute it on the physical device, observe what actually happens and continue from the result.
That turns hardware into a truth layer.
“We can be infinitely fast and wrong, of course.”
— Adam Dunkels, Groundrun
That may be one of the most important production AI lessons from the evening.
Generation without verification just allows us to be wrong faster.
Key Insights From Stockholm MLOps #38
1. Agents Need Identities, Not Just API Keys
Applications traditionally authenticate as applications.
Agents complicate that model because an agent may be acting for someone else.
HashiCorp's presentation showed what this starts to look like operationally. An agent can operate with limited delegated authority, recognize when an action exceeds that authority, request additional human consent and receive a short-lived credential specifically for the approved action.
“Here, you need to give specific consent for that one approval.”
— Fredrik Warfvinge, HashiCorp
This is important because autonomous systems are non-deterministic.
“Your AI agents will have non-deterministic behavior.”
— Fredrik Warfvinge, HashiCorp
Giving a non-deterministic actor permanent powerful credentials is fundamentally different from giving them to a tightly bounded deterministic service.
The emerging production pattern looks more like minimal standing privilege, contextual escalation, explicit consent and short-lived authorization.
Human approval also becomes stronger when it exists inside the infrastructure itself rather than inside a prompt telling the agent to ask first.
The broader signal is significant: agents are becoming a new class of enterprise identity.
2. AI Is Moving From Prompting to Delegation
There is an enormous difference between asking an AI to answer a question and giving an AI responsibility for an outcome.
Squidler demonstrated agents that remember, plan, schedule and continue working. The summer job example was particularly revealing because the agent did not simply respond with instructions. It devised a mechanism for keeping the result current and scheduled future work itself.
Mattias described the value as the combination of reasoning with the systems surrounding it.
“It's when you get the creativity of the reasoning model combined with all the features and functionalities that you can put on top of that.”
— Mattias Ask, Squidler
HashiCorp showed the other side of the same transition.
Once AI is delegated responsibility, someone must also determine its authority.
A prompt can produce a bad answer. A delegated agent can alter data, access a system, change software, initiate a transaction or trigger another business process.
That means the industry is moving from asking only “How good was the answer?” toward asking “Who gave this system the authority to act?”
3. Memory Is Becoming Agent Infrastructure
Persistent agents need continuity.
But continuity cannot simply mean attaching every previous interaction to every future prompt.
Semvec argued that token consumption grows as conversation history accumulates and that quality can deteriorate as context becomes larger.
“The quality tends to decrease with a growing context windows.”
— Johannes Sommer, Semvec
Its approach is instead built around a fixed-size state that can evolve while maintaining a constant footprint.
That also opens a second possibility: shared memory.
“You can share the state across multiple agents.”
— Johannes Sommer, Semvec
Once state is shared between agents, memory stops being merely personalization. It becomes coordination infrastructure.
And Semvec connected memory to governance through drift detection.
“If an agent goes off board... we can set a negative vector and re-anchor that agent back to its original task.”
— Johannes Sommer, Semvec
The agent infrastructure problem therefore expands again.
Production teams may eventually need to manage not only models and prompts, but persistent state, retention, forgetting, shared memory and behavioral drift.
4. Local Inference Is Becoming an Architectural Choice
Onde Inference made perhaps the clearest sovereignty argument of the evening without needing to turn sovereignty into a political argument.
If useful inference can happen directly on the device, then some data simply does not need to leave the device.
That changes privacy.
It changes latency.
It changes availability.
It changes infrastructure economics.
And it changes control.
“The app does, it just loads all those weights to the memory of iPhone and then do the inference directly without the internet or going to the cloud.”
— Seto Elkahfi, Onde Inference
Seto also pushed the idea much further.
Billions of phones and computers already exist. They represent an enormous installed base of computing capacity.
“Think if, imagine if you have data centers spread across all over Earth and then you just do the inference on those billion devices.”
— Seto Elkahfi, Onde Inference
The implication is not that phones replace data centers.
It is that execution location is becoming a design variable.
Training may happen on large centralized infrastructure. Frontier reasoning may remain in the cloud. Sensitive inference may happen locally. Memory may live somewhere else.
The future architecture is not necessarily cloud versus edge.
It is deciding which part of the AI lifecycle belongs where.
5. Generation Is Accelerating Faster Than Verification
Groundrun exposed an uncomfortable asymmetry.
“Things that would take months, years to do is now compressed to just a few days.”
— Adam Dunkels, Groundrun
That sounds entirely positive until the next question:
Can we verify it equally quickly?
Connected products are especially unforgiving because software eventually meets physical systems. A generated implementation can look perfectly reasonable and still fail on the device.
Groundrun therefore puts the device inside the development loop.
The surprising result was not simply that AI could generate new code. Machine-driven testing could also expose weaknesses in existing human-written systems.
“The user flows usually starts to fail because the hand-coded systems have not been tested so thoroughly as we can do with a machine.”
— Adam Dunkels, Groundrun
This points toward a much larger AI infrastructure category.
As generation becomes cheap and fast, proof becomes scarce and valuable.
