1046 posts · Page 27 of 88. ← Blog
An LLM demo costs almost nothing, so teams ship without a cost model — and then production traffic turns a rounding error into the biggest line item on the bill.
An LLM demo costs almost nothing, so teams ship without a cost model — then production traffic turns a rounding error into the biggest line item on the bill. Why AI costs explode, and how to see it coming.
Prompt engineering was about wording a single instruction well; context engineering is the broader discipline of deciding everything a model sees at inference time — and for agents, it is the discipline that matters most.
Prompt engineering was about wording one instruction well; context engineering is the broader discipline of deciding everything a model sees at inference — and for agents it is the skill that matters most.
Tools are one half of an agent's world and other agents are the other half, and A2A is the open standard that lets agents built by different teams, in different frameworks, discover and delegate to each other as peers.
A2A is the open standard that lets agents built by different teams, in different frameworks, discover and delegate to each other as peers — the agent-to-agent complement to MCP's agent-to-tools.
Underneath every tool call and resource read is a small, well-defined conversation in JSON-RPC that begins with a handshake and a negotiation over what each side can do.
Under every MCP tool call is a JSON-RPC conversation that starts with an initialize handshake and a capability negotiation. Here is the wire protocol in detail.
The cheapest way to make an agent evolve is to let it remember what happened and reflect on it, turning yesterday's failure into today's context.
The cheapest way to make an agent evolve is to let it remember and reflect. Reflexion's verbal learning and the Generative Agents memory stream — and how to build a modest version.
Hooks turn "please always run the formatter" from a hope into a guarantee — deterministic shell commands that fire on Claude Code's lifecycle events, no matter what the model decides.
Hooks are shell commands that fire deterministically on lifecycle events — auto-format on edit, block edits to protected paths, run checks, notify. When to use a hook (guarantee) vs CLAUDE.md (influence) vs permissions (gate), and keeping them safe.
Every forward deployed engineer builds one-offs to win the customer in front of them — the ones who last turn those one-offs into product instead of drowning in them.
Every FDE builds one-offs; the ones who last turn them into product. Why bespoke is the right start, the 'third time productize' rule, the feedback loop to the product team, designing custom work for graduation, and managing the portfolio of one-offs.
Scaling red-teaming beyond manual probing — the building blocks of an automated harness (seed library, mutation, orchestrator, scorer), LLM-driven adaptive attackers, the real tools by role (PyRIT, garak, promptfoo, Giskard), and wiring it all into CI as a repeatable gate.
Scaling red-teaming: the harness building blocks (attack seeds, mutation, orchestrator, scorer), adaptive LLM-driven attackers, the real tools by role (PyRIT, garak, promptfoo, Giskard), and integrating an automated red-team gate into CI.
How to communicate an architecture so it survives contact with a real team — a few living, versioned diagrams and decision records instead of a dead 200-page tome nobody opens twice.
Communicating architecture so it survives contact with a team: the C4 model's zoomable levels, diagrams-as-code that live in version control and don't rot, multiple views for multiple audiences, and just-enough living docs plus ADRs.
The two specialist lenses a reviewer switches on for a diff — thinking like an attacker to catch the injection and the missing authorization check, and thinking like production to catch the N+1 query — while knowing exactly where the human eye stops and a scanner, profiler, or load test has to take over.
The specialist lenses: security review (untrusted input to a sink, missing authz/BOLA, secrets, SSRF, new dependencies) and performance review (N+1 queries, unbounded queries, missing indexes) — flag the smells, defer depth to scanners and profilers.
Why your Terraform is a security control point, how misconfiguration scanners catch public buckets and open ingress before apply, and how to encode org guardrails as executable policy with OPA/Rego, Conftest, and Sentinel instead of a wiki page nobody reads.
Securing infrastructure definitions and enforcing guardrails automatically: IaC scanning (Checkov/tfsec/Trivy) for misconfig, drift detection, and policy-as-code with OPA/Rego + Conftest so org rules block bad infra before apply — not in a wiki.
Part six of the API Security series: encrypt every byte in transit and at rest, hand out only the data a caller actually needs, and keep the keys that protect it out of your code and under a rotation policy.
Protecting data in transit and at rest: TLS everywhere (even internal, zero-trust), mTLS for service-to-service, minimizing sensitive data exposure, encryption at rest with managed keys, secrets management, a correct CORS allow-list, and redacting logs.