1290 posts · Page 40 of 108. ← Blog
You cannot optimize what you cannot price, and pricing an AI system starts with understanding