Notes from building agent systems
Evaluation harnesses, orchestration patterns, memory design and the failures behind them — written up while the details are still fresh.
Full Disk Access Is a Coarse Grant: Scoping Agent Read Rights to Data Classes
macOS Full Disk Access is one boolean over every user file. The durable fix is per-data-class read rights with provenance on every read.
The Cleanup Asymmetry: Why Incident Response Assumes an Operator Who Does Not Exist
Autonomous agent incidents expose a gap: playbooks assume a single accountable operator, but responsibility is distributed across vendors, frameworks, integrators and users.
Agent Swarms Need a Discovery Contract, Not a Shared Database
At swarm scale, the hard problem is agreeing on how facts are named, versioned and retired. A discovery contract must precede any shared store.
Leaked Output Is a Provenance Failure, Not a Model Alignment Failure
When an agent publishes user artefacts it should never have exported, the defect is missing provenance and taint tracking on data flowing into generated output.
Prediction-Market Agents Need a Resolution Ledger, Not a Confidence Score
When an agent places a position, its probabilistic output becomes a settlement obligation. The artefact that matters is a per-claim resolution ledger with provenance, not a calibrated number.
Audit Trails for Agents Are a Write-Ahead Log Problem, Not a Dashboard Problem
Agent accountability is only provable when every tool call, credential use and state transition is appended before it executes, making the log a runtime dependency.
Institutional Memory: What an Agent Should Remember and What It Must Forget
Persistent agent memory is only useful with provenance and expiry; unbounded recall turns a context store into a liability with no audit trail.
Memory Is a Write-Policy Problem: Retention, Provenance and the Cost of Remembering
Most agent memory failures originate at write time, not retrieval. Provenance, sensitivity classes and schema-level expiry fix them earlier and cheaper.