The knowledge base
Practical patterns for agent loops, tools, memory, evaluation, safety, and production infrastructure—distilled for builders.
Knowledge base
59 of 59
A2A (Agent-to-Agent) is the Linux Foundation open protocol for cross-vendor agent interop: JSON-RPC over HTTP with Agent Cards for discovery, task lifecycles for long-running delegation, and…
Measure cost per completed task, not cost per model call, because cheap models can become expensive when they cause retries or long trajectories. Reduce repeated input with prompt caching,…
Give an AI agent its own identity rather than the user's credentials: issue short-lived tokens whose sub names the human, act names the agent, aud binds a single resource server, and scope…
Treat serverless agent workers as stateless and persist conversation state, plans, checkpoints, idempotency records, and pending approvals in durable services because instances can disappear…
Agent evaluations should separate model quality from scaffold, tool, and environment failures. Single-run pass rates hide nondeterminism, while overly short time or token limits can…
Give each agent workload a distinct identity and short-lived, task-scoped credentials instead of placing broad API keys in prompts, tool output, logs, or persistent memory. A trusted…
An agent loop repeatedly reads the current state, chooses an action, uses a tool, observes the result, and corrects its plan. The model is only one component: reliable agents also need…
Short-term memory is the working context supplied on each model call: recent messages, the current plan, tool results, and task-local state; it is bounded by the context window and…
Represent each agent run as a trace with spans for model calls, retrieval, tool execution, guardrails, handoffs, and human approvals, linked by stable run and parent identifiers. Log model…
Pillar hub mapping the four agent attack surfaces — input (prompt injection), memory (poisoning), execution (sandboxing), authority (guardrails/approval gates) — with links to the deep-dive…
An MCP server gives an agent reach it does not have — a connection, a credential, a running process. An Agent Skill gives it judgment about tools it can already use: a folder with a `SKILL.
Coding agents should work in isolated, least-privilege sandboxes with repository-scoped credentials, network controls, resource limits, and explicit approval for destructive commands, secret…
A computer-use agent drives a real GUI by reading screenshots and emitting mouse and keyboard events. Use it only when no API, MCP server or CLI exists: it is far slower, costlier and more…
Manage context as a budget: retain the system policy, current objective, unresolved constraints, recent actions, exact error messages, and identifiers needed for future tool calls, while…
Context rot is the degradation of agent performance as the context window fills — long before the technical token limit — because attention favors the start and end of the window and buries…
A support agent can deflect repetitive requests by answering from versioned help-center content and resolving low-risk tasks such as checking delivery status, but it should cite the…
Lower temperature can reduce sampling variation for extraction and routing, but it does not make a hosted model or a multi-step agent deterministic because model revisions, parallel tools,…
Long-running agents should execute as resumable state machines whose durable checkpoint records the current step, validated state, completed side effects, pending approvals, retry counters,…
E-commerce agents should combine lexical and semantic product retrieval with hard filters for inventory, locale, compatibility, price, and fulfillment, and clearly label sponsored or…
Article 50 of the EU AI Act has been enforceable since 2 August 2026 and applies to agents regardless of high-risk status — the Annex III high-risk regime was separately deferred to 2…
Offline evals provide repeatable pre-release regression tests over representative tasks, adversarial cases, tool failures, and multi-step trajectories; online evals measure real completion,…
Finance agents need data minimization, field-level protection for PII, least-privilege access, immutable audit trails, retention controls, and jurisdiction-specific compliance review. Keep…
Groundedness measures whether each claim in an agent's output is entailed by the source material the agent actually saw, and it is computed by decomposing the answer into atomic claims and…
Guardrails should be enforced in code around the model: validate inputs and outputs, authorize every tool call against the user and task, constrain arguments with allow-lists, and run code…
Healthcare agents handling protected health information require HIPAA-aligned administrative, physical, and technical safeguards, minimum-necessary data access, vendor agreements where…
Place approval gates immediately before consequential actions such as sending messages, moving money, changing production, deleting data, or releasing regulated decisions, rather than asking…
Langflow — a popular open-source visual framework for building AI agents and RAG pipelines — has had multiple critical flaws added to CISA's Known Exploited Vulnerabilities catalog over the…
Optimize both time to first useful feedback and total task time: stream text or structured progress, acknowledge long-running work immediately, and expose tool status without leaking private…
Legal agents should retrieve from authoritative, jurisdiction- and date-filtered corpora and preserve court, reporter, docket, pinpoint citation, precedential status, and source text for…
Ariane 5's maiden flight was destroyed in 1996 when inertial-reference software reused from the slower Ariane 4 hit an unhandled overflow under the new rocket's higher values. Lesson:…
The 2017 AWS S3 outage began when an engineer ran a debugging command with a mistyped parameter that removed far more capacity than intended, cascading across dependent systems. Lesson:…
In 2019 a single regular expression with catastrophic backtracking consumed CPU globally and took Cloudflare offline. Lesson: any operation without an explicit bound can consume all…
In 2017 GitLab lost production data when a tired engineer removed a directory on the wrong host, then discovered that five separate backup/replication methods had silently been failing.…
Google's SRE practice sets an availability target, treats the gap below 100% as a spendable error budget, and ties release velocity to whether the budget is intact. Lesson: reliability and…
HealthCare. gov's 2013 launch failed publicly: a big-bang release of an integrated system that had never been tested end-to-end at anything near real volume.
