Thor Henning Hetland’s Post

The agent gave a great answer. The user asked how it got there. We had nothing to show them. Not the reasoning. Not the tools it called. Not even which model answered. Just the response and a shrug. That was the day we stopped treating audit trails as optional. Every agent turn now emits a structured trace. Not for the user by default. For us. Which lane the router picked, and why. Which tools got called, with argument summaries and latency. Which model handled it, with token counts. What the confidence score was, and which risk flags fired. All of it lands in observability. A slim version is available behind an opt-in "why did you answer this way" panel for users who ask. 𝗔 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻 𝗮𝗴𝗲𝗻𝘁 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗮 𝘁𝗿𝗮𝗰𝗲 𝗶𝘀 𝗷𝘂𝘀𝘁 𝗮 𝗰𝗼𝗻𝗳𝗶𝗱𝗲𝗻𝘁 𝗴𝘂𝗲𝘀𝘀 𝗶𝗻 𝗮 𝗻𝗶𝗰𝗲 𝘄𝗿𝗮𝗽𝗽𝗲𝗿. The first time a wrong answer shipped, we could reconstruct the entire decision path in under a minute. Which lane. Which tool returned stale data. Which model. What confidence. The fix took ten minutes. The investigation would have taken a day. One exception. Latency-critical paths where the trace itself is expensive. There we sample, not skip. A tiny percentage of turns still carries the full trace so drift stays visible. Agents will act on behalf of users, spend money, touch systems of record. "It worked in testing" is not a defense anymore. If you cannot explain why your agent made a decision, you do not have a production agent. You have a demo with better marketing. What is the first thing you wish you had logged on your agent, but did not? #AIAgents #SoftwareArchitecture #Observability #ProductionEngineering #SachinSaurav

The model call was not today's main agent bottleneck. Background daemons lost replies, locally monitored steps assembled into attacks, judges encoded bias, and visual agents saw the wrong thing. 1. Claude Code 2.1.208 fixed lost background-agent replies, stale daemons, context accounting, command safety, memory leaks, and transcript growth. Edit-heavy transcripts can be up to 79x smaller. 2.1.209 then reverted a dialog guard that went too far. 2. A new multi-agent safety paper shows a payload split across agents can pass every local monitor while the assembled output is harmful. Per-step checks are not system safety. We need provenance across handoffs and assembly-aware gates. 3. An LLM judge-bias paper tested 7 judges, 7 bias types, and 9 benchmarks. Hidden states move along low-dimensional directions; steering can reproduce or reduce bias, and a linear probe predicts failures better than a text baseline. Scores need inspectable judges. 4. Apple's MM-ToolSandBox tests 12 models across 500+ tools and 16 domains. The best model stays below 50% success; 53% of failures came from incorrect visual extraction despite a correct workflow. Perception evals and confidence checks matter. Full newsletter in the first comment.

coming back to the personal agent topic after my previous post. message compression is quite an important topic, yet it can be overcomplicated. the thing with agents is deciding what they should remember. on one hand we expect them to know everything, on the other hand we do not want to provide all of our personal information to third-party providers, especially as they might use this data to train the models further. there is also the question of how long certain information should be preserved, based on importance and time. do we expect agents to behave like human, or better? to fit the needs I anticipated, I decided to take roughly half of the available short-term message context, and summarize it into one chunk. then chunks try to fill out available context. recent chunks are prioritized. this kind of simulates us: we tend to blur information over time, and forget old information.

A broker updates their claims form. New layout, same fields. Nobody tells your intake bot. The bot expected the policy number top right and the loss date in the second table. Now they have moved, so it stops, and the claim lands in an exception queue where a handler opens the file and keys it in by hand. Not because the claim was hard. Because a template changed. Hand the same document to AI claims agents and the day goes differently: - They read the page for meaning, so the policy number gets found wherever it sits. - They pull the data out and check it against your policy rules. - If something is missing, they ask the claimant for exactly that at intake, not days later. - Anything that genuinely needs judgment goes to a handler, with the reasoning and sources already logged. New layout, same outcome: a decision your auditors can trace. Full breakdown on the MarvelX blog. Link in the comments.

