Om
Devoted to sharing knowledge and building value and great communities in software and…
Artikler fra Thor Henning
-
Refactoring Myself: How LLMs Changed My Coding Habits
Refactoring Myself: How LLMs Changed My Coding Habits
Reflecting on over 30 years in software development, I've recently observed a remarkable shift in my workflow—more…
12 kommentarer -
The Street-smart mindset to help you avoid missing deadlines.
The Street-smart mindset to help you avoid missing deadlines.
A small rant in the Street-smart developer series If you care about not missing deadlines, you might want to start…
2 kommentarer
Aktivitet
2k følgere
-
Thor Henning Hetland delte detteLast April I wrote here that in the agentic space, last week's mental model is already outdated. Then all of Norway took six weeks off. Both things are true, and Thursday we find out what that does to a mental model. Agent Pilsen is back: Thursday 6 August, 17:00, Eileff Landhandleri. Same format as always. No agenda, no slides. You say what you've been building, what broke, and what you've stopped believing since June. Someone buys a beer. If you want to catch up first — July was not quiet. Across the twelve open-source repos of the KCP ecosystem: 1,012 commits, 88 releases, and the spec went v0.22 → v0.30.3. Skills became things a machine can be *refused* permission to run, with a written reason. Governance learned to say yes — revocably, with the asking itself logged. But the thing I actually want to argue about over a beer is smaller. I published the full map of the ecosystem last week — including a section on what *doesn't* work yet. Skill files nobody had declared. A curated library whose every skill failed closed. An authority model shipped and used by no one, including us. Within 48 hours, every gap named in that section was closed. Not because anyone was assigned to it — because a gap with a number on it is a work order, and a gap without one is a vibe. One of those numbers was wrong, by the way. I claimed 65 skill files; the real count was 24 — my script counted stale duplicates and deliberately-broken test fixtures as governance gaps. The correction is now on the post, visibly, with the anatomy of the miscount. On a map that argues for measurement, a miscount is content. → A map that only shows the finished parts is a brochure. → A map that shows the unfinished parts gets them finished. → And a map that shows its own errors gets trusted. Thursday, 17:00. Bring whatever you've been wrong about lately — I'm clearly bringing mine. 🍺 The full map in the first comment.
-
Thor Henning Hetland delte detteIn 2023, cutting a release with AI meant pasting a small prayer into a chat window. This morning, an agent in my toolchain was *offered* a release skill — and told, in a signedreceipt, that it was relevant but not allowed to run, because no human had granted it the right. Same twenty lines of playbook. Completely different kind of object. That's the quiet story of the last three and a half years: the humble "skill" turned into a charter — a scoped, reviewable, revocable grant of authority a machine can both read and enforce. → 2023: the skill was a secret. → 2025: the skill was an asset. → 2026: the skill is a charter. Advice became property became authority. And authority — unlike advice — is something you can delegate, audit, revoke, and build an organization on. Notice the tempo. The first two eras took three years. The last three took twenty-two weeks. That's what happens when the coordination layer itself becomes executable. So next time someone tells you agentic development is about better prompts, ask them: Who signs your prompts? Who granted them? What happens when one reaches for a file it never declared?
