agents
Articles
Our Grades Fell While the Code Got Better
Five scored code reviews trended downward while each one triggered a real remediation wave. The score was measuring the reviewer, not the code.
Handing a Decision to a Human Needs a Real Acknowledgment
An escalation ending in "reply with this code" is empty unless the code names a stable item and the reply names a verified person.
The Watchdog That Announced a Restart It Never Performed
A supervision mechanism that logs its intent and then fails to act is worse than no supervision, because the log reads like recovery in progress.
The Agent Cited Itself
A provenance gate asked whether the agent read an identifier or composed it, and counted the agent reading its own instructions as reading it.
One Machine per Customer: Two Planes, Two Writers
Isolation lives in the deployment topology, and config authority is a separate question: two writers reach the same bucket and neither holds the other key.
Five Words and the Edit Nobody Authorized
A request to review one section of a customer reply came back as an unbriefed critique and an unauthorized edit. The fix was an output contract, not a reminder.
The Grant Table Is the Kill Switch: Access Control for a Shared AI Employee
Several people share one autonomous agent: the identity provider proves who they are, but a grant read live on every request decides whether they still get in.
What an Agent May Do Is Not How It May Start
One authorization setting was answering two unrelated questions. Splitting exposure from initiation is what made the entitlement model enforceable.
Bake Every Author-Built Connector In, Keep It Inert Until Bound
When a vendor has no MCP server you author your own. The real decision is where that connector code lives: baked into one shared image, inert until bound.
Ground It or Flag It: Ending Agent Confabulation
The agent failure to fix is not guessing - it is confident, unmarked inference dressed as fact. The cure separates disclosure from verification.
An Agent Should Write the Script, Not Be the Loop
When an agent task burns money, the reflex is to make the run survivable. Often the real fix is upstream: the agent should write the script, not be the loop.
We Accidentally Built a Shadow System of Record
A review caught our agent console rendering the customer's own data back to them. We had built a shadow system of record nobody designed.
claude.ai as a Routing Surface, Not a Content Generator
MCP turns a conversation interface into a capable operator by exposing production tools directly - the LLM becomes the routing layer, not a content generator.
Suppress Work Loudly
When a suppression mechanism fails, the failure mode should produce more work, not less - because silent suppression looks identical to a successful decision.
Give an Agent Powerful Capabilities Without Giving It Credentials
Least-privilege for autonomous agents: mediate every Google Workspace grant through a separate privilege-dropped broker, never hand the agent the credential.