Agents are in production. They can act on your systems. But you can't prove what they did or stop them from doing the wrong thing. Structural assurance fixes that. Stoa Graph is a deterministic policy layer for agents. Define where data comes from. Which actions need approval. The model proposes. Policy decides. Every action gets signed proof. Untrusted data (search results, user input) can't authorize actions that matter. The gate is outside the model, not filtering it. Built for enterprises in regulated environments where control and proof are non-negotiable. If you're running agents in production and need actual governance, let's talk. https://lnkd.in/e2BxKqrv

Every agent demo ends the same way: the agent says "done," a green checkmark appears, everyone moves on. I stopped trusting that checkmark after an agent told me a backtest was clean — while it was quietly running on synthetic data. So in Crucible (my multi-agent research pipeline), I built two audits that don't let the agents grade themselves: 𝟭. 𝗧𝗵𝗲 𝘄𝗼𝗿𝗸 — a Gate verdict with 4 possible decisions (PROCEED / KILL / NEEDS_MORE_DATA / BRANCH), each with a different required schema. A model under pressure to look productive can't quietly downgrade a hard KILL into "needs more data" — the softer decision literally has nowhere to put that reasoning. Backed by an adversarial reviewer that never sees the generation crew's self-praise, plus deterministic AST rules for the bugs LLM reviewers keep re-writing instead of fixing (look-ahead bias, hollow stub functions). 𝟮. 𝗧𝗵𝗲 𝗯𝗶𝗹𝗹 — token-cost estimates get checked against OpenRouter's actual billed cost, fetched independently after the run. When they disagree, both numbers stay visible. The gap is a finding, not something the report smooths over. The hard lesson underneath both: instrumentation built on an assumed call path (I initially tried to intercept a routing layer Crucible's LLM calls never actually go through) silently measures nothing — and confidently reports the nothing as zero. Full writeup — includes the actual schema validation rules and the OpenRouter reconciliation logic: https://lnkd.in/gpf4dUEV Repo: https://lnkd.in/gs_W56VT #AIAgents #LLM #SoftwareEngineering #AgenticAI

Over the long weekend, I built three agentic systems, each with the same structure: a panel of LLMs, each LLM assuming a different role. The panel read a large document set, debated against specified criteria and returned a verdict to steer a sizable decision.⁣ ⁣ Brilliant output, fast runs, zero crashes … and that was my red flag.⁣ ⁣ What my review caught:⁣ ❌ Unbeknownst to the panel, one agent cut every document at 32,000 characters to reduce cost. The panel returned a verdict on a fraction of the evidence. ⁣ ❌ The LLM occupying a chairman role compressed reviewer findings into 900-character digests. Issues big enough to swing the decision sometimes vanished.⁣ ❌ Reviewer models cited data that did not exist in the source documents. ⁣ ⁣ Three different failures, all leaning the same direction: false confidence; however, the most fascinating part? Only the fake data was a hallucination. The other two were decisions, an agent choosing to cut a corner and not mention it.⁣ ⁣ Four rules that fixed it:⁣ ✅ Trust nothing an agent says about its own work. A self-report = a claim. An executable check = a result. No agent outranks verification.⁣ ✅ Retry with the failure in hand. Blind retries burn tokens. Informed retries converge and there is real value in this pattern. ✅ Standing rules beat prompt stuffing. Give every agent a constitution it carries into every task.⁣ ✅ Agents earn their seats. Every model passes a graded interview before real work and a scoreboard decides who keeps the chair. It's fine for an agent to be wrong out loud but you can't allow it to be wrong in silence.⁣ ⁣ 𝐑𝐞𝐦𝐞𝐦𝐛𝐞𝐫: 𝐬𝐨𝐟𝐭𝐰𝐚𝐫𝐞 𝐟𝐚𝐢𝐥𝐬 𝐥𝐨𝐮𝐝𝐥𝐲. 𝐀𝐠𝐞𝐧𝐭𝐬 𝐟𝐚𝐢𝐥 𝐩𝐨𝐥𝐢𝐭𝐞𝐥𝐲, 𝐥𝐢𝐤𝐞 𝐚𝐧 𝐞𝐦𝐩𝐥𝐨𝐲𝐞𝐞 𝐰𝐡𝐨 𝐧𝐞𝐯𝐞𝐫 𝐛𝐫𝐢𝐧𝐠𝐬 𝐛𝐚𝐝 𝐧𝐞𝐰𝐬. 𝐒𝐭𝐚𝐲 𝐬𝐤𝐞𝐩𝐭𝐢𝐜𝐚𝐥 𝐛𝐲 𝐝𝐞𝐟𝐚𝐮𝐥𝐭, 𝐛𝐮𝐢𝐥𝐝 𝐭𝐡𝐞 𝐩𝐫𝐨𝐨𝐟 𝐢𝐧𝐭𝐨 𝐭𝐡𝐞 𝐰𝐨𝐫𝐤 𝐚𝐧𝐝 𝐦𝐚𝐤𝐞 𝐭𝐡𝐞𝐦 𝐛𝐫𝐢𝐧𝐠 𝐲𝐨𝐮 𝐭𝐡𝐞 𝐛𝐚𝐝 𝐧𝐞𝐰𝐬.⁣ #AgenticAI #AIGovernance #EnterpriseAI