-
Thor Henning Hetland delte detteAn AI assistant with 644 skills. One it leaned on every single day had been wrong for three weeks — and nothing flagged it. It hadn't broken. It just had no way to know which of the things it "knew" had gone stale. To find anything, it keyword-matched a flat list — no ranking, no sense of freshness, no record of where a fact came from. Ask it something, and it handed itself ~80 maybe-relevant notes and guessed. We expect better from everything else: → A good expert says "let me check — that may have changed." → A library stamps the out-of-date references. → Every line of a bank statement carries a date. An AI's own memory? It uses whatever it has, blind to how old it is. So we ran the experiment properly — written down in advance, measured, honest about the caveats. We gave the agent's memory a structure that ranks what's actually relevant, flags what's gone stale, and can prove where each piece came from. The right answer went from buried-in-a-pile to top-of-list, at roughly 31× less effort — and the system immediately raised its hand on 227 memories it should no longer trust. 🔗 Full write-up (caveats and all) in the first comment. If one of your AI tools quietly used a fact that went out of date last month — would anything tell you? #ArtificialIntelligence #AIGovernance #KnowledgeManagement #TrustworthyAI
-
Thor Henning Hetland delte detteAn AI agent read your customer records, changed an account, and paid a vendor $50 — overnight, while no one was watching. On Thursday, someone asks what it did. For almost every AI agent running today, the honest answer is: "we can check the logs and guess." We obsess over what AI is allowed to DO — permissions, guardrails, budgets. Almost no one can say, afterward, what it actually DID, and prove it. A shop gives you a receipt. A bank itemizes every transaction. A contractor hands you a signed invoice. An AI agent, after a night of autonomous work? An honor-system log — a story written after the fact. A log is a narrative. A receipt is evidence. So we built an open-source agent that keeps the receipts — a signed, checkable record written the moment it decides anything, all the way down to the dollar it spends. The idea isn't ours alone; a whole field is converging on "evidence, not logs." What we did was make it cover the whole agent — including the money — and then put the real thing in your browser. Drag the spending limit. Point it at a shady vendor. Watch it get blocked mid-purchase — the actual governance code deciding, live, and signing the receipt in front of you. No slides. You click it. 🔗 Try it yourself + the full write-up in the first comment. If your AI agent took an action overnight, could you prove — to a skeptic — exactly what it did, and that it was allowed to? #ArtificialIntelligence #AIGovernance #AIAgents #TrustworthyAI
-
Thor Henning Hetland delte detteEvery agent monitor I've seen tries to capture what the model was thinking. That's the wrong thing to capture. A model's chain-of-thought is an unreliable narrator. It will tell you it reasoned carefully about the evidence. It may have. But emitted reasoning is a plausible reconstruction, not a faithful record. You can't audit a narrator. We built something different. kcp-dashboard doesn't scrape thoughts. It reconstructs the decision graph from the governance layer — not what the model said it considered, but which documents it was actually handed, and which it wasn't, and where each candidate failed. pci-scope — skipped at temporal. Out of date. vendor-intel — skipped at payment. Not cleared. prod-secrets — skipped at access. Restricted. Same inputs, same cascade, same verdict — every time. That's not a guess about reasoning. That's a record of the information environment the agent was operating in. The thought graph: not what the model was thinking. What it was given to think with. --- Honest limit: this works because kcp-harness runs a fixed, deterministic governance cascade and emits a content-free trace of every verdict. If your agent doesn't have a deterministic governance layer, there's nothing faithful to reconstruct. You're back to the unreliable narrator. That's not a caveat. It's the actual point. Five scenarios. Three complexity levels. Runs in your browser. https://lnkd.in/eJwK-XeJ
-
Thor Henning Hetland delte detteOWASP published the Agentic Top 10 in December. 100+ security experts. Fully peer-reviewed. It's correct. Every item maps to a real incident category. But four of the ten share a root cause the list describes — and doesn't name. ASI01: agent reads a poisoned document. Follows hidden instructions. ASI04: a plugin gets swapped for a compromised version at runtime. ASI06: false data planted in agent memory. Fires weeks later, on an unrelated task. ASI07: agent trusts a message that was spoofed or replayed. Read the attack vectors. In every case: the agent acts correctly given what it knows. What it knows is wrong. The error is invisible in the action log. The attack doesn't break through the front door. It poisons the well the agent drinks from. 🔗 Field guide in the first comment — all ten risks, the shared pattern, what a missing ASI11 would look like, and the architectural fix that covers all four at once. If you're mapping your agent deployment against OWASP today: does your agent have a declared list of what it's allowed to reason from? Not a prompt telling it to use approved documents — a manifest it checks before loading. #AIAgents #Cybersecurity #AIGovernance #EnterpriseAI
