Agent security6 MIN READ
The permission boundary behind every agent action
An agent can only be evaluated in the context of what its tools allow. Examine identity, delegated authority and action boundaries before you put a workflow in motion.
THE SOFTLANDER BLOG
Architecture & engineering
Designing the system around the model: orchestration, memory, context, tools, observability and recovery.
In Architecture & engineering
47 articlesEvaluation & assurance5 MIN READ
Your agent passed the test. What does that prove?
A release decision needs a traceable connection between expected behaviour, test conditions and observed results. Here is a practical way to build that connection.
Governance & privacy7 MIN READ
Permission-aware retrieval: the control most RAG diagrams omit
A retrieval system should establish the active principal and filter authorised resources before similarity ranking or model context assembly.
Agent security6 MIN READ
Computer-use agents bring the interface back into the threat model
A computer-use agent treats pixels, accessibility data and interface state as both evidence and an action surface. Security must bind intent to effects beyond the screen.
Architecture & engineering6 MIN READ
A CTO’s checklist before an agent reaches production
Production readiness for an AI agent spans workflow requirements, system identity, evaluation, recovery and operations—not just a working model endpoint.
Architecture & engineering6 MIN READ
Designing a human handoff that preserves context and authority
A safe handoff transfers the decision, evidence, current state and bounded authority—not a transcript dump or a vague request for someone to take over.
Architecture & engineering6 MIN READ
When open-source agent infrastructure is the responsible choice
Openness can improve inspectability, control and portability, but only when an organisation can own the supply chain, operation and evidence it inherits.
Architecture & engineering7 MIN READ
An AI feature, an AI agent and an agentic system are not the same thing
Classify AI by the action path it creates, not the label on the product. The distinction determines ownership, controls, evaluation and release evidence.
Architecture & engineering7 MIN READ
A failure ladder for retrieval-augmented agents
A wrong answer is the final symptom of failures that may begin with source coverage, access control, parsing, retrieval, context assembly, generation or action.
Agent security6 MIN READ
Designing credentials that expire before trust does
Agent credentials should be shorter-lived than the assumptions that justify them. Bind them to a workload, audience, task and action, then prove renewal and revocation work.
Architecture & engineering6 MIN READ
Where smaller models can strengthen agent architecture
Smaller models are not merely budget substitutes. Used behind explicit routing and escalation rules, they can improve latency, locality and architectural control.
Evaluation & assurance6 MIN READ
Golden traces are useful—but they are not gold standards
A reference trace can explain one acceptable journey. Treating it as the only correct path can punish valid behaviour and conceal unsafe alternatives.
KEEP EXPLORING
Take the thinking
into your next discussion.
Read the method, assumptions and questions to ask.
A little more clarity
Questions worth asking.
Start with the questions that shape a better decision.
Which enterprise agent questions does the Softlander blog examine?
The blog examines where agents create business value, how teams define release evidence, how authority and tool access should be bounded, and how engineering, security and governance owners can make a shared decision.
Who are the articles written for?
They are written for product, engineering, AI platform, security, governance and transformation leaders responsible for moving an agent workflow from idea or pilot towards accountable operation.
How do the articles relate to Softlander’s services?
Articles explain the problems and decision methods behind the consultancy’s service direction. They are educational material and do not replace a scoped review of an organisation’s actual system.