For twenty years we have measured our attack surface in ports and endpoints. We scanned it, patched it, slept. Then your team shipped an AI agent, and the surface quietly changed units underneath you. An agent is the most capable, most trusting new hire you have ever made, and you handed it real keys. Every tool it can call, every API it can touch, every credential it holds is now reachable through plain language. Not an exploit chain. A sentence, typed by anyone the agent will talk to, or buried in a document it will read. The attacker does not even have to be your user. They only have to get words in front of the one employee who believes everything it reads. So stop trying to enumerate the bad sentences. Language is infinite and you will never list them all. The action space is finite, and that is where the leverage lives. You do not authorize language, you authorize operations, in code the model cannot reach, running as the person who asked, holding anything irreversible for a human to confirm. A tool that can only refund up to fifty dollars has a small blast radius no matter how clever the sentence is. Hardening the model lowers the odds it gets fooled. It never bounds what a fooled model can do. That bound is the thing you build around it, and it is the part you actually control. Then measure what is left. Count the agents, the operations each one can reach, how many run as a real user instead of one fat service account, when each was last verified. Most teams cannot produce that number today. The surface you have reduced is the most honest thing you can set in front of a board, because it is the one number that says exactly how much a sentence can still do.

The failures that worry me most are not the ones that throw an error. They are the ones that return a green checkmark. I saw this happen recently with a message moving between two automated components. The notification came through, and every status looked normal. But the message itself never arrived. The system appeared to be working while the actual work quietly disappeared. In security, there is a distinction between failing closed and failing open. A system that fails closed stops when something goes wrong and lets you know. A system that fails open keeps moving, even when it is no longer doing what you expect. I think a lot of AI pipelines have this problem. An agent reports that it finished. A step shows that it ran. But that does not tell you whether the output reached the right place, whether anything used it, or whether the result was correct. This is especially true using pre-built agentic harnesses in combination with models that have a reputation for failed tool calls. A green checkmark tells you that the process ran. It does not prove the work was done. Whenever possible, systems should make failures obvious. Visible errors can be investigated and fixed. The failures that cause the most damage are often the ones nobody notices.

I barely read my agent's code. I interrogate it. My agent writes faster than I can read. I used to open the diff and go line by line. At this pace that breaks: the PR passes CI, looks clean, and does the wrong thing. So my review moved off reading and onto questions. First I ask about intent. Does this solve the task we set, or only the prompt I typed? The agent keeps satisfying the wording and missing the point. A question catches that in a minute. Scrolling files does not. Then I ask about scope. "Did you fix this everywhere, or only here?" The agent sees its own slice, not the whole system, so one short question tells me more than the entire diff. Then I go after the conventions it doesn't know. "Is this how we do it?" Every repo carries unwritten rules: what's generated and can't be hand-edited, where there's one shared way and where duplicates crept in, what data has no business sitting in this service. When the agent trips on a rule like that, catching it in review is half the job. I write the rule into AGENTS.md or CLAUDE.md so next time it knows. This is the standard advice, and it holds up: Anthropic measured that context cutting wrong-pattern rewrites by 40 to 60 percent. A tail remains, the part I haven't written down. My question lives on that tail. I don't take its word. I ask for proof: the test that failed before the change, the data under the diagnosis. Confidence from an agent counts for nothing. At the end I make it account for itself. "Tell me from the PR what you changed that matters." It lays out its own blast radius, and whatever it did in passing surfaces. None of these questions read the code. The linter, type-check, unit tests, and security scanners cover the mechanical layer without me. My questions rest on the context I carry and the tools don't have yet. I still read the code. I start with a question instead of the diff.