Writing
Essays on agentic systems in production, written from the inside.
Jul 26
The only implementation of our budget was named NoBudgetOur agent budget interface had exactly one implementation, named NoBudget, that never capped anything. The types checked and the guarantee was absent, which is the defect a model author produces at scale, and the reason correctness has to move out of the reviewer and into the grammar.
The number carries its own receiptAn assistant answers business questions in plain English and every number it reports arrives with the exact SQL that produced it. The real boundary is not the prompt telling it to behave, it is a Postgres role that cannot write and cannot cross tenants.
One capability, four front doorsA single operation now has to be an HTTP endpoint, an MCP tool, a chat tool, and a sandboxed code-mode capability at once. Generate all four from one declaration or watch them drift, quietly, into a security bug.
Jun 26
Your async trace tree is lying about who called whomIn a concurrent model gateway the active span is the wrong parent, so I anchor every span to the server span captured once at request entry.
Treat the model as a cell, not a function callWhy I model each LLM call in my app as a derived spreadsheet cell that recomputes when its inputs change, and where that model breaks
May 26
The turn outlives the connectionWhen the browser tab closed, the old design sent a kill signal to an agent that was halfway through editing a file, and fixing that forced a second question I had been able to ignore, what the system should do when no one is there to answer.
The editor is built from the blocks it editsAdding a database backend to a block-based editor introduced no new model tools because the apps and the editor are one tree of typed blocks, and the same purity later cost it its founding CRDT
Apr 26
Streaming an LLM turn is not streaming textReconnecting to a long agent turn corrupted its answers, and the fix was to stop modeling the turn as a character stream and treat it as a structured object that survives the connection.
Skills don't have to be a vendor featureI rebuilt a provider's native skills feature as request-time compilation so it runs on models with no skills API, and found the one piece that does not survive the translation
Mar 26
Pointing at code you can't seeYou can point at a button on a live page an agent is driving and it knows where you mean, but most of what an agent does has no screen, and the only way I found to point at invisible work was to give it a visible projection that carries its own address.
Make the agent record proof a human will actually watchAutonomous pull requests should fail the build unless they carry an inline-autoplaying screen recording of the feature, because a recording nobody opens is not evidence.
Feb 26
LLM spend is an attribution problemA month of anonymous model spend taught me that cost governance for AI is identity infrastructure, and the discipline that fixes it already has a name.
You can't review your way to trusting an autonomous agent. Let prod be the reviewer.We had already built two thirds of an autonomous deploy pipeline by hand and the missing piece was a self-reverting canary that quietly moved the moment of trust off code review and onto a metric.
Jan 26
My Self-Improving Agent Improved Itself Right Into a Coma (and How I Woke It Up)A loop that waits for failure to recur learns nothing, and dropping to one trace per lesson cures the paralysis while quietly letting wrong lessons walk in the front door
In an LLM app, the only manipulation feature worth building is pointingI built drag-and-drop authoring, watched it break under JSX iteration, and deleted all 520 lines once I noticed the chat panel could already do every move in one sentence.
Dec 25
Give a model a tool it doesn't have by hiding the agent loop in the gatewayHow I gave a search-less model web search by running the whole agent loop inside one gateway call, and what that opacity costs
Forbid the edit by making it impossible to land, not by telling people not toA CI gate that regenerates generated files from their spec and fails on any drift can never be satisfied by a hand-edit, and the same trick quietly stops working where the generator's output ends.
Nov 25
Database lessons for the agent eraAgent platforms are rediscovering, one incident at a time, what database engines settled decades ago.
Your Agent Knows Exactly As Much As the Command You Let It Run, and Not One Assertion MoreA build agent's confidence reaches exactly as far as the command it runs to verify itself and no further, which turns any gap between the local check and the merge gate into a false green it will go on to defend.
Oct 25
What it takes to let agents touch enterprise dataTrust in agentic systems is an architecture property, not a model property.
Getting an agent to follow the rules is a persuasion problem, not a prompting problemAgent skill files quietly use the seven principles of human persuasion to more than double an agent's compliance, which makes them powerful, symmetric, and silently perishable.
Sep 25
Why your knowledge graph isn't helping your RAGWe nearly published the fashionable verdict that GraphRAG is hype. The audit found something better, the structural reasons the published architectures break on enterprise data.
Where no becomes yesA browser reload once made an agent deny a tool its operator was happy to approve, and that accident is the whole argument, that a fail-closed system enforces a line it cannot draw and someone outside it has to decide where no turns into yes.
Aug 25
When documents become databasesSchema discovery is a corpus-statistics problem before it is a modeling problem.
What you can't add laterI have deleted three abstractions I was sure I would need, and only one of them actually had to be deleted, which taught me the question to ask before building one is not whether I will need it but what being wrong will cost.
Jul 25
Your agent thinks fine, it's the shell that's killing youAn autonomous coding agent's dominant cost is environmental friction re-paid on every tool call, and writing the workaround into the docs only makes the bill bigger
The model designs, the code enforcesIn an LLM ingestion pipeline, the model gets the judgment that requires reading the document and nothing else. The surprise is how badly the prompt wants to violate that in both directions.
Jun 25
May 25
When one line of code becomes five thingsThe drag-to-rearrange proof passed seven of seven and meant nothing, because a model that writes your interface turns one expression into a screen full of echoes, and you cannot point at the third echo until you give it a name.
The Second Account Is a Costume, Not a BoundaryThe claude-box pipeline gives its reviewer agent a separate account, yet the only thing that makes the review independent is a fresh context window that nothing can prove was actually clean.
Apr 25
Mar 25
Feb 25
Close enough, and too closeThe same distance that proves synthetic data learned the real distribution is the distance that catches it memorizing a real row, so quality and privacy are not two virtues to balance, they are one ruler with a floor underneath.
Authorization for answersWe have learned to secure what agents do. The harder question is what they are allowed to know.
Jan 25