Notes from building agent systems
Evaluation harnesses, orchestration patterns, memory design and the failures behind them — written up while the details are still fresh.
Agents That Obey and Still Cause Harm: The Philadelphia Tip as a Specification Failure
The Philadelphia false-tip case is not a hallucination story. It is a specification failure: an agent executed a consequential action whose preconditions were never declared.
Runtime Governance Beats Prompt Governance: Reading the Nvidia Sentry and Kill-Switch Debate
Prompt-level controls are advisory because they live inside a probabilistic system. Runtime interception sits where actions become concrete, and that is where authority belongs.
OpenShell Treats the Symptom: Agent Safety Needs Contracts, Not Kill Switches
Runtime containment can halt a misbehaving agent, but without a pre-declared contract of permitted actions it is damage limitation, not prevention.
Containment Is Not a Control Surface: Reading Nvidia's OpenShell Against the Grain
Sandboxes stop escapes; they do not define what an agent was authorised to attempt. Agent safety needs an authority layer above the runtime, not a faster kill switch.
Agents Do Not Need More Autonomy, They Need Narrower Tool Surfaces
Most agent overreach starts at the tool interface, not the model. Narrowing the surface an agent calls is a higher-leverage fix than wrapping it in guardrails.
Refusal Is a Routing Decision, Not a Model Property
Agent overreach is usually a missing authorisation decision upstream of the model. Safety belongs in the request path, not only in alignment training.
Sandbox Escape Is a Capability Budget Problem
Containment failures in agent systems are mispriced capability grants, not missing jailbreaks. The control surface is a per-run budget on reachable systems.
Sandbox Contracts: What an Agent Must Prove Before It Touches a Production Endpoint
Agent containment is a permissions-and-verification contract, not a guardrail prompt. Every tool boundary needs a pre-condition the agent cannot negotiate at runtime.
Coding Agents Need a Sandbox Contract, Not a Warning Label
An autonomous coding agent's blast radius is defined by its sandbox and network egress rules. Specify that contract before you specify the agent.