Whitepaper16 MIN READ
Engineer the harness, not just the prompt
Define the contracts around an agent's decisions: what state it trusts, which actions can execute, how interrupted work resumes, and what evidence an operator needs to recover safely.
Category
Architecture & engineering
Designing the system around the model: orchestration, memory, context, tools, observability and recovery.
Most of the behaviour of an agentic system is decided outside the model, in how work is decomposed, how context is assembled, how tools are described and bounded, how memory is written and read, and how failures are detected and recovered. This category covers agent architecture patterns, orchestration and delegation, memory and retrieval design, tool and connector engineering, observability and tracing, and the engineering practices that make an agent inspectable enough to evaluate and safe enough to operate.
Published in this category
Agent security6 MIN READ
The permission boundary behind every agent action
An agent can only be evaluated in the context of what its tools allow. Examine identity, delegated authority and action boundaries before you put a workflow in motion.
Whitepaper5 MIN READ
Before your agent can act, define its authority
A working paper for the moment an AI system moves from advice to action. Map identity, permissions, approvals and recovery into an authority model your team can review and test.
Evaluation & assurance5 MIN READ
Your agent passed the test. What does that prove?
A release decision needs a traceable connection between expected behaviour, test conditions and observed results. Here is a practical way to build that connection.
Governance & privacy7 MIN READ
Permission-aware retrieval: the control most RAG diagrams omit
A retrieval system should establish the active principal and filter authorised resources before similarity ranking or model context assembly.
Agent security6 MIN READ
Computer-use agents bring the interface back into the threat model
A computer-use agent treats pixels, accessibility data and interface state as both evidence and an action surface. Security must bind intent to effects beyond the screen.
Architecture & engineering6 MIN READ
A CTO’s checklist before an agent reaches production
Production readiness for an AI agent spans workflow requirements, system identity, evaluation, recovery and operations—not just a working model endpoint.
Architecture & engineering6 MIN READ
Designing a human handoff that preserves context and authority
A safe handoff transfers the decision, evidence, current state and bounded authority—not a transcript dump or a vague request for someone to take over.
Architecture & engineering6 MIN READ
When open-source agent infrastructure is the responsible choice
Openness can improve inspectability, control and portability, but only when an organisation can own the supply chain, operation and evidence it inherits.
Architecture & engineering7 MIN READ
An AI feature, an AI agent and an agentic system are not the same thing
Classify AI by the action path it creates, not the label on the product. The distinction determines ownership, controls, evaluation and release evidence.
Architecture & engineering7 MIN READ
A failure ladder for retrieval-augmented agents
A wrong answer is the final symptom of failures that may begin with source coverage, access control, parsing, retrieval, context assembly, generation or action.
Agent security6 MIN READ
Designing credentials that expire before trust does
Agent credentials should be shorter-lived than the assumptions that justify them. Bind them to a workload, audience, task and action, then prove renewal and revocation work.
Architecture & engineering6 MIN READ
Where smaller models can strengthen agent architecture
Smaller models are not merely budget substitutes. Used behind explicit routing and escalation rules, they can improve latency, locality and architectural control.
Evaluation & assurance6 MIN READ
Golden traces are useful—but they are not gold standards
A reference trace can explain one acceptable journey. Treating it as the only correct path can punish valid behaviour and conceal unsafe alternatives.
Agent security6 MIN READ
Testing an agent’s network-egress boundary
“Internet access” is too broad a permission for an agent. Define destinations, protocols, data-release rules and failure behaviour, then test bypasses against the deployed network path.
Architecture & engineering6 MIN READ
Agentic AI in manufacturing maintenance
Maintenance agents can turn condition signals into coordinated work, but plant safety and control demand bounded action and field verification.
Evaluation & assurance6 MIN READ
How to design a joint AI evaluation lab
A joint lab should be a governed way to create decision evidence across organisations, with shared methods but explicit ownership of systems, data and conclusions.
Architecture & engineering6 MIN READ
Why durable agent workflows need explicit state
Long-running agent work cannot rely on a transcript and hopeful retries. Explicit state makes progress, authority, recovery and completion inspectable across failures.
Strategy & transformation6 MIN READ
The no-agent test: when ordinary automation is the better choice
Agents earn their complexity only when a workflow needs bounded adaptation. A disciplined no-agent test can reveal when rules, search or ordinary software is safer and cheaper.
Agent security6 MIN READ
What least privilege means for an AI agent
Least privilege for agents is not a smaller role assigned once. It is authority narrowed by identity, task, resource, action, time and consequence at every tool call.
Governance & privacy7 MIN READ
Can your agent truly forget?
Deleting a chat is not the same as removing personal data from memory, retrieval, logs, caches, evaluations, backups and learned models.
Evaluation & assurance6 MIN READ
How to evaluate a software-engineering agent on real repository work
A passing patch is only the start. Repository evaluation should test understanding, change quality, security, reviewability and recovery.
Agent security6 MIN READ
Agent protocols are creating a new control surface
Protocols make tools and agents interoperable, but they also standardise discovery, delegation and context exchange. Those interfaces need explicit trust and policy controls.
Evaluation & assurance6 MIN READ
Measure the action, not just the answer
A convincing message can conceal a failed or unauthorised operation. Agent evaluation must inspect tool calls, external state and control decisions.
