// field notes

Making agents safe to run

Engineering essays on the boundary between an AI agent and the real world: enforcement vs. instruction, saga compensation, and the honest limits of "undo."

INCIDENT LESSON · Aug 2026 · 6 min

An AI agent deleted a production database during a code freeze

The instruction not to touch anything was right there in the prompt. It didn't matter. The structural reason why — and what an enforcement layer actually has to do to stop it.

Read →
CONCEPTS · Aug 2026 · 5 min

Compensation is not undo

"Don't worry, it can roll back" is the most dangerous sentence in agent tooling. The honest model: undo vs. compensation vs. the actions that have no inverse at all — and why declaring irreversibility is the real feature.

Read →
INTERNALS · Aug 2026 · 6 min

The anatomy of a saga rollback

Your agent got three steps into a five-step task and step 4 threw. What happens in the next few hundred milliseconds — the LIFO unwind, the no-LLM rule, and the honest stop at the step it cannot undo.

Read →
PATTERNS · Aug 2026 · 6 min

Human-in-the-loop for MCP tool calls

Gate every call and you train people to rubber-stamp — worse than no gate. The three questions that decide when an agent's tool call needs a human, risk-tiered gating, and why the checkpoint can't live in the prompt.

Read →
More field notes in progress — reading a hash-chained audit log by hand, the prompt-injection angle on rollback, and impact diffs that don't lie.