https://ericmacdougall.com/journal/ Long-form essays about running AI agents in production. en Sat, 07 Nov 2026 15:00:00 +0000 https://ericmacdougall.com/journal/delivery-you-can-recover/ https://ericmacdougall.com/journal/delivery-you-can-recover/ Sat, 07 Nov 2026 15:00:00 +0000 Journal before the risky step, lock the scope, refuse blind retries and leave one checked way out; then never delete agent logs you have not verified saved. https://ericmacdougall.com/journal/guards-that-say-which-way-they-lean/ https://ericmacdougall.com/journal/guards-that-say-which-way-they-lean/ Sat, 07 Nov 2026 15:00:00 +0000 How guards for commands, process stops and production deletes decide when they cannot tell, what each one leans toward, and why they are best-effort controls and not a complete boundary. https://ericmacdougall.com/journal/escalation-rules-and-the-bill/ https://ericmacdougall.com/journal/escalation-rules-and-the-bill/ Sat, 07 Nov 2026 15:00:00 +0000 Write the escalation rule as a table, count failures only from receipts the tools wrote, and put a budget wrapper with a memory around each expensive command. https://ericmacdougall.com/journal/the-spec-the-reviewers-and-the-evidence-ledger/ https://ericmacdougall.com/journal/the-spec-the-reviewers-and-the-evidence-ledger/ Sat, 07 Nov 2026 15:00:00 +0000 Write down what done means before the work, bind two different reviewers to that exact text, and let a merge gate read every result on the exact commit. https://ericmacdougall.com/journal/why-agents-cannot-grade-their-own-work/ https://ericmacdougall.com/journal/why-agents-cannot-grade-their-own-work/ Sat, 07 Nov 2026 15:00:00 +0000 An author calling work done is a claim, not evidence; a small harness turns it into rules and checks a reviewer approval against the stage, commit and packet it actually read. https://ericmacdougall.com/journal/late-replies-must-match-the-current-identity-before-they-write/ https://ericmacdougall.com/journal/late-replies-must-match-the-current-identity-before-they-write/ Thu, 05 Nov 2026 15:00:00 +0000 Four products, one bug: a late reply, cleanup step or expired lease changed current state. Carry identity into every write and test the orderings with a controlled clock. https://ericmacdougall.com/journal/a-path-contract-has-more-readers-than-the-review-names/ https://ericmacdougall.com/journal/a-path-contract-has-more-readers-than-the-review-names/ Thu, 05 Nov 2026 15:00:00 +0000 When a fix changes a shared path, review finds one broken reader per round. Make the reader inventory a failing test with an empty allowlist before the first fix. https://ericmacdougall.com/journal/a-request-ledger-has-to-survive-its-own-extractor/ https://ericmacdougall.com/journal/a-request-ledger-has-to-survive-its-own-extractor/ Thu, 05 Nov 2026 15:00:00 +0000 An audit of 236 requests found 52 stalled, and the capture fix could be silenced by one long message. How to build request capture that cannot switch itself off. https://ericmacdougall.com/journal/parallel-branches-need-one-owner-for-the-migration-index/ https://ericmacdougall.com/journal/parallel-branches-need-one-owner-for-the-migration-index/ Thu, 05 Nov 2026 15:00:00 +0000 Agent branches that pick their own migration numbers collide. A landing order with one owner, reserve-first indexes and a merge-based re-chain recipe keep the chain intact. https://ericmacdougall.com/journal/nothing-that-runs-should-live-where-cleanup-can-reach-it/ https://ericmacdougall.com/journal/nothing-that-runs-should-live-where-cleanup-can-reach-it/ Thu, 05 Nov 2026 15:00:00 +0000 An agent harness that grew in a scratch folder lost most of its runnable code in about 80 seconds. How to spot the pattern, recover, and keep code and gates out of cleanup's reach. https://ericmacdougall.com/journal/when-two-hooks-disagree-write-the-precedence-order-down/ https://ericmacdougall.com/journal/when-two-hooks-disagree-write-the-precedence-order-down/ Thu, 05 Nov 2026 15:00:00 +0000 A Stop hook said push before stopping and the runner said never push. Two agents resolved it correctly, and a written