Knight Capital lost ~$440M in 45 minutes in 2012 after a deploy left an old, repurposed feature flag enabling long-dormant code on some servers but not others. Lesson: never leave dead code…
NASA lost the Mars Climate Orbiter in 1999 because one team produced output in imperial units while another consumed it as metric; the mismatch was never validated at the boundary. Lesson:…
Netflix's Chaos Monkey randomly kills production instances so the system is forced to tolerate failure as a normal condition rather than a rare emergency. Lesson: resilience comes from…
Between 1985 and 1987 the Therac-25 radiation therapy machine delivered massive overdoses to patients, killing several. Hardware interlocks present on earlier models had been removed in…
The Model Context Protocol is an open standard for connecting AI applications to external tools and data. MCP uses a client-server architecture: servers expose resources, prompts, and…
The largest MCP revision since launch makes the protocol stateless: the initialize handshake and sessions are gone, every tool call is a self-contained HTTP request, and server-initiated…
Memory poisoning plants malicious content in an agent's long-term memory so it activates on a later task, often against a different user — unlike one-shot prompt injection, the payload sits…
Choose the smallest model that meets measured quality, tool-use, context, latency, modality, privacy, and reliability requirements on your own task distribution, then route exceptional cases…
Use multiple agents when subtasks are genuinely independent, require distinct tools or context, or benefit from parallel search or review; a single agent is usually cheaper, faster, and…
Back-office agents are useful when documents vary and judgment is needed, while deterministic RPA remains preferable for stable screens and fixed rules; combine them by letting the model…
ReAct interleaves reasoning, actions, and observations so the agent can revise its approach from environmental feedback; plan-then-execute first creates a task graph and is better when…
Prompt caching reduces latency and input cost when many calls share a long stable prefix such as system instructions, tool definitions, examples, or reference documents. Put stable content…
Treat retrieved pages, emails, documents, tool outputs, and user-uploaded files as untrusted data, even when they contain text claiming to be system instructions. Keep instructions and data…
Retrieval-augmented generation embeds a question, retrieves semantically similar passages from a knowledge base, and places those passages in the model context. Good RAG systems preserve…
Model providers can limit requests, input tokens, output tokens, or concurrent work, so admission control must estimate token load rather than count requests alone. Use per-tenant quotas,…
Chunk along semantic boundaries and keep headings, source URL, timestamps, permissions, and neighboring relationships; chunks should be small enough to isolate an answer but large enough to…
Sales agents should personalize from consented, relevant data, respect suppression lists and communication rules, and avoid inferring sensitive traits or fabricating customer facts. CRM…
Treat every line of LLM-generated code as hostile: run it in a microVM (Firecracker) or user-space kernel (gVisor) rather than a plain shared-kernel container, and lock down network egress,…
Use schema-constrained generation when downstream code needs machine-readable output: define required fields, closed enums, bounds, and disallow unexpected properties where the provider's…
A subagent is a specialized worker with its own isolated context window and restricted tools; the orchestrator hands off a bounded task and only the result flows back. Use subagents when…
UK AI Security Institute evaluations found that increasing an agent's token budget from 1 million to 10 million tokens improved success on software-engineering tasks by roughly 25 percent.…
Give every networked tool a connection timeout, an overall deadline, and a bounded retry policy using exponential backoff with jitter only for transient failures such as throttling or…
Expose narrow, intent-level tools with unambiguous names and descriptions, explicit required fields, typed enums and bounds, and no overlapping functions that differ only subtly. Do not…
Tool-using agents work best with narrow tools, explicit schemas, actionable error messages, and observable results. Validate arguments before execution, use idempotency keys for side…
Watch the loop