What this is. Opinion + Experience + Fact (50% opinion · 20% experience · 30% fact). Written in collaboration with AI — I discuss, I do not outsource.

A field note written during embedded world North America (Anaheim, September 22–24, 2026), whose two keynote titles point at autonomous, agentic systems and at AI in the physical world for everyone. The short version: the agent is the top of the stack, and what earns it the right to act is the layer underneath — bounded states, a way to say no below the model, and a record of what the device did. An agentic device is not an unsupervised one.

The agent proposes, the firmware disposes (simplified illustration) Three boxes in a row: the agent, the firmware, the device. A request travels from the agent toward the device. In the first pass it is in the firmware's state table and reaches the device; in the second pass it is not in the table and the firmware refuses it before it reaches the device. The agent proposes. The firmware disposes. Simplified illustration of the control path in an agentic device — not a wiring or protocol diagram. THE AGENT THE FIRMWARE THE DEVICE decides, proposes an action state table · limits · watchdog motor · valve · battery request action PASSED — in the table REFUSED — not in the table Agency is granted by the layer that can refuse it.
A request from the agent is either a named transition in the firmware's state table, or it is refused before it reaches the hardware. Simplified illustration.

The week of September 22, 2026, the embedded world is in Anaheim. embedded world North America runs September 22–24, and the titles of its two keynotes tell you where the industry is looking. The Tuesday keynote is Deepu Talla, NVIDIA's VP of Robotics and Edge AI, on "The Next Evolution of Embedded: Open Platform for Autonomous, Agentic Systems." The Wednesday keynote is Fabio Violante, VP and GM of Arduino at Qualcomm, on "Powering the Age of AI in the Physical World for Everyone." Two names everyone in the room knows, both pointing at the same thing: software that decides, running on devices that act.

I love the direction. I have also spent enough years on factory floors and next to test benches to add one line to it. The agent is the top of the stack. What earns it the right to act on a motor, a valve or a battery is the boring layer underneath, and that layer is firmware. This post is about what that layer has to provide before "agentic" is a safe word to put on a product.

1. What is the difference between an agentic device and an unsupervised one?

An agent decides. It takes in the world, reasons about it, and proposes an action. A device acts, and every action it takes has something physical attached: a motor that draws current, a valve that moves fluid, a battery with a thermal limit, a person standing nearby. The agent is allowed to be slow, uncertain and occasionally wrong. The device is allowed to be none of those things when the over-current trip has to fire.

So the real question on an agentic product is not "how smart is the agent?" It is "what does the device do while the agent is wrong?" A model can take as long as it needs to think. The safety limit has to fire instantly, regardless of what the model is thinking, and regardless of whether the model is running at all. That means the limit lives below the model, in firmware, where a bad inference reaches it as a request, not as a command.

This is also why I distinguish agentic from unsupervised. Agentic says where the decisions come from; autonomous says how much human supervision the system needs; unsupervised is the corner case where nothing below the decision-maker can overrule it. An agentic device has a decision-maker on top. An unsupervised device has a decision-maker with nothing underneath it that can say no. The first is the future. The second is a problem you meet in the field.

▸ First principle. The agent proposes; the firmware disposes.

2. What does a device need before it can be given agency?

Three things. I have watched good teams build all three by hand, per product, under deadline, and I have seen how much lighter the product gets when a framework carries them. They are the whole reason I work on an open one.

Bounded states. Every action the agent can request is a named transition in a table: from this state, on this request, go to that state, and run this handler. Anything not in the table is refused, by construction, and the refusal is a normal event, not an exception. This is the same idea as every device is a state machine, applied to a new kind of caller. The agent does not get a function pointer into the hardware. It gets a vocabulary.

A way to say no, below the model. Current limits, temperature limits, interlocks, rate limits and the watchdog all live in firmware, independent of the model's process, thread or accelerator. If the agent stalls, the watchdog still fires. If the agent asks for a torque above the limit, the limit wins. In firmware terms this is the difference between a request arriving on a message queue and a request arriving as a direct write to a register.

A record of what it did. Every request, every transition, every fault, stamped with the device identity and the firmware version, so that "why did it do that?" has an answer that a human, a regulator or another machine can read. A device that acts on its own judgment and keeps no record of it is asking for trust it has not earned.

These three are the shipped design of EmbedIQ, the open framework I work on. Each task is a single thread with a table-based state machine and one message queue, so an agent's request is by definition a message that either matches a transition or does not. The Observatory records every transition, message and fault as a tamper-evident trace, with no instrumentation code in the application. Board-specific bring-up and drivers are still your work; the guardrail structure is not.

▸ First principle. Agency is granted by the layer that can refuse it.

3. Why is "for everyone" the harder promise?

The Arduino keynote title says AI in the physical world for everyone. I read that as a framework promise as much as a chip promise. What is scarce is the discipline that makes an agentic device safe to ship, and today that discipline mostly lives in the heads of experienced firmware engineers.