The next major bottleneck may not be creating more software, content or decisions.
It may be proving that what AI created is correct.
6. Production AI Needs Something Outside the Model
Groundrun used hardware.
HashiCorp used identity infrastructure and explicit human consent.
ForgeU started with actual learner goals rather than assuming the existing educational structure was correct.
Lozd started with customer validation before product development.
These look like unrelated ideas, but they share an important principle.
The model cannot be its own source of truth.
Dr. Egui Zhu made this visible from a completely different perspective.
“Every technology has its own function. But the school system developer or institute just copy the older structure to the new technology.”
— Dr. Egui Zhu, ForgeU
Simply inserting AI into an inherited workflow does not necessarily improve the workflow.
ForgeU instead starts from the individual.
“Everyone has their own goal, own path.”
— Dr. Egui Zhu, ForgeU
That idea extends far beyond education.
AI-native product design may increasingly begin with an outcome and dynamically organize the path toward it, rather than simply adding an assistant to an interface inherited from pre-AI software.
7. Domain Knowledge Is Moving Into the Harness Around the Model
Groundrun discovered that some of the knowledge its agents needed simply was not available in model training data.
“The training data was not there. It was in the heads and minds of the people that built these products.”
— Adam Dunkels, Groundrun
That is an important corrective to the assumption that larger general models eventually eliminate the need for specialist systems.
Groundrun responded by putting accumulated engineering knowledge into the environment surrounding the coding agent.
Squidler adds personal context around a general model. ForgeU adds a learner's goals and skill structure. Semvec adds persistent memory. HashiCorp adds authority and identity.
The pattern is consistent.
As model capability becomes broadly available, differentiation increasingly comes from what surrounds the model.
Domain knowledge. Context. Memory. Permissions. Tools. Feedback. Workflows.
The moat is moving outward.
Ahmad 8. Faster AI Makes Building the Wrong Thing Easier
Mudhar from Lozd provided an important counterweight to all the technical acceleration.
“Don't start with digital, because you're gonna be in a loop developing, developing.”
— Ahmad Mudhar, Lozd
Generative AI has dramatically reduced the cost and time required to create software.
But that does not eliminate customer discovery.
It arguably makes it more important.
“You need to verify with the customers as soon as possible.”
— Ahmad Mudhar, Lozd
The danger is straightforward. If building becomes easier, teams can become emotionally and technically invested in an unvalidated solution much faster than before.
“You don't become in love with what you are building and then you just try to convince them.”
— Ahmad Mudhar, Lozd
AI has accelerated production.
It has not automated away the need to understand the problem.
The Agent Stack Is Forming
One of the most interesting things about #38 only becomes visible when the presentations are placed next to each other.
HashiCorp was talking about identity and authorization.
Squidler was talking about persistent personal agents.
Semvec was talking about memory and state.
Onde Inference was talking about execution.
Groundrun was talking about verification.
ForgeU was talking about AI-native workflow design.
None of them presented this as a common architecture.
But collectively, that is what they showed.
An agent production stack is beginning to form around the foundation model.
The model provides intelligence. The surrounding infrastructure determines who the agent is, what it knows, what it remembers, what it can access, where it executes and whether its actions can be trusted.
That may ultimately be the more important infrastructure market.
Control Is Becoming Dynamic
There was another important shift underneath the presentations.
Control traditionally means deciding in advance what a system is allowed to do.
Agentic systems make that harder because what they need to do depends on context.
HashiCorp demonstrated an agent escalating authority only when a particular action required it.
Semvec discussed detecting drift and re-anchoring an agent.
Squidler allows agents to plan and schedule future activity while making that activity inspectable.
The interesting conclusion is that autonomy and control are not necessarily opposites.
Better control infrastructure may actually enable greater autonomy.
The more precisely a system can determine identity, scope, duration, consent and escalation, the more responsibility an organization can safely delegate to an agent.
That is a much more useful production discussion than simply arguing whether agents should or should not be autonomous.
Sovereign AI Is Expanding From Data Control to Action Control
This event also adds an important layer to the sovereign AI conversation we have been following across Stockholm MLOps.
Onde Inference demonstrates sovereignty at the execution layer. Useful intelligence can run locally, allowing data to remain on the device and reducing dependency on centralized inference infrastructure.
HashiCorp extends the idea into authority.
Control is not only about where a model runs or where data resides.
It is also about who has the authority to make an intelligent system act.
Semvec adds another dimension: control over persistent state. What does the agent remember? What is forgotten? What state can be shared?
Taken together, #38 points toward a broader definition of operational AI sovereignty:
Control of compute. Control of data. Control of identity. Control of memory. Control of action.
That is increasingly what Control AI looks like in practice.
Sweden AI Factory: Infrastructure Is Becoming Accessible
There was another ecosystem signal worth separating from the startup presentations.
Sweden AI Factory brought the European infrastructure story directly into the room.
“Don't buy tokens. Don't buy tokens. Come to us.”