Governance & privacy6 MIN READ
How to collaborate when client data cannot leave the environment
Keep sensitive data under client control by moving approved methods and people to the environment, exporting only the minimum reviewed evidence needed for collaboration.
Architecture & engineering6 MIN READ
How do you evaluate an agent orchestrator?
An orchestrator should be judged by the workflow it controls: decomposition, routing, state, authority, recovery, verification and stopping—not by a polished final response.
Evaluation & assurance6 MIN READ
Continuous evaluation without alert theatre
Run evaluations often, but interrupt people only when a signal maps to user consequence, a decision owner and a tested response.
Agent security6 MIN READ
A practical security review for an MCP server
Review an MCP server as a privileged protocol adapter: verify tool semantics, OAuth boundaries, token audience, downstream delegation, input handling, isolation, logging and consent.
Agent security6 MIN READ
How to map an AI agent’s attack surface
A useful agent threat model follows data, instructions, identity, tools and state across trust boundaries. This method turns the map into test cases and control decisions.
Agent security6 MIN READ
The dangerous combination of private data, untrusted content and external actions
An agent becomes especially risky when it can read secrets, ingest attacker-controlled material and communicate or act outside the boundary. Design the workflow to break that combination.
Architecture & engineering6 MIN READ
Context is not memory: why the distinction matters
Context is the information available for one inference. Memory is a governed process for retaining, changing and recalling information across time. Confusing them creates silent risk.
Agent security6 MIN READ
What CISOs need to know about tool-using AI agents
Tool-using agents join untrusted input, probabilistic decisions and privileged action. CISOs should govern that path as a security system, not a chatbot feature.
Evaluation & assurance6 MIN READ
Evaluating a customer-support agent from answer to action
A support agent should be judged on whether it resolves the right problem safely, not on whether its first answer sounds convincing.
Architecture & engineering6 MIN READ
Agent observability should answer questions, not produce dashboards
Useful observability reconstructs a decision and its effects. Begin with incident, release and governance questions; then collect the smallest safe evidence that answers them.
Governance & privacy7 MIN READ
A useful autonomy classification starts with consequences
Classify an AI agent by what it can affect, the authority it can exercise and how quickly people can recover—not by how autonomous a demo appears.
Architecture & engineering6 MIN READ
The anatomy of a tool-using AI agent
A tool-using agent is a controlled system around a model, not a model with an API key. Map its runtime layers before deciding what to test, trust or release.
Architecture & engineering6 MIN READ
How to evaluate model-routing decisions
A model router is a policy for allocating quality, cost, latency, privacy and failure risk. Evaluate whether each route serves the workflow—not whether routing is fashionable.
Architecture & engineering6 MIN READ
What can go wrong in a multi-agent handoff?
Multi-agent systems fail between workers when goals, evidence, state, authority and completion semantics do not survive the transfer. Test the protocol, not just each agent.
Strategy & transformation6 MIN READ
Vendor-neutral does not mean anti-vendor
Neutral advice compares dependencies and evidence against the client's decision; it does not pretend every platform is interchangeable or that vendors add no value.
Agent security6 MIN READ
Sandboxing and authorisation solve different problems
A sandbox limits what compromised execution can reach. Authorisation decides what an authenticated actor may do. Secure agents need both, tested independently and together.
Architecture & engineering6 MIN READ
Idempotency for AI agents: preventing one instruction from becoming three actions
Retries, duplicated messages and uncertain tool outcomes can multiply an agent’s effects. Idempotency turns a logical action into one controlled business operation.
Evaluation & assurance6 MIN READ
How should we evaluate an agent that works for days rather than minutes?
Long-running agents accumulate state, dependencies and chances to drift. Evaluation must test checkpoints, recovery, changing conditions and complete outcomes across time.
Governance & privacy6 MIN READ
Autonomy is a spectrum of actions, not a product label
Describe autonomy operation by operation. A multidimensional action map gives leaders a better basis for limits, oversight and release evidence than one marketing label.
Governance & privacy7 MIN READ
Data minimisation for agents that always want more context
Better agent context is not the largest possible context. It is the smallest authorised, relevant and timely data set that supports the task.
Governance & privacy6 MIN READ
What changes when an AI agent can modify itself?
Self-modification turns runtime learning into controlled software change. Separate what may adapt, require evidence for promotion and preserve a recoverable baseline.
Evaluation & assurance6 MIN READ
Testing logistics agents under disruption
A logistics agent earns trust when data becomes late, routes close and plans conflict—not when everything follows the timetable.
Evaluation & assurance6 MIN READ
How to test whether an AI agent recovers gracefully
Inject realistic faults, verify state and judge the recovery path. A retry that finishes the task can still duplicate work or hide uncertainty.
Agent security6 MIN READ
Prompt injection is a workflow-security problem
Prompt injection becomes consequential when untrusted content can steer a model towards privileged tools. Reduce the blast radius by redesigning the workflow around trust and authority.
Architecture & engineering6 MIN READ
The foundation model is only one dependency in an agentic system
Model selection matters, but production behaviour emerges from an entire dependency graph. Review the system that turns model output into business effects.
Know what your agents will do before you let them do it.
Bring one agent workflow and the decision in front of you. Gaurav Tiwari replies personally within 1 working day.