precedence order keeps that from resting on judgment. https://ericmacdougall.com/journal/the-agents-used-8-percent-of-the-host-the-polling-used-more/ https://ericmacdougall.com/journal/the-agents-used-8-percent-of-the-host-the-polling-used-more/ Thu, 05 Nov 2026 15:00:00 +0000 Agent engines took 3.6 of 44 cores while supervisors forked 5,751 processes a second, and the idle host was disk-bound on shared storage. Measure the control plane first. https://ericmacdougall.com/journal/check-that-each-git-worktree-resolves-to-itself/ https://ericmacdougall.com/journal/check-that-each-git-worktree-resolves-to-itself/ Thu, 05 Nov 2026 15:00:00 +0000 One shared git setting made 17 linked worktrees write into a live tree. How to detect it with one command, prove the fix with a negative control and keep worktree isolation real. https://ericmacdougall.com/journal/a-fail-closed-allow-list-can-silently-disable-your-failover/ https://ericmacdougall.com/journal/a-fail-closed-allow-list-can-silently-disable-your-failover/ Thu, 05 Nov 2026 15:00:00 +0000 A strict model allow-list refused every request on a relay's backup path for two weeks. How to spot it, probe fallbacks with real payloads and alert on zero successes. https://ericmacdougall.com/journal/fourteen-control-files-became-one-release-command/ https://ericmacdougall.com/journal/fourteen-control-files-became-one-release-command/ Thu, 05 Nov 2026 15:00:00 +0000 A site release had 14 control files and a 923 MB archive, and still could not ship. What one refusing, reading-back release script kept, and the gap it still has. https://ericmacdougall.com/journal/measure-the-split-before-you-redesign-the-agent-loop/ https://ericmacdougall.com/journal/measure-the-split-before-you-redesign-the-agent-loop/ Thu, 05 Nov 2026 15:00:00 +0000 A five-second computer-use click had about 0.3 seconds of server time. Timing each verb two ways killed a push-channel redesign and found the real overhead in the helper path. https://ericmacdougall.com/journal/tests-that-spawn-processes-need-a-group-a-cap-and-a-stop-order/ https://ericmacdougall.com/journal/tests-that-spawn-processes-need-a-group-a-cap-and-a-stop-order/ Thu, 05 Nov 2026 15:00:00 +0000 A loop test without its own cap left about 49,000 orphaned processes. How to contain spawning tests with process groups, an independent cap, and a cleanup order that ends the growth first. https://ericmacdougall.com/journal/landed-is-not-done-define-done-before-agents-report-it/ https://ericmacdougall.com/journal/landed-is-not-done-define-done-before-agents-report-it/ Thu, 05 Nov 2026 15:00:00 +0000 A status audit found seven false completion claims, including "proven live" beside 217 failed runs of 246. How to define done so only a live check can satisfy it. https://ericmacdougall.com/journal/a-rate-is-a-belief-with-a-width/ https://ericmacdougall.com/journal/a-rate-is-a-belief-with-a-width/ Thu, 05 Nov 2026 15:00:00 +0000 Pseudo counts make a rate's uncertainty explicit, pooling steadies thin slices, and probability matching routes traffic while you learn. Worked in counts. https://ericmacdougall.com/journal/counting-honestly-ranges-zero-failures-paired-changes/ https://ericmacdougall.com/journal/counting-honestly-ranges-zero-failures-paired-changes/ Thu, 05 Nov 2026 15:00:00 +0000 Report every AI success rate as a range, gate automation on its lower bound, size clean test sets from the bar, and judge a change by what it flipped. https://ericmacdougall.com/journal/your-answer-key-is-the-product/ https://ericmacdougall.com/journal/your-answer-key-is-the-product/ Thu, 05 Nov 2026 15:00:00 +0000 A model is only as measurable as its gold set: blind, double labelled, stratified, versioned, split by time, and checked with kappa before you trust it. https://ericmacdougall.com/journal/pick-the-metric-by-what-a-mistake-does-next/ https://ericmacdougall.com/journal/pick-the-metric-by-what-a-mistake-does-next/ Thu, 05 Nov 2026 15:00:00 +0000 Precision, recall and miss rate are not a matter of taste. The harm of each wrong action picks the metric, and walking the threshold