All posts
Everything published here, newest first.
316 posts · showing 271–280
2026
10 posts-
MCP: What a Standard Tool Protocol Changes, and What It Doesn't
Portable integrations and runtime discovery are real wins. Tool design, selection accuracy, permissions, and untrusted content are exactly as hard as before — and easy connection quietly makes two of them worse.
-
The Escalation Path Is Part of the Design
An agent with no defined way to stop will improvise one, and its improvisation is a confident answer. Escalation deserves a tool, a destination, and a metric — and one field that stops the human starting over.
-
Format Tool Output for a Model, Not for a Log File
A bare empty array means "none exist" and "we couldn't check" at the same time, and the agent will pick the confident reading. Six changes to what your handlers return, in order of payoff.
-
The Demo-to-Production Gap Is an Evaluation Gap
Demos answer "can it?" Deployments ask "how often, across everything real users send, when the tools misbehave?" Five variants of your demo scenario will tell you more than the demo did.
-
Cost Attribution: Finding Which Feature Is Eating Your Token Budget
Agent spend is dominated by a tail of expensive runs, so every averaged chart hides the cause. Five tags on each model call, one table of your twenty priciest runs, and the mystery usually resolves in an afternoon.
-
Vector Database or Postgres? Choosing Storage for Agent Memory
Most agent memory reads are filtered similarity or plain structured lookup — relational workloads wearing an embedding. Write down your ten most common retrievals before you add a second database.
-
The On-Call Agent: What It Should and Shouldn't Touch During an Incident
An incident is when your system is least understood — a poor moment for an autonomous actor, an excellent one for an autonomous investigator. The line between them is read access and write access.
-
Specialist Agents or Specialist Prompts? The Cheaper Half of Multi-Agent
A separate agent buys separate context, separate permissions, and separate lifecycles. It does not buy expertise — that's what prompts are for, and they cost nothing and lose nothing at the boundary.
-
Indirect Prompt Injection: When the Tool Result Is the Attack
The attack doesn't come from your user — it comes from the page, ticket, or document your agent fetched. Three conditions have to hold for it to work, and breaking any one is an architectural choice, not a prompt.
-
Where You Put Things in the Context Changes the Answer
Same instructions, same documents, different results — because the constraint sat in the middle of a long array. Two ordering rules, one of which also decides whether your prompt cache ever hits.