If the guardrails live in an expert's head, only teams with that expert ship safe agentic devices. If the guardrails live in the framework, a small team can. That is the whole bet behind EmbedIQ, and it is why the work I find most interesting at a show like this sits one layer below the demos: the structure that lets a small team give a device agency and sleep at night.

There is a date attached, too. From September 11, 2026, the EU Cyber Resilience Act turns an actively exploited vulnerability in a product with digital elements into a reporting event with a 24-hour early-warning clock. A device that keeps a trace of what it did lets the manufacturer write that report from evidence, not from memory. I expect agentic devices that can explain themselves to be easier to sell into Europe than ones that cannot.

▸ First principle. The smartest device in the room is still the one that can explain itself.

The copyable part: an agency checklist for a connected device

QuestionWhat "yes" looks likeWhere it lives
1. Is every agent action a named transition?A state table lists the request, the source state, the target state and the handler; unknown requests are refused as a normal eventFirmware state machine
2. Can the device say no without the model?Current, thermal, rate and interlock limits enforced in firmware, independent of the model's thread or acceleratorFirmware limits + interlocks
3. What happens when the agent stalls?The watchdog fires and the device falls to a defined safe state; the agent restarting is a transition, not a surpriseWatchdog + state table
4. Does the request arrive as a message?Requests enter through one queue per task; the agent has no direct path to registers or actuatorsMessage queue
5. Is every decision written down?Requests, transitions and faults recorded with device identity and firmware version, tamper-evident, readable off the deviceTrace / observability
6. Can a human read "why"?The trace answers "what did it see, what did it decide, what did the firmware allow" in that orderTrace + tooling
7. Who is told, and by when?From September 11, 2026: the CRA 24-hour early-warning clock for actively exploited vulnerabilitiesProcess + trace

Seven questions. Only the first mentions the agent by name. The other six are the layer that gives it permission, and the question to ask about your own product is how many of them your firmware already answers.

If you are at embedded world this week, or watching the keynotes from a distance: what would you need to see from a device before you let an agent act through it?

Next in this thread: the log the crash erased — why the record of what a device did has to survive the failure it describes.

Sources

Event and keynotes: embedded world North America — Keynote Speakers Announced for ewNA26 (press release, May 12, 2026: Deepu Talla, NVIDIA, "The Next Evolution of Embedded: Open Platform for Autonomous, Agentic Systems"; Fabio Violante, Arduino at Qualcomm, "Powering the Age of AI in the Physical World for Everyone"). Program and dates: Embedded Computing Design — embedded world North America Announces its 2026 Technical Conference Program (June 26, 2026: September 22–24, Anaheim Convention Center; NVIDIA keynote Tuesday September 22, Arduino at Qualcomm keynote Wednesday September 23). Event site: embedded-world-na.com. Regulation: European Commission — Cyber Resilience Act reporting obligations (from September 11, 2026: 24-hour early warning for actively exploited vulnerabilities). Keynote titles and dates are quoted from the organizer; the reading of them, and the design position, are mine. This post was written before either keynote was delivered and makes no claim about their content.

FAQ

What is an agentic embedded device?
An agentic embedded device is a connected product in which a software agent, usually a model running on the device or at the edge, observes the world and proposes actions that the device then carries out physically, such as moving a motor, opening a valve or changing a power state. The agent decides; the firmware and hardware act.

What is the difference between agentic and autonomous in embedded systems?
Agentic describes where decisions come from: a software agent proposes actions. Autonomous describes how much human supervision the system needs. A well-designed agentic device is not unsupervised: the firmware beneath the agent bounds what it can request, enforces safety limits independently of the model, and records every decision so a human can review it.

What should firmware provide before an AI agent is allowed to control hardware?
Three things: bounded states, so every agent request is a named transition in a state table and anything else is refused; limits, interlocks and a watchdog that live below the model and act even if the model stalls or is wrong; and a tamper-evident record of every request, transition and fault, stamped with device identity and firmware version.

What are the keynotes at embedded world North America 2026?
embedded world North America 2026 takes place September 22–24 at the Anaheim Convention Center. The two keynotes on the program are Deepu Talla, NVIDIA's VP of Robotics and Edge AI, on Tuesday September 22 with "The Next Evolution of Embedded: Open Platform for Autonomous, Agentic Systems," and Fabio Violante, VP and GM of Arduino at Qualcomm, on Wednesday September 23 with "Powering the Age of AI in the Physical World for Everyone."

Labels: Opinion 50% · Experience 20% · Fact 30%. Written in collaboration with AI — I discuss, I do not outsource.

This is a Ritzy Lab field note. If you ship connected devices and want to compare notes on giving a device agency safely, the longer story and how I work live on my profile. — Ritesh | ritzylab.com

#EmbeddedSystems #EdgeAI #embeddedworld #Firmware #EmbedIQ