sets its value. https://ericmacdougall.com/journal/counts-out-of-a-thousand-what-a-flag-really-means/ https://ericmacdougall.com/journal/counts-out-of-a-thousand-what-a-flag-really-means/ Thu, 05 Nov 2026 15:00:00 +0000 A 90% detector can be wrong about most of what it flags. Count out of 1,000 at the real base rate before you let a flag block, note or route. https://ericmacdougall.com/journal/a-99-percent-approval-rate-is-not-an-accuracy-number/ https://ericmacdougall.com/journal/a-99-percent-approval-rate-is-not-an-accuracy-number/ Thu, 05 Nov 2026 15:00:00 +0000 A reviewer approved 99% of drafts while 1 in 12 was wrong. How to measure correctness with a blind audit, outcome truth and seeded items. https://ericmacdougall.com/journal/let-a-business-operator-request-a-site-change-without-handing-ai-a/ https://ericmacdougall.com/journal/let-a-business-operator-request-a-site-change-without-handing-ai-a/ Thu, 22 Oct 2026 15:00:00 +0000 A non-engineer can request a bounded change without becoming a proxy for unchecked code. Run generation without network or deployment credentials, enforce an exact file boundary, build and review a pinned artifact, and promote through a separate trusted deploy authority. https://ericmacdougall.com/journal/the-offline-test-that-spent-the-production-quota/ https://ericmacdougall.com/journal/the-offline-test-that-spent-the-production-quota/ Thu, 22 Oct 2026 15:00:00 +0000 A fake transport is not a network boundary, and an empty negative control is not evidence. Deny egress at the test runner, keep production credentials out, prove the block with a harmless control, and preserve an unknown outcome when readback is unavailable. https://ericmacdougall.com/journal/the-192-core-server-was-still-waiting-on-one-kernel-worker/ https://ericmacdougall.com/journal/the-192-core-server-was-still-waiting-on-one-kernel-worker/ Thu, 22 Oct 2026 15:00:00 +0000 High CPU capacity does not guarantee progress when a serialized cleanup path stalls. Reduce sandbox churn, terminate whole process groups, add mechanism-specific early signals, and replay alarms against observed samples before retuning. Keep a local diagnosis distinct from an unverified upstream cause. https://ericmacdougall.com/journal/let-an-agent-ask-for-a-credential-without-ever-seeing-it/ https://ericmacdougall.com/journal/let-an-agent-ask-for-a-credential-without-ever-seeing-it/ Thu, 22 Oct 2026 15:00:00 +0000 Separate the agent’s request from the secret value. Bind operator input to the live run, requesting step, target and logical credential; resume the waiting work without returning the value to the transcript. https://ericmacdougall.com/journal/shared-git-state-is-the-fleet-coordination-bug/ https://ericmacdougall.com/journal/shared-git-state-is-the-fleet-coordination-bug/ Thu, 22 Oct 2026 15:00:00 +0000 Git worktrees isolate checked-out files but leave shared repository metadata and remote publication requiring coordination. Several observed failures had distinct causes and required different controls. https://ericmacdougall.com/journal/restart-is-where-a-deletion-tool-can-lose-the-only-backup/ https://ericmacdougall.com/journal/restart-is-where-a-deletion-tool-can-lose-the-only-backup/ Thu, 22 Oct 2026 15:00:00 +0000 A deterministic archive key and a completion receipt written after source deletion can make a retry overwrite the only backup. Model each external write, verification and destructive local effect as durable states. https://ericmacdougall.com/journal/when-an-agent-writes-a-one-off-script-it-skips-your-safety-rails/ https://ericmacdougall.com/journal/when-an-agent-writes-a-one-off-script-it-skips-your-safety-rails/ Thu, 22 Oct 2026 15:00:00 +0000 A one-off operations script can bypass approval capture and host refusal even when the underlying operation works. Make the shared CLI the policy boundary and improve it when agents reveal missing options. https://ericmacdougall.com/journal/what-the-subscription-meter-actually-charged-for-tokens/ https://ericmacdougall.com/journal/what-the-subscription-meter-actually-charged-for-tokens/ Thu, 22 Oct 