FIELD NOTE / X
Fast agents still need fixed contracts.
The short film, the complete written thought, and the evidence behind it.
The X edition will be linked here after its public post is verified.
Fast agents still need fixed contracts.
Day 01 · 2026-09-28 · X
Short video caption
A lighter agent run may verify Remove User in the UI but miss a pre-issued token. Set the denial deadline before coding. Trusted CI replays that token after removal and fails on a late 200 or a missing probe. Enforce on every auth patch. Simulated design. #EricFieldNotes
Full written post / accessible read
Coding agents make small auth changes fast. A junior developer or a light model run may verify that Remove User works in the admin page, and forget the old bearer token. That is an ordinary engineering miss, multiplied by a faster change rate.
In this simulated design, the admin page says removed. A pre-issued token can still return protected data until expiry. Whether that is acceptable depends on the promised revocation window. A screenshot cannot answer that policy question.
Before the agent edits auth, a trusted test runner issues a token and records the allowed denial deadline. After removal, it replays that same token against a protected route. It checks the actual response after the deadline, outside the agent's own browser transcript.
Keep that replay contract outside the agent's writable worktree. Run it in CI on every auth change. Fail if the old token still returns two hundred past the deadline, or if the probe never ran. Do this because a policy written only in an instruction file can be skipped by the next fast patch.
#EricFieldNotes
X thread draft
Attach the video to the first post. The subsequent text adds detail; the full read above is also the accessible transcript. Review the thread in the live composer before sending.
A lighter agent run may verify Remove User in the UI but miss a pre-issued token. Set the denial deadline before coding. Trusted CI replays that token after removal and fails on a late 200 or a missing probe. Enforce on every auth patch. Simulated design. #EricFieldNotes
In this simulated design, the admin page says removed. A pre-issued token can still return protected data until expiry. Whether that is acceptable depends on the promised revocation window. A screenshot cannot answer that policy question.
Before the agent edits auth, a trusted test runner issues a token and records the allowed denial deadline. After removal, it replays that same token against a protected route. It checks the actual response after the deadline, outside the agent's own browser transcript.
Keep that replay contract outside the agent's writable worktree. Run it in CI on every auth change. Fail if the old token still returns two hundred past the deadline, or if the probe never ran.
Do this because a policy written only in an instruction file can be skipped by the next fast patch.
Evidence and boundary
On-screen boundary: SIMULATED AUTH · HARNESS DESIGN. The sources below support documented mechanisms and specifications; illustrative scenarios are not presented as measured incidents.