Skip to content

Writing

Your AI Agent Just Did Something. Can You Prove It Was Okay?

A new kind of agent — the defendable agent — is roughly 85–90% built. Here's the complete picture, one organ at a time.

On Tuesday, an AI agent called Nora followed the risk-assessment playbook, drafted an assessment for a customer account, and downgraded their status. On Wednesday the customer complained. On Thursday your compliance officer walks over: What did Nora read? Why those documents and not the newer policy from March? What playbook did she follow — the current one? How sure was she? Which human signed off, under which policy?

A Firewall for What Your Agent Knows

Everyone is building firewalls for what agents do. Sandboxes, budget caps, tool permissions, egress filters — the action side of agent governance is getting crowded, and that is good news. But almost nobody is building firewalls for what agents know. Your agent's context window is an unauthenticated ingestion pipeline: whatever text lands in it becomes, functionally, trusted input. If someone edits a policy document, swaps a mirror, or serves your agent a stale copy of the rules, no sandbox in the world will catch it — because nothing wrong ever executed. The agent just knew the wrong thing.

Split panel: the action side of agent governance — sandboxes, budget caps, tool permissions, egress filters — behind a locked brick wall, while on the knowledge side an open funnel pours unverified documents straight into the context window. We are only securing half the agent architecture.

This post is the hands-on companion to Two Halves of the Governance Problem. That one argued the thesis; this one is a tutorial. In about ten minutes, we take two markdown files and give them a declared, signed, tamper-evident boundary that an agent verifies before loading a single byte. Every command output below is pasted from a real run.

Defensible Agents: When Every Gate Writes Its Verdict

Two weeks ago we shipped an agent that plans deterministically and told the vibes-based era to end. The argument was real — a pure-function planner, zero-token navigation, scored reasons for every unit selected or skipped. But one question kept coming up, and it was fair:

"The plan says it skipped something. But why did gate 3 reject it and not gate 7? What was the actual decision path?"

The plan was evidence. But it was a verdict without a trial transcript.

Today kcp-agent 0.10.0 ships the trial transcript.

OWASP Just Mapped the Agentic Top 10. Here's the Root Cause Four of Them Share.

The OWASP Agentic Top 10 Field Guide: mapping the risks, finding the hidden pattern, and securing the autonomous stack. An AI Agent Core at the centre connected to Knowledge Data Stores, Internal APIs, Model Weights, External Integrations, Actionable APIs, Executive Functions, Policy & Constraints, Human-in-the-Loop, and Audit Logs.

In December 2025, OWASP published the Top 10 for Agentic Applications — 100+ security experts, peer-reviewed, the first serious attempt to name what goes wrong when AI systems plan, act, and talk to each other autonomously.

The list is correct. Every item on it maps to a real incident category. If you're building or deploying AI agents and you haven't read it, stop here and do that first.

This post does two things: a fast field guide to all ten risks, and then a close reading that reveals the pattern four of them share — a pattern the list describes but doesn't name, and which points at a common architectural fix.

Prompt Injection Is SQL Injection for Agents. Here's the Prepared Statement.

The Prepared Statement for Agentic AI: verified operator instructions pass through the structural gate into the secure agentic context; unverified attacker input is blocked and rejected. Why prompt injection is the exact equivalent of SQL injection, and how structural separation fixes it.

One word. "Additionally."

That is all it took to make GitHub's AI agent leak the contents of private repositories to anyone who posted a crafted issue comment. Noma Labs disclosed GitLost on July 6th: an indirect prompt injection attack against GitHub Agentic Workflows where an attacker opens an issue in a public repository and buries instructions inside it. When the agent reads the issue — because that is its job — it cannot tell the difference between those instructions and the instructions from its actual operator. It follows them. Then it posts the private repository contents as a public comment.

The bypass was elegant in the way that most security failures are: the guardrail was checking for obvious refusals. "Additionally" reframed the data-exfiltration request as a legitimate follow-on task. The model did not refuse because the request no longer looked like a refusal case.

Six Months Down the Rabbit Hole

On January 15th I published a blog post about parsing semiconductor part numbers. I thought I was building a PCB component library. I was wrong about what I was building in the most productive way I have ever been wrong about anything.

Six months later there is a knowledge protocol with nineteen releases, a deterministic reference agent, an episodic memory system that indexed this very retrospective's sources, five toolchain products, thirty-one new repositories, and a family vacation that an AI agent can defend to a regulator.

It is time to stop, sit by the fjord, and look back down the hole.

Getting Into the Phone Book of the Agentic Internet Took an Afternoon. Here's Why.

The Phone Book of the Agentic Internet: Beyond Discovery to Verifiability. An iceberg: above the waterline, the afternoon — 16,500+ servers already registered, cryptographic proof of ownership via DNS TXT ed25519, a minimal engineering gap. Below the waterline, the months — the signed knowledge web, deterministic planning as a pure function, infrastructure built for agents rather than eyeballs. At the base, the trust layer: Discovery (AEO) tells an agent you exist; Provenance tells it exactly what it was given and who vouched for it.

This morning Thomas Anglero published a piece called "The phone book of the agentic internet is being written — and I am the first speaker in it". His argument: the MCP registry — the official directory that tells AI agents which services they can interact with, not merely read — is being written right now, and the window between "technically possible" and "everyone does it" is where positions are won. He registered himself as the first professional keynote speaker in it.