2026 15:00:00 +0000 API list prices were a poor proxy for subscription quota. Isolated token-class experiments measured reads, writes and output separately and changed the optimization ranking. https://ericmacdougall.com/journal/the-five-minute-cache-cliff-that-made-waiting-subagents-expensive/ https://ericmacdougall.com/journal/the-five-minute-cache-cliff-that-made-waiting-subagents-expensive/ Thu, 22 Oct 2026 15:00:00 +0000 A short cache lifetime mismatched to subagents waiting behind long commands caused large prompt-prefix rewrites. Configure lifetime by worker role and verify positive and negative paths; meter savings remain unmeasured. https://ericmacdougall.com/journal/one-per-session-line-broke-the-shared-prompt-cache/ https://ericmacdougall.com/journal/one-per-session-line-broke-the-shared-prompt-cache/ Thu, 22 Oct 2026 15:00:00 +0000 A per-session value in an early tool description made otherwise stable headless prompts diverge; route dynamic values only to the client that consumes them and keep remaining entropy separate. https://ericmacdougall.com/journal/a-merge-gate-must-prove-the-tests-ran/ https://ericmacdougall.com/journal/a-merge-gate-must-prove-the-tests-ran/ Thu, 22 Oct 2026 15:00:00 +0000 A successful process exit does not prove tests executed; gates must distinguish command success, test execution, baseline comparison and unknown evidence. https://ericmacdougall.com/journal/a-merge-needs-proof-of-no-change/ https://ericmacdougall.com/journal/a-merge-needs-proof-of-no-change/ Thu, 22 Oct 2026 15:00:00 +0000 A similarity heuristic cannot prove reviewed work is already merged; simulate the exact merge against current main and compare the resulting tree, including reverts relative to the task fork point. https://ericmacdougall.com/journal/key-rotation-has-two-readers-and-one-writing-authority/ https://ericmacdougall.com/journal/key-rotation-has-two-readers-and-one-writing-authority/ Thu, 22 Oct 2026 15:00:00 +0000 During key migration, prepare and try one decryption candidate at a time so malformed fallback configuration cannot break a valid current-key read; new writes still use one current authority. https://ericmacdougall.com/journal/retire-worktrees-by-consumer-lifetime-not-terminal-task-status/ https://ericmacdougall.com/journal/retire-worktrees-by-consumer-lifetime-not-terminal-task-status/ Thu, 22 Oct 2026 15:00:00 +0000 A terminal task state is only a candidate; safe worktree retirement requires the last consumer to release a shared lease, a fresh owner snapshot and verified private recovery outside the target. https://ericmacdougall.com/journal/design-the-evidence-review-screen-before-automating-the-decision/ https://ericmacdougall.com/journal/design-the-evidence-review-screen-before-automating-the-decision/ Thu, 22 Oct 2026 15:00:00 +0000 An evidence-review product must separate read-only inspection, bounded extraction proposals, conflict review and explicit human acceptance; the model does not inherit the decision right. https://ericmacdougall.com/journal/a-read-only-observer-still-needs-backpressure/ https://ericmacdougall.com/journal/a-read-only-observer-still-needs-backpressure/ Thu, 22 Oct 2026 15:00:00 +0000 Read-only describes data mutation, not resource cost. A safe observer checks pressure during long reads, stops only its owned child, preserves last-good data and makes incomplete evidence explicit. https://ericmacdougall.com/journal/a-fleet-pause-must-reach-the-process-tree/ https://ericmacdougall.com/journal/a-fleet-pause-must-reach-the-process-tree/ Thu, 22 Oct 2026 15:00:00 +0000 A task is not cancelled until its lifetime reaches admission waits, Git, install descendants and filesystem recovery; cancellation must leave a state the next attempt can trust. https://ericmacdougall.com/journal/the-dependency-cache-belongs-before-the-credential-boundary/ https://ericmacdougall.com/journal/the-dependency-cache-belongs-before-the-credential-boundary/ Thu, 22 Oct 2026 15:00:00 +0000 A dependency cache is shared mutable state. Bind identity to exact inputs, publish complete trees atomically, limit