Skip to main content
Blog

Notes from building agent systems

Evaluation harnesses, orchestration patterns, memory design and the failures behind them — written up while the details are still fresh.

All postsllm-agents 40agent-security 24multi-agent-systems 17evaluation 12agent-architecture 10agent-evaluation 10agent-safety 10authorisation 9policy-enforcement 9idempotency 8llm-evaluation 8provenance 8
Aerial view of freight trains and tracks in a railway yard
22 Oct 2026·6 min read

Runtime Governance Beats Prompt Governance: Reading the Nvidia Sentry and Kill-Switch Debate

Prompt-level controls are advisory because they live inside a probabilistic system. Runtime interception sits where actions become concrete, and that is where authority belongs.

runtime-governanceagent-safetypolicy-enforcement
A close-up view of a neoclassical building facade featuring detailed arches and columns.
08 Oct 2026·5 min read

Policy-Driven Containment: What an OS Enforcer Can and Cannot Decide

Host-level containment enforces resource and filesystem boundaries but cannot judge whether an agent action was authorised. Separate the enforcement and authorisation layers.

agent-containmentauthorizationos-security
Elegant neoclassical facade of Dublin's Four Courts with iconic white columns.
02 Oct 2026·5 min read

Decision Models Are Not Policy Engines: What a 2B Router Can and Cannot Enforce

Cheap decision models like Strands Decider and Clef are routing primitives, not control surfaces. Treating a fast classifier as an enforcement point moves the failure mode rather than removing it.

agent-routingpolicy-enforcementllm-systems
Cybersecurity professionals working on computer systems, focusing on data protection in a dimly lit room.
28 Sept 2026·6 min read

Intent Is the Missing Signal in Agent Security Telemetry

Security stacks log what agents do, not what they intend. Making declared intent a signed, queryable artefact closes the gap.

agent-securityobservabilityintent-tracking
Close-up of a server rack with illuminated status LEDs and network cables running between units
25 Sept 2026·6 min read

The Agent Sandbox Is a Capability Question Before It Is a Container Question

Containment is less about the isolation technology and more about enumerating, bounding and revoking the capabilities an agent holds at each step of a run.

agent-sandboxingcapability-securityllm-agents
Two travelers stand beside large columns in Chicago, capturing the essence of urban exploration and architectural beauty.
25 Sept 2026·5 min read

Intent Logs: The Missing Artifact Between a Policy and an Agent Run

Allowlists show what an agent may do, not whether a step was warranted. Intent logs capture the per-step decision context at runtime.

agent-observabilityintent-logsruntime-security
A dark, minimalist photo of a computer monitor displaying the ChatGPT interface.
25 Sept 2026·6 min read

Sandbox Escape Is a Capability Budget Problem

Containment failures in agent systems are mispriced capability grants, not missing jailbreaks. The control surface is a per-run budget on reachable systems.

agent-safetycapability-budgetssandboxing
A close-up view of a futuristic bionic prosthetic arm in neon lighting.
23 Sept 2026·5 min read

Identity Without Intent: Why Credentialing Agents Does Not Constrain Them

Authenticating an agent and scoping its token does not bound what it does across a sequence of tool calls. Intent-level policy, evaluated per trajectory, is the control that closes the composition gap.

agent-securityidentitypolicy-enforcement
Close-up of hard disk drive circuitry and connectors, a stock photo
20 Sept 2026·7 min read

Provable Control: Moving Governance From Dashboards to Enforced Invariants

Observability records what an agent did. Governance requires constraints that make certain actions impossible regardless of what the model decides.

agent-governancepolicy-enforcementtool-boundaries