-
Thor Henning Hetland delte detteOne word broke GitHub's AI agent. "Additionally." That single word — prepended to a data-exfiltration request buried in a public GitHub issue comment — bypassed the guardrails and leaked private repository contents to anyone who asked nicely. Noma Labs published the research last week and called it exactly right: prompt injection is to agentic AI what SQL injection was to web applications. A category-wide vulnerability class. What they didn't say — and what I think matters more than the fix recommendations — is what actually ended the SQL injection era. It wasn't smarter string detection. It wasn't better escaping. It was parameterized queries: a structural separation that made user input and SQL instructions two different channels. The agent era needs the same thing. I wrote up what that looks like in practice. 🔗 Blog post in the first comment. If your agents are using semantic guardrails to distinguish operator instructions from attacker text — what's your "Additionally"? #AIAgents #Cybersecurity #AIGovernance #PromptInjection
-
Thor Henning Hetland delte detteWe spend a lot of energy controlling what AI can do. Almost none on what it believes. Ask anyone rolling out AI assistants what keeps them up at night, and you'll hear about permissions, budgets, guardrails. All about controlling actions. But here's the question that matters more: where did your AI get its facts? The document it just quoted — is that the current version? Approved by anyone? Edited by whom, when? Most AI systems can't answer. Whatever text reaches them becomes the truth they act on. An assistant can follow every rule perfectly and still give a confidently wrong answer, because someone changed the refund policy it read — or it read last year's copy. We already solved this everywhere else. Food has ingredient labels. Software has signed updates. Financial reports have audit trails. Knowledge going into AI systems? Honor system. It doesn't have to be. I wrote a hands-on guide showing how to give your AI's knowledge the same thing your software updates already have: a way to check who published this, has it changed, and did it come from the right place — before acting on it. 🔗 Guide in the first comment. Takes 10 minutes, everything in it actually runs. If you audited your AI's sources tomorrow, what would you find? #ArtificialIntelligence #AIGovernance #TrustworthyAI #AIAgents
-
Thor Henning Hetland delte detteThe sharpest critique of Claude Code I've read is accidentally the best argument for how to build with LLMs. Last week a post made the rounds claiming that behind the curtain, Claude Code's "understanding" of code is really classic parser machinery — generative grammars doing the heavy lifting, with an LLM on top. Conclusion: lipstick on a pig. The analysis may or may not be accurate. The conclusion is backwards. Symbolic machinery around the model isn't a confession of weakness. It's what production AI engineering looks like: formal structure for the formal parts — parsing, diffs, validation — and the model for what it's uniquely good at: intent, planning, transformation. GitHub learned the same lesson publicly this week: giving their code review agent better tools made results worse, until they constrained the workflow around them. The scaffolding did the work. We've been building on this principle with governed, versioned context for agents. Reliability doesn't come from hoping the model understands. It comes from scaffolding that makes misunderstanding detectable. "Pure LLM" was never the goal. Engineered systems with LLM components is. Where do you draw the line between what you let the model do and what you enforce around it? #AIEngineering #DeveloperTools #ClaudeCode #ContextEngineering
-
Thor Henning Hetland likte detteThor Henning Hetland likte detteFollowing yesterdays scrub, we are preparing for the next launch window opening at 13:45. We are live from 12:45! Go to our website for further updates propulse.no/launch-updates
-
Thor Henning Hetland likte detteNTNU Fakultet for informasjonsteknologi og elektroteknikk
NTNU Fakultet for informasjonsteknologi og elektroteknikk
Thor Henning Hetland likte dette🚀Gratulerer til Propulse NTNU med vellykket oppskyting av Fossekall! 73 studenter og over 70 000 arbeidstimer ligger bak raketten som ble skutt opp fra Spaceport Trøndelag på Tarva kl 08.38 idag, samme sted som Heimdall tok av ifjor. 👏 Imponerende godt arbeid👏Gratulerer til hele teamet 💙👉 https://lnkd.in/eXxWw_ti Foto: Propulse NTNU
Patenter
Språk
-
English
-
Motatte anbefalinger
3 personer har anbefalt Thor Henning
Bli med nå for å vise