agents
Articles
The Grant Table Is the Kill Switch: Access Control for a Shared AI Employee
Several people share one autonomous agent: the identity provider proves who they are, but a grant read live on every request decides whether they still get in.
What an Agent May Do Is Not How It May Start
One authorization setting was answering two unrelated questions. Splitting exposure from initiation is what made the entitlement model enforceable.
Bake Every Author-Built Connector In, Keep It Inert Until Bound
When a vendor has no MCP server you author your own. The real decision is where that connector code lives: baked into one shared image, inert until bound.
Ground It or Flag It: Ending Agent Confabulation
The agent failure to fix is not guessing - it is confident, unmarked inference dressed as fact. The cure separates disclosure from verification.
An Agent Should Write the Script, Not Be the Loop
When an agent task burns money, the reflex is to make the run survivable. Often the real fix is upstream: the agent should write the script, not be the loop.
We Accidentally Built a Shadow System of Record
A review caught our agent console rendering the customer's own data back to them. We had built a shadow system of record nobody designed.
claude.ai as a Routing Surface, Not a Content Generator
MCP turns a conversation interface into a capable operator by exposing production tools directly - the LLM becomes the routing layer, not a content generator.
Suppress Work Loudly
When a suppression mechanism fails, the failure mode should produce more work, not less - because silent suppression looks identical to a successful decision.
Give an Agent Powerful Capabilities Without Giving It Credentials
Least-privilege for autonomous agents: mediate every Google Workspace grant through a separate privilege-dropped broker, never hand the agent the credential.