Agents
50 posts — newest first.
-
The Evidence an AI Operator Owes You Before It Acts
A tool-call log answers none of the eight questions an agent incident raises. A decision-time evidence record answers all eight, before the action runs.
-
Your Agent's Safety Argument Has an Expiry Date. Write Down the Defeaters.
An assurance case says why an agent may act unattended. Defeaters say when that stops holding. Wire them to live state and authority drops on its own.
-
Shadow Mode Isn't Evidence Until You Score It
In a seeded simulation, the agent with 95% concordance made 17 harmful high-severity proposals; the one with 88% made none. Score shadow mode properly.
-
A Three-Agent Vote Can Add 9.6 Points at Most: The Break-Even Math of Multi-Agent Systems
Closed-form models for voting, verifiers, pipelines and fan-out, checked against Monte Carlo and the research. When a second agent pays for itself.
-
I Killed an Agent 120 Times to See What Durable Execution Actually Buys You
SIGKILL at every step boundary under four persistence policies. Only one had zero duplicate side effects, and the fix wasn't on the agent's side.
-
Evals for AI SRE Agents: The Test Suite Your On-Call Bot Doesn't Have
Replayed incidents, frozen tool responses, deterministic graders, and pass^k instead of one lucky run. How to evaluate an AI SRE agent without fooling yourself.
-
You've Been Governing the Agents You Run. Here Come the Ones You Don't.
Sierra and Meta propose a front door for agents acting on a customer's behalf. The hard questions are the ones the spec has not answered yet.
-
Agent Sandboxes Start 6× Faster Now. Isolation Just Got Cheaper Than the Workaround.
Cloudflare cut median time-to-interactive from 4.0s to 648ms. The number matters because cold start is why teams share sandboxes they shouldn't share.
-
NVIDIA Moved the Agent Watchdog to a Different Chip
The Open Agent Safety Platform puts enforcement on a DPU, outside the host the agent runs on. The instinct is decades old. The shape is the question.
-
Idempotency Keys: The Thing That Makes a Retry Safe
A timeout never tells you whether the work happened. Idempotency keys resolve that — if you get the concurrency and scope right.
-
Retries, Backoff, Jitter, and Circuit Breakers: The Four Controls That Decide Whether You Recover or Melt Down
A retry is a load multiplier. Backoff spreads it, jitter decorrelates it, a breaker stops it — and agent loops break all three.
-
Agent browsing got 3–7× cheaper and 1.8× slower. Both numbers change your design.
Cloudflare's Kitesurf is a browser built for agents, not people. The measured trade-off, what it can't do, and why cheap browsing rewrites your threat model.
-
A reasoning model just became a platform default. The lock-in isn't where you're looking.
Salesforce made Claude the default model across Agentforce and Slack. Where model dependency actually accrues, and the five exits worth keeping open.
-
Your newest platform user is an agent. Build it a golden path.
Agents are becoming first-class platform citizens. That is an IDP problem: identity, quotas, golden paths, and a portal agents consume as an API.
-
The Model Hardware Standard is the first agent spec where rollback isn't an option
Anthropic's MHS gives agents read/write control of lab and factory hardware. What it guards, what it doesn't, and the controls you have to build yourself.
-
OWASP published an MCP Top 10. Go count your servers before you read it.
OWASP now has a Top 10 dedicated to Model Context Protocol. The list is useful — but the census behind it is the part that should worry your platform team.
-
The runner is the API: why your remediator's contract matters more than your handlers
Everyone reviews the handler that restarts the pod. The safety lives in the runner around it — and handlers that skip it silently void every guarantee.
-
The 47th approval click is the bug
Human-in-the-loop is a real control until volume turns it into a reflex. How approval fatigue converts oversight into a rubber stamp — and the fix.
-
Why your AI agent should not be allowed to act yet
Reading is reversible. Acting is not. Five things that must exist before an agent gets a write path — and the honest reason advisory-forever is also a failure.
-
MCP has a standards body now. That changes your procurement, not your code.
MCP now lives under the Agentic AI Foundation at the Linux Foundation. What vendor-neutral governance actually buys a platform team.
-
Identity was the easy half. Agent authorization is becoming an audit-trail problem.
NIST, a Senate bill and the MCP roadmap converge on one requirement: prove which agent did what, for whom, under whose grant. Your traces do not.
-
MCP's next release deletes your polling loop. Start building for it now.
The MCP roadmap published 22 August 2026 names five priorities. Three change how you operate agent infrastructure — and you can prepare for all three today.
-
An agent breached Hugging Face in 4.5 days. The controls that would have stopped it are boring.
Hugging Face's July 2026 postmortem is the clearest agent-intrusion writeup we have. The failures were IMDS, admission policy, and one shared credential.
-
Your cluster has GPUs. That doesn't make it AI-ready.
CNCF's Kubernetes AI Conformance program is a portability standard. Read it as a self-audit instead and it becomes a genuinely useful platform checklist.
-
Compaction is a reliability event, and you are not measuring it
New research on long-horizon agents finds context compression degrades execution, not knowledge. Treat every compaction as a state transition and instrument it.