— Sweden AI Factory
The message was practical rather than abstract. European AI infrastructure is not only something being discussed through industrial policy. Training and fine-tuning compute is becoming something Swedish builders can actually access.
“We give it away for free, not when you do inference, but when you train and fine-tune.”
— Sweden AI Factory
That creates an interesting contrast with Onde Inference.
At one end, Europe is building shared infrastructure for compute-intensive training and fine-tuning.
At the other, startups are pushing inference outward onto devices already owned by users.
Those directions are not contradictory.
They suggest that European AI infrastructure may become distributed across several layers rather than concentrated in one architectural model.
Only Said Here: What You Learn From People Actually Building
Some of the best signals at Stockholm MLOps events are the details that would rarely survive into a polished product announcement.
Groundrun discovered that important connected-product knowledge was missing from model training data because it existed inside experienced engineers' heads.
Even more interestingly, existing hand-coded products began failing when automated systems exercised user flows more exhaustively than human teams traditionally could.
Semvec is deliberately designing a memory system that forgets.
Onde turned an offline iPhone into an inference runtime.
HashiCorp demonstrated an agent recognizing that it did not have sufficient authority and moving into an external approval flow instead of simply being given permanent elevated access.
And Squidler provided a particularly revealing example of agentic problem solving. Mattias expected his agent to build something involving databases and normalization for his son's summer-job application. Instead, it chose a simpler operational solution: rescan the web periodically and rewrite static HTML.
The important point is not whether that specific implementation was optimal.
It is that an agent equipped with reasoning, tools and scheduling may solve a problem through behavior over time, rather than by constructing the software architecture a human engineer initially imagined.
Those are the kinds of lessons that only appear once people actually build these systems.
Signals From the Room
The audience evidence from #38 was lighter than the speaker material, so it should not be overstated. But one moment was particularly telling.
When Mattias asked how many people were already using Claude or comparable tools, the response appeared to be almost everyone.
That changes the conversation.
For this audience, access to capable AI is no longer the differentiator.
The question becomes what happens when everyone has access to roughly the same intelligence substrate.
What differentiates one system from another then?
Context.
Memory.
Domain knowledge.
Tools.
Workflows.
Infrastructure.
The room itself therefore reinforced the central signal from the speakers: the competitive conversation is moving outward from the model.
What Stockholm MLOps #38 Signals
The first phase of the current AI cycle was about making models useful.
The emerging phase is about making intelligent systems operable.
That difference is substantial.
A useful model can answer a question.
An operable agent may persist across sessions. It may remember. It may plan future work. It may access tools and systems. It may require credentials. It may act under authority delegated by a human. It may request additional approval for sensitive actions. It may execute locally rather than in a cloud. It may modify software connected to physical hardware. Its behavior may drift. Its memory may need to forget. And its output may need to be tested against something outside itself.
Once that happens, the model is no longer the architecture.
The architecture is everything required to make that intelligence contextual, secure, persistent, controlled, verifiable and useful.
HashiCorp showed that agents need authority structures.
Squidler showed that persistent agents need accumulated human context.
Semvec showed that accumulated context needs memory architecture.
Onde Inference showed that execution does not have to remain centralized.
Groundrun showed that generated output needs external truth.
ForgeU showed that AI-native systems may need to reorganize workflows around outcomes rather than inherit old structures.
Lozd reminded us that none of this matters if we build the wrong thing.
The deeper Stockholm MLOps signal is therefore:
AI infrastructure is moving around the model.
And as agents become operational actors, MLOps itself may have to expand.
It will no longer be enough to ask whether the model is deployed.
We will increasingly have to ask:
Who is the agent? What does it know? What can it access? Who gave it permission? What does it remember? Where does it run? How do we know what it did? How do we know it was right? And what happens when it is not?
That is the story underneath Stockholm MLOps #38.
The agent era is becoming an infrastructure era.
Event Details
Stockholm MLOps #38, Fall Bash 2026
August 20, 2026
IBM, Stockholm
Speakers included
Fredrik Warfvinge of HashiCorp on agentic identity and API key management
Mattias Ask of Squidler on moving from prompting to employing agents
Adam Dunkels of Groundrun on agent-speed development verified against hardware
Dr. Egui Zhu of ForgeU on AI-native learning systems
Seto Elkahfi of Onde Inference on native on-device inference
Johannes Sommer of Semvec on persistent fixed-size agent memory, and Ahmad Mudhar of Lozd on turning domain problems into AI ventures.
Related Insights
The themes from #38 build directly on earlier Stockholm MLOps discussions around infrastructure, sovereignty, control and what happens after the model.
Sovereign AI & Control AI
#38 expands sovereignty from control of infrastructure and data into control of identity, memory, execution and agent authority.
Stockholm MLOps #36: AI Infrastructure and Sovereignty
#36 explored retrieval, routing, workload placement and infrastructure ownership. #38 extends that infrastructure discussion into the agent era.
Stockholm MLOps #37: Summer Bash 2026, AI After the Model
The Summer Bash showed control, verification, runtime and domain knowledge moving above the model. #38 shows the infrastructure now forming around those layers.