Three things surprised us while running a live agent through a governed runtime

**Background** We've been running a live analysis agent on real market data, with execution routed through a governed runtime: budget limits, semantic classification, and execution controls at the gateway before anything hits external systems. We ran controlled experiments on the reasoning step to see what actually breaks when analysis meets execution — not prompt quality in the abstract, but whether downstream systems can reliably act on what the model produces. **Three things surprised us** **1. Prompt structure drove execution reliability, not reasoning quality.** We compared strict JSON output against freeform natural-language analysis on identical data — 10 runs each. * Strict JSON: **10/10** parse success * Freeform: **0/10** parse success The freeform responses were often thoughtful — multi-scenario analysis, conditional views, nuanced uncertainty. But our pipeline couldn't consume them. Reliability wasn't about whether the model understood the problem. It was whether the output matched what execution expects. **2. Prompt structure appeared to influence decision distribution, not just output shape.** We added a third variant: freeform reasoning with a structured JSON block appended at the end. Same data, same model. The exact distributions varied across experiment runs, but outputs consistently differed between formats even when fed identical inputs. The strict schema appeared to compress multi-scenario reasoning into a single forced direction. We weren't just changing serialization — we may have been changing what the agent would have done. **3. Reasoning and extraction can be separated.** We split into two explicit calls: Agent A does freeform reasoning; Agent B reads A's output and produces strict JSON only. Agent B maintained **10/10** parse success while A retained rich, sometimes contradictory analysis. The extracted directions were consistently machine-readable even when A's prose contained multiple conditional scenarios that no single label could capture. The layers have different jobs. **Takeaway** We now think in three layers: * **Reasoning** — open-ended analysis, uncertainty, multiple scenarios * **Extraction** — structured output the pipeline can parse * **Execution** — governed boundary where budget, semantics, and authorization actually matter Our current working hypothesis is that governance belongs closest to execution, where decisions become actions. Trying to govern freeform reasoning felt like the wrong layer. Governing structured payloads at the execution boundary felt right. **Question for the room** How are you handling execution control, tool authorization, and governance for production agents today — in the prompt, in a middleware layer, or at the tool boundary? Curious what's working and what's still duct tape.