Long-form posts on the systems I actually run — the architecture decisions, the migrations that went sideways, and what I would do differently.
The SQL was valid, the arithmetic was right, and the number was still wrong, because the agent picked the table whose name looked most like the question. Here is how to make a data agent commit to a source you can check before it hands anyone a figure.
A timeout tells the agent it stopped waiting, not that nothing happened. Here is how a reasonable-looking retry turned into a double charge, and the idempotency key that makes the retry safe.
The trigger is the least-discussed design choice in a personal agent, and it quietly decides your bill, your duplicate rate and how stale its answers are. A simple test for choosing between a schedule and an event, and why the best setup usually uses both.
Prompt-injection filters try to spot the bad sentence. A taint flag skips that guess: once fetched text is in the context, the tools that can do damage are no longer offered.
An eval that has never failed anything is not proof of a good agent. Before you trust a grader's score, feed it answers you know are wrong and see if it notices.
A to-do agent archived a task you meant to finish, and the tool was working fine. The model picks tools from a short menu of names and descriptions, so how you split that menu decides how often it picks wrong.
Splitting a year of transactions across four workers looks like clean delegation until the merged total is off and every worker reports success. The fix is a coverage contract the supervisor checks before it adds anything up.