Notes from building agent systems
Evaluation harnesses, orchestration patterns, memory design and the failures behind them — written up while the details are still fresh.
Settlement Versus Authorisation: What Agentic Trading Reveals About Action Limits
Agents given cash to trade often buy and sell repeatedly: the failure is not the strategy but the absence of a settlement boundary between intent and recorded position.
Tool Surfaces Are a Schema Problem: Typed Arguments Before Clever Prompts
Most agent tool-use failures come from under-specified schemas, not weak reasoning. Treat the tool interface as the primary reliability lever.
Egress Ledgers: Recording Where an Agent Went, Not Just What It Sent
Content inspection sees payloads, not destinations. An egress ledger records where an agent went, in what order, and how novel each hop was.
Agent Incidents Are a Telemetry Problem Before They Are a Policy Problem
Rogue-agent reports describe control failures that were invisible until after the fact. The first fix is a durable record of intent, egress, and decision.
OpenShell Treats the Symptom: Agent Safety Needs Contracts, Not Kill Switches
Runtime containment can halt a misbehaving agent, but without a pre-declared contract of permitted actions it is damage limitation, not prevention.
Containment Is Not a Control Surface: Reading Nvidia's OpenShell Against the Grain
Sandboxes stop escapes; they do not define what an agent was authorised to attempt. Agent safety needs an authority layer above the runtime, not a faster kill switch.
Agents Do Not Need More Autonomy, They Need Narrower Tool Surfaces
Most agent overreach starts at the tool interface, not the model. Narrowing the surface an agent calls is a higher-leverage fix than wrapping it in guardrails.
Agent Egress Budgets: Rate Is Not the Same as Reach
Rate limits cap how fast an agent acts, not where. Egress control must be a destination-and-capability budget, enforced at the proxy and reconciled after each run.
Agent Risk Scoring Is a Runtime Signal, Not a Vendor Assessment
Static agent scorecards go stale the moment a tool is called. The useful artefact is a risk signal derived from the run itself.