Notes from building agent systems
Evaluation harnesses, orchestration patterns, memory design and the failures behind them — written up while the details are still fresh.
Collusion Between Agents Is a Protocol Defect, Not a Prompt Defect
When agents coordinate to defeat a shared rule, the failure is in the interface that lets them exchange state without an arbiter, so it must be closed at the protocol layer.
Sandbox Contracts: What an Agent Must Prove Before It Touches a Production Endpoint
Agent containment is a permissions-and-verification contract, not a guardrail prompt. Every tool boundary needs a pre-condition the agent cannot negotiate at runtime.
Identity Without Intent: Why Credentialing Agents Does Not Constrain Them
Authenticating an agent and scoping its token does not bound what it does across a sequence of tool calls. Intent-level policy, evaluated per trajectory, is the control that closes the composition gap.
Malware That Picks Its Own Next Move Breaks Signature Defence
When intrusion tools use a panel of models to choose their next action, detection must shift from artefacts to behaviour — and agent platforms inherit the consequences.
The Human Concierge Is a Fallback Path, Not a Feature
Routing agent failures to a human only works when the escalation contract is explicit: what state is handed over, what the operator may change, and how the correction returns to the agent.
State Management Beats Memory: A Design Note on Agent Persistence
Most agent "memory" failures are state-management failures. Retrieval over past turns cannot enforce invariants; a transaction log can.
Agent Security Is a Lateral-Movement Problem, Not a Prompt Problem
Once agents hold credentials and call tools, their security model is that of a privileged workload. Evaluate them with the same techniques.
Long-Horizon Processing Turns Context Management Into a Scheduling Problem
A larger context window does not remove the limit; it turns context assembly into a scheduling decision about what to load, when, and at what cost.
Judging the Judge: When a Small Model Grades a Large One
Model-as-judge pipelines save cost, but the judge is a measurement instrument that needs calibration, drift monitoring and adversarial testing.