install credentials and choose deliberately between shared reuse and per-step copy. https://ericmacdougall.com/journal/measure-context-costs-before-building-an-agent-steward/ https://ericmacdougall.com/journal/measure-context-costs-before-building-an-agent-steward/ Thu, 22 Oct 2026 15:00:00 +0000 Model the fleet-wide share a context change reaches before funding a Steward. Injected-text share, cached-token cost and total usage are different denominators. https://ericmacdougall.com/journal/a-safe-ai-widget-is-a-small-capability-system/ https://ericmacdougall.com/journal/a-safe-ai-widget-is-a-small-capability-system/ Thu, 22 Oct 2026 15:00:00 +0000 Treat model-authored JavaScript as executable content: constrain its language, isolate browser capabilities, pin the trusted bridge and bind the serving route to the reviewed version. https://ericmacdougall.com/journal/make-model-failover-preserve-the-agent-contract/ https://ericmacdougall.com/journal/make-model-failover-preserve-the-agent-contract/ Tue, 20 Oct 2026 15:00:00 +0000 A fallback route changes more than a model name: tool representation, role separation, budgets, privacy and refusal behavior can all differ. https://ericmacdougall.com/journal/design-recovery-semantics-into-the-safety-state-machine/ https://ericmacdougall.com/journal/design-recovery-semantics-into-the-safety-state-machine/ Tue, 20 Oct 2026 15:00:00 +0000 A safety gate needs to preserve evidence and conservative uncertainty while distinguishing historical observations from current authority to hold execution. https://ericmacdougall.com/journal/decompose-work-around-contracts-and-integration-costs/ https://ericmacdougall.com/journal/decompose-work-around-contracts-and-integration-costs/ Tue, 20 Oct 2026 15:00:00 +0000 Use the whole-versus-pieces experiment to explain when decomposition creates useful independent boundaries and when repeated setup fragments an interdependent implementation. https://ericmacdougall.com/journal/personal-agents-need-private-authority-recoverable-work-and-measured/ https://ericmacdougall.com/journal/personal-agents-need-private-authority-recoverable-work-and-measured/ Tue, 20 Oct 2026 15:00:00 +0000 Long-running personal agents need user-specific compute, storage, credentials and network authority. Multiplexed conversations alone do not create isolation. https://ericmacdougall.com/journal/trace-agent-decisions-without-turning-telemetry-into-a-private-content/ https://ericmacdougall.com/journal/trace-agent-decisions-without-turning-telemetry-into-a-private-content/ Tue, 20 Oct 2026 15:00:00 +0000 Keep the links needed to reconstruct decisions and reconcile effects while minimizing stored prompts, credentials and sensitive low-entropy data. https://ericmacdougall.com/journal/port-agent-controls-across-runtimes-without-assuming-hook-parity/ https://ericmacdougall.com/journal/port-agent-controls-across-runtimes-without-assuming-hook-parity/ Tue, 20 Oct 2026 15:00:00 +0000 Different CLIs, IDEs and operating systems expose different observation and denial points. Port the contract, then prove each runtime route. https://ericmacdougall.com/journal/build-the-test-harness-around-cross-system-invariants/ https://ericmacdougall.com/journal/build-the-test-harness-around-cross-system-invariants/ Tue, 20 Oct 2026 15:00:00 +0000 A test should encode the business or security promise across components, with an oracle independent of the actor and an outer containment boundary. https://ericmacdougall.com/journal/separate-probabilistic-development-from-deterministic-shipping/ https://ericmacdougall.com/journal/separate-probabilistic-development-from-deterministic-shipping/ Tue, 20 Oct 2026 15:00:00 +0000 Models can propose changes and repairs. A narrow release controller can decide whether exact reviewed and tested artifacts meet a fixed contract, without reasoning its way around it. https://ericmacdougall.com/journal/regional-cells-need-one-home-for-mutable-authority/ https://ericmacdougall.com/journal/regional-cells-need-one-home-for-mutable-authority/ Tue, 20 Oct 2026 15:00:00 +0000 Portable