Key Takeaways
- Resilience is three layers, not one. Infrastructure, control, and response — governance alone only prevents problems; it doesn’t handle the ones that get through anyway.
- Most failures should never become incidents. The infrastructure layer’s job is to absorb routine failure silently, so only the rare catastrophic event ever has to escalate — Boomi’s multi-zone HA/DR split is one working example of that ratio.
- The response layer runs on a trust curve, not a leap of faith. Start with human approval on every automated fix, then hand over full autonomy once you’ve earned confidence in the system — that’s the adoption model behind Boomi’s response-layer tools today, and the one Autopilot will extend as it rolls out.
“Everyone’s talking about governance, but what about resilience?” This was the question posed to me recently by an analyst, and one that I’m surprised I don’t hear more often.
They were right to ask. It’s important to proactively think about governing your agentic systems but you also need a plan for when something goes wrong. Just because you can be made aware something is wrong, doesn’t mean you will be prepared to handle the repercussions. Awareness is not enough. Action is what is necessary.
So how is Boomi preparing our customers to be resilient in the age of agentic AI? Let’s look at this in three layers: infrastructure, control, and response. I want to make this clear, so I’m going to walk you through an example from my catering days to illustrate how this all works together.
When you work in the food industry, your business is required to follow health codes. You must also adhere to prep checklists. Think of these as the governance layer — the rules that prevent problems before service starts. But even if your kitchen is up to code and you checked all the boxes on the prep checklist, there’s no guarantee there won’t be issues. A new cook (like an AI agent) doesn’t come in knowing everything about the specific appliances you use, how the kitchen operates, or where all the needed ingredients are stored. Industry experience taught them the health code, but these other critical, specific pieces of information can only be learned from working in YOUR restaurant.
Layer 1: Infrastructure
There will come a day when a burner goes out. Maybe it was a mechanical malfunction no one could have predicted, or maybe the new chef turned the knob a little too hard. You are mid-service with a burner down, but dinner service must go on, so you switch to the next one. It’s a non-issue until the kitchen loses power entirely, at which point you move into emergency mode: close early, or shift service to a sister location or catering kitchen.
Think of those burners as your runtime clouds, the infrastructure layer beneath everything you run. Host your Boomi environments through any of our Boomi-hosted runtime offerings — Public Cloud Service (PCS), Dedicated Cloud Service (DCS), or Managed Cloud Service (MCS) — and you get built-in High Availability (HA): a minimum of three availability zones in every region, backing a 99.99% infrastructure SLA, a ceiling of just 52 minutes and 36 seconds of downtime per year. If one zone goes down, your workloads shift to the next without interruption. Only a major event taking out all three would raise real concern, and even then, cross-region Disaster Recovery (DR) is there to catch you, included automatically for PCS production environments and available as an optional add-on for DCS and MCS.
Behind that infrastructure, Boomi’s dedicated Site Reliability Engineering (SRE) teams provide continuous, round-the-clock monitoring across PCS, DCS, and MCS. That operational oversight is what makes the 99.99% SLA real in practice, not just on paper, so availability isn’t something your team has to manage alone
Layer 2: Control
Beyond having a plan for the infrastructure in place, you also need a plan for rogue agents (or in our example, rogue new chefs). If your new chef starts adding in all sorts of spices that your restaurant patrons are not used to, disaster could ensue. Maybe there is an allergic reaction or people are in need of more water than anticipated to cope with the hot spice levels. The control layer in the kitchen may be an expeditor, checking every plate before it leaves the pass, but if extra spice was added, that might not be noticed visually. So there are exceptions that can slip past the guardrails, but once you discover which chef is adding the extra spice, you need to have enough control over the kitchen to remove them from the line immediately.
The control layer in Boomi is the Agent Control Plane. This watches for anomalies (rogue agent activity) and provides a kill switch to stop the agent when it is doing something costly (or just flat-out wrong) in production. While we have had our Agent Control Tower out on the market for over a year now (released March 2025) we only recently announced our expansion of those services into the Agent Control Plane, which goes beyond just monitoring and governance of your organization’s agents to also cover the infrastructure supporting their actions. The Agent Control Plane governs the MCP tooling, grounded context, and models (whether frontier LLMs or homegrown SLMs) to provide holistic visibility and oversight.
Layer 3: Response
The response layer is the layer we hear the least about. What do you do to correct the actions that have transpired? How do we figure out how many tables received the spicy entrees and how quickly can we remedy the situation?
The kitchen manager might know the order system well enough to quickly gather the information on which seats at which tables have the wrong dish and be familiar enough with the staff in the kitchen to get replacement entrees whipped up and out to the correct patrons. With your Boomi-built solutions, that expert authority would be our forthcoming offering, Boomi Autopilot.
Autopilot will have access to your accounts and can quickly understand what went wrong, the root cause, and how to fix it. Not only does it understand how, but it can build, test, and deploy the fix without human input. Of course, you can start with a human approval process before the agent takes any action. Then, when you’ve built the level of trust desired to grant that agent more autonomy, you can remove that human-in-the-loop to allow the agent to act independently. Boomi Companion is a skill set that can be used today with any coding agent to accomplish this task, but unlike Autopilot, Companion is a conversational tool that must be invoked to diagnose, fix, and redeploy a process.
This year, Amneal Pharmaceuticals received the Boomi Customer Innovation Award for agentic transformation for its 24/7 autonomous AI support agent, powered by Anthropic Claude and Boomi Agentstudio. Amneal was managing more than 100 processes across ERP and finance systems, and its integration ecosystem had grown too complex to manage manually. The company wanted to catch errors before they reached business users. So even prior to our development of Autopilot, Amneal built and deployed an agent on Boomi that cut average error-detection time from 30 minutes to under 2 minutes using Agentstudio — a 93% improvement — while cutting mean time to repair (MTTR) by 75% and pushing SLA adherence from 85% to 98%. That’s the response layer, working as designed.
Conclusion
As we think about how to best prepare for this agentic era, there is a lot of talk about data readiness. And there should be. You need to have your data in order. But clean data doesn’t change the fact that no agent, like no human, is perfect. That’s not a reason to avoid agentic, probabilistic systems. It’s the reason resilience has to be built in from the start.
The three layers above aren’t there to make agents perfect. They’re there to make an imperfect, probabilistic system produce predictable, dependable outcomes anyway; the same way Amneal didn’t need flawless agents to push its SLA adherence from 85% to 98%. It needed infrastructure that stayed up, a control layer that caught what went wrong, and a response layer that fixed it fast. That’s what resilience buys you in the agentic era: not certainty that nothing will break, but confidence that when it does, your SLAs hold anyway.
To learn more about the resources mentioned above, check out: