Skip to main content
Blog

Notes from building agent systems

Evaluation harnesses, orchestration patterns, memory design and the failures behind them — written up while the details are still fresh.

All postsllm-agents 40agent-security 24multi-agent-systems 17evaluation 12agent-architecture 10agent-evaluation 10agent-safety 10authorisation 9policy-enforcement 9idempotency 8llm-evaluation 8provenance 8
Close-up of a server rack with stacked networking equipment and status lights
28 Oct 2026·6 min read

Intent Is Not a Scope: Why Access Control for Agents Cannot Be Inferred From Prompts

Intent-based access control is promising, but only if intent is compiled into a bounded, auditable capability set before the run — not evaluated at call time from the agent's own description.

agent-securityaccess-controlllm-agents
Close-up of a retro circuit board showing intricate copper traces and electronic components
22 Oct 2026·6 min read

Agent Commerce Is a Delegation Grammar Problem, Not a Storefront Problem

Walmart and Amazon are not arguing about bots. They are giving different answers to how a shopper's mandate is expressed, bounded and proved at checkout.

agent-commercedelegationauthorisation
Minimalist facade with orange and white geometric panels
22 Oct 2026·6 min read

Dormant Agents Keep Their Keys: Credential Reclamation as a Lifecycle Stage

An agent that stops running but keeps its credentials is an unattended principal. Fleet hygiene must schedule credential expiry, not treat it as a decommissioning afterthought.

agent-lifecyclecredential-managementagent-security
Close-up of white woven fabric with small textured holes, a stock photo
03 Oct 2026·5 min read

Agentic Checkout Breaks the Merchant's Authorisation Model, Not Its Inventory

Blocking shopping agents is not hostility to automation. It is a rational response to a payment credential that arrives without a verifiable consent record.

agentic-commerceauthorisationpayments
Close-up of a cactus covered in sharp thorns against a blurred green background
29 Sept 2026·6 min read

Checkout Is Not a Tool Call: Why Browser Agents Break Commerce Authorisation

Browser agents can drive checkout flows, but a purchase is a consent event. This essay argues for scoped spend credentials and an agent-facing checkout contract.

agentic-commerceauthorisationbrowser-agents
Colorful spectrum of light refracted through a glass prism, creating a rainbow effect
28 Sept 2026·6 min read

Refusal Is a Routing Decision, Not a Model Property

Agent overreach is usually a missing authorisation decision upstream of the model. Safety belongs in the request path, not only in alignment training.

agent-safetypolicy-enginetool-use
Close-up of a server rack showing network cables and indicator lights in a dimly lit data centre.
24 Sept 2026·6 min read

An Agent That Reaches a Government Portal Is an Access-Control Failure

The reported intrusion into an Australian health portal shows agents need scoped, auditable access to public services — not just rate limits.

agent-access-controlauthorisationpublic-sector-ai
In the Space Station Processing Facility, technicians and factory workers assemble parts on the Japanese remote manipulator system, while li
24 Sept 2026·5 min read

Payment Authority for Agents: Scoped Spend Credentials Beat Stored Cards

Stored cards grant unbounded, reusable authority. Scoped spend tokens bind amount, merchant, expiry and task, making agent payments revocable and auditable.

agent-paymentsspend-credentialsauthorisation
Close-up of the ornate archways and columns at the Minnesota State Capitol building.
20 Sept 2026·6 min read

Agent Credentials Are a Policy Problem, Not a Prompt Problem

Credentials without scoped authority turn every prompt injection into privilege escalation. Design the capability grant, not the instruction text.

agent-securitycapability-grantsprompt-injection