containers do not make state ownership, residency and failover portable. Define one authoritative home for mutable state before adding regions. https://ericmacdougall.com/journal/agent-fleets-need-explicit-ownership-transfers-before-more-workers/ https://ericmacdougall.com/journal/agent-fleets-need-explicit-ownership-transfers-before-more-workers/ Tue, 20 Oct 2026 15:00:00 +0000 More workers help only when task ownership, resource admission and shared-state authority remain coherent. https://ericmacdougall.com/journal/parallel-ai-checks-need-a-release-contract-before-they-need-more-workers/ https://ericmacdougall.com/journal/parallel-ai-checks-need-a-release-contract-before-they-need-more-workers/ Tue, 20 Oct 2026 15:00:00 +0000 Parallel checks help only when the release condition, ownership of output fields and behavior of late branches are defined in advance. https://ericmacdougall.com/journal/memory-success-has-to-confirm-the-requester-address-and-receipt/ https://ericmacdougall.com/journal/memory-success-has-to-confirm-the-requester-address-and-receipt/ Tue, 20 Oct 2026 15:00:00 +0000 Memory changes future behavior across turns. Tenant scope, namespace, origin, current permissions and deletion semantics matter as much as retrieval relevance. https://ericmacdougall.com/journal/a-retrieval-system-needs-to-know-who-will-read-the-answer/ https://ericmacdougall.com/journal/a-retrieval-system-needs-to-know-who-will-read-the-answer/ Tue, 20 Oct 2026 15:00:00 +0000 Requester authorization and answer-audience authorization are separate questions. A user may be allowed to read something that cannot be disclosed into the destination conversation. https://ericmacdougall.com/journal/design-agent-supervision-around-delivery-intervention-and-bounded/ https://ericmacdougall.com/journal/design-agent-supervision-around-delivery-intervention-and-bounded/ Mon, 19 Oct 2026 15:00:00 +0000 Use deterministic event observation, bounded independent model judgment and a constrained intervention controller; spend review effort where it changes accepted outcomes. https://ericmacdougall.com/journal/budget-agent-work-before-dispatch-then-reconcile-what-actually-happened/ https://ericmacdougall.com/journal/budget-agent-work-before-dispatch-then-reconcile-what-actually-happened/ Mon, 19 Oct 2026 15:00:00 +0000 A token counter after completion cannot enforce a hard pre-dispatch exposure bound across parallel work and ambiguous provider outcomes. https://ericmacdougall.com/journal/route-ai-work-by-the-cost-of-accepted-outcomes/ https://ericmacdougall.com/journal/route-ai-work-by-the-cost-of-accepted-outcomes/ Mon, 19 Oct 2026 15:00:00 +0000 Choose among routes that preserve privacy, authorization, tool semantics and required quality, then optimize expected accepted-work cost under quota and latency constraints. https://ericmacdougall.com/journal/turn-engineering-standards-into-agent-execution-contracts/ https://ericmacdougall.com/journal/turn-engineering-standards-into-agent-execution-contracts/ Mon, 19 Oct 2026 15:00:00 +0000 Agents need explicit constraints at admission, implementation, review and release, connected to the product decision that justified them. https://ericmacdougall.com/journal/recheck-current-policy-authority-before-protected-bytes-leave/ https://ericmacdougall.com/journal/recheck-current-policy-authority-before-protected-bytes-leave/ Mon, 19 Oct 2026 15:00:00 +0000 An immutable signed policy revision is an evidence artifact. Current authorization can change while model inference or transformations are running. https://ericmacdougall.com/journal/unknown-is-an-outcome-designing-agent-systems-around-lost-replies/ https://ericmacdougall.com/journal/unknown-is-an-outcome-designing-agent-systems-around-lost-replies/ Mon, 19 Oct 2026 15:00:00 +0000 A timeout does not determine whether an external action happened. Retrying safely requires a durable operation identity and a reconciliation path. https://ericmacdougall.com/journal/durable-agents-need-agreement-between-delivery-ownership-and-effects/ https://ericmacdougall.com/journal/durable-agents-need-agreement-between-delivery-ownership-and-effects/ Mon, 19 Oct 2026 15:00:00 +0000 A workflow is more than a queue. State changes, durable delivery, worker ownership and publication authority must agree across retries and crashes. https://ericmacdougall.com/journal/where-jev-earned-a-decision-and-where-we-replaced-it/ https://ericmacdougall.com/journal/where-jev-earned-a-decision-and-where-we-replaced-it/ Mon, 19 Oct 2026 15:00:00 +0000 Evaluate decision systems per class and effect: dynamically constrain candidates, use JEV where measured, and replace or escalate it when deterministic scenarios or stronger models own the uncertainty better. https://ericmacdougall.com/journal/authorized-recall-the-retrieval-budget-has-to-belong-to-the-caller/ https://ericmacdougall.com/journal/authorized-recall-the-retrieval-budget-has-to-belong-to-the-caller/ Mon, 19 Oct 2026 15:00:00 +0000 A retrieval system must preserve authorized recall, freshness and evidence coverage while keeping token and latency costs bounded. https://ericmacdougall.com/journal/a-browser-is-an-outbound-capability-how-i-separate-destination-data-and/ https://ericmacdougall.com/journal/a-browser-is-an-outbound-capability-how-i-separate-destination-data-and/ Mon, 19 Oct 2026 15:00:00 +0000 Read-looking operations can send information outward through URLs, redirects, images, unfurls and fetched resources. https://ericmacdougall.com/journal/fourteen-cuts-through-a-streaming-security-boundary/ https://ericmacdougall.com/journal/fourteen-cuts-through-a-streaming-security-boundary/ Mon, 19 Oct 2026 15:00:00 +0000 A whole-response security decision cannot protect bytes already delivered. Define the protected unit and release boundary before choosing streaming UX. https://ericmacdougall.com/journal/we-measured-local-safety-models-the-hard-part-was-deciding-what-works/ https://ericmacdougall.com/journal/we-measured-local-safety-models-the-hard-part-was-deciding-what-works/ Mon, 19 Oct 2026 15:00:00 +0000 Secret detection, exact redaction and content classification are different jobs. A cheap classifier that finds everything can still be unsuitable because it blocks ordinary traffic or cannot identify spans. https://ericmacdougall.com/journal/a-semantic-firewall-needs-an-enforcement-architecture/ https://ericmacdougall.com/journal/a-semantic-firewall-needs-an-enforcement-architecture/ Mon, 19 Oct 2026 15:00:00 +0000 Semantic detection supplies a risk signal. The durable protection comes from the places that control reads, actions, disclosure and rendering even when the detector misses an attack. https://ericmacdougall.com/journal/build-the-tool-broker-around-the-authority-that-survives-alternate-paths/ https://ericmacdougall.com/journal/build-the-tool-broker-around-the-authority-that-survives-alternate-paths/ Mon, 19 Oct 2026 15:00:00 +0000 A model proposes a typed action; an independently authorized executor controls credentials, object access and effectful routes. https://ericmacdougall.com/journal/make-human-approval-survive-changes-in-payload-and-context/ https://ericmacdougall.com/journal/make-human-approval-survive-changes-in-payload-and-context/ Mon, 19 Oct 2026 15:00:00 +0000 A human approval becomes useful execution authority only when it commits to the action’s identity, payload and current effect context. https://ericmacdougall.com/journal/give-each-agent-turn-its-own-authority/ https://ericmacdougall.com/journal/give-each-agent-turn-its-own-authority/ Mon, 19 Oct 2026 15:00:00 +0000 Keep the stable bot/service identity separate from the human authority delegated for one turn. Recompute authorization as the conversation and its audience change. https://ericmacdougall.com/journal/design-the-authority-boundary-between-a-chatbot-an-assistant-and-an/ https://ericmacdougall.com/journal/design-the-authority-boundary-between-a-chatbot-an-assistant-and-an/ Mon, 19 Oct 2026 15:00:00 +0000 Capability growth changes the system’s trust model. Public explanation, authenticated account help and autonomous action deserve distinct data paths, identities and acceptance criteria.