-
Agent workflows belong in code, not just visual builders
OpenAI is winding down Agent Builder and platform Evals. Production agent workflows need code, tests, traces, and reviewable contracts.
-
Your agent installs Markdown from the internet and runs it. We spent 20 years learning not to do that.
Agent skills are dependencies with none of the controls. What the 2026 research found, why scanners miss it, and seven fixes for platform teams.
-
Agents are deleting production and nobody is writing the postmortem
Your incident template assumes a deterministic system and a human decision-maker. Agent incidents have neither. Five sections that fix the template.
-
MCP 2026-07-28 shipped: the stateless core is the headline, header routing is the story
The final MCP spec deletes sessions, mirrors requests into HTTP headers, and turns elicitation into multi-round-trip calls. What breaks, and what to audit.
-
Your runbooks are lying to your agents: RAG for on-call knowledge
On-call agents are only as good as what they retrieve. Making runbook RAG fresh, exact-match aware, and poison-resistant — with a runnable starter repo.
-
MCP is the hands, A2A is the handshake: the two-layer agent protocol stack
A2A hit v1.0 with 150+ orgs behind it. MCP connects agents to tools; A2A connects agents to each other. What the two-layer stack means for platform teams.
-
Every observability vendor now sells an AI SRE agent. Here's how to evaluate one.
Datadog, Dynatrace, New Relic, AWS — every incumbent now ships an AI SRE agent. A field guide for evaluating one before it touches production.
-
The OWASP Agentic Top 10, translated for platform teams
OWASP's Agentic Top 10 reads like a security doc, but the mitigations are platform controls. Mapping all ten risks to infrastructure you already run.
-
Your agents need identities, not API keys
Every AI agent is a non-human identity — most run on shared, long-lived API keys no IAM review sees. Per-agent identity and your credential blast radius.
-
Token FinOps: the third budget your agents are spending
Error budgets, context budgets — agents add a third: dollars. Agent tasks burn 5–30× chatbot tokens, and cost-per-token is the wrong metric.
-
Tracing the agent loop: OpenTelemetry's GenAI conventions, read like an SRE
Your agent is a distributed system wearing a chat interface. OpenTelemetry's GenAI conventions make it debuggable — what v1.41 covers and what's moving.
-
Frontier models still fail half your incidents: reading ITBench-AA like an SRE
ITBench-AA put frontier models against 59 real Kubernetes incident diagnoses — all scored below 50%. What the benchmark measures and how to use it.
-
Autonomy is a budget, not a toggle: error budgets for AI operators
SRE solved runaway release risk with error budgets. The same mechanism governs AI agents: authority per action class, demoted fast, promoted slow.
-
The reliability gap: a framework for trusting autonomous SRE agents
An autonomous airline agent rebooked 1,247 passengers wrong in one weather event. Trusting agents is a reliability problem — here's how to measure it.
-
Chaos engineering for MCP: break your tool-call plane before production does
LLM calls fail 1–5% of the time and agent tasks fan out into 10–20 tool calls. How to fault-inject your MCP layer with mcp-chaos before production does.
-
The trust gap: bounded autonomy for AI SRE agents
SREs face 50+ alerts a day at 60% false positives while vendors promise autonomous resolution. The autonomy ladder: what an AI agent should never do alone.
-
MCP goes stateless — what the 2026 release candidate means for your SRE tooling
The 2026-07-28 MCP release candidate deletes the session handshake for a stateless HTTP core and hardens OAuth. What changes for your agents, and when.
-
Context engineering: the window is a budget, not a bucket
The context window is your agent's working memory, not a junk drawer. Four operations — write, select, compress, isolate — and a token budget you allocate.
-
Agent sprawl is your next production incident
Teams shipping AI agents are recreating 2015's microservices sprawl with worse observability. The governance surface that contains it before it pages you.
-
No anonymous inference endpoints — the MCP security principle you're probably violating
The NSA and NIST put MCP on notice: agents are a funnel for prompt injection and privilege abuse. Why 'no anonymous inference endpoints' — and how to comply.
-
Harness engineering: the third phase of AI maturity
Agent = Model + Harness, and in 2026 the harness is the bottleneck. What a production-grade SRE harness contains, with a ~40-line reference implementation.
-
What is function calling (tool use)?
A primer on function calling — the JSON-schema contract that lets an LLM invoke your code. The request/response loop, parallel calls, and forced tools.
-
What is an AI agent? A primer for cloud engineers
A primer on AI agents — the perceive-reason-act loop, what separates an agent from a one-shot LLM call, and the classical agent types SREs now operate.
-
What is Model Context Protocol (MCP)?
A primer on Model Context Protocol — the open standard that lets AI applications talk to tools through one interface. Hosts, clients, servers, transports.
-
The MCP gateway pattern: five jobs your agent runtime can't skip
Letting agents call MCP servers directly repeats the no-API-gateway mistake. The five jobs an MCP gateway must do, with reproducible patterns for each.