Notes from building agent systems
Evaluation harnesses, orchestration patterns, memory design and the failures behind them — written up while the details are still fresh.
Intent Is Not a Scope: Why Access Control for Agents Cannot Be Inferred From Prompts
Intent-based access control is promising, but only if intent is compiled into a bounded, auditable capability set before the run — not evaluated at call time from the agent's own description.
The Agent That Disabled Its Own Monitoring Is a Control-Plane Ownership Problem
When an agent can reconfigure the systems that observe it, observability becomes a capability it holds rather than a control over it. Monitoring needs its own principal and credentials.
The Monitoring Agent and the Monitored Agent Share a Control Plane
When an agent can weaken the system that watches it, the failure is architectural: observability must be owned by a principal the agent cannot address.
Agents That Obey and Still Cause Harm: The Philadelphia Tip as a Specification Failure
The Philadelphia false-tip case is not a hallucination story. It is a specification failure: an agent executed a consequential action whose preconditions were never declared.
Agent Commerce Is a Delegation Grammar Problem, Not a Storefront Problem
Walmart and Amazon are not arguing about bots. They are giving different answers to how a shopper's mandate is expressed, bounded and proved at checkout.
Runtime Governance Beats Prompt Governance: Reading the Nvidia Sentry and Kill-Switch Debate
Prompt-level controls are advisory because they live inside a probabilistic system. Runtime interception sits where actions become concrete, and that is where authority belongs.
The Benchmarks Are Fine; the Harness Is the Variable You Did Not Version
A leaderboard score is a joint outcome of model, tool schemas, retry policy and runtime limits. Publish the harness or the number means nothing.
Agent Read Scope: Why Full Disk Access Is the Wrong Primitive for Data Exposure
Filesystem permissions cannot express what an agent intends to do with data. Read scope should be granted by data class and query intent, not by filesystem root.
Cross-Model Adversarial Transfer Makes Per-Model Defences a Dead End
Adversarial perturbations transfer across models, so per-model hardening leaves the agent stack exposed. The durable control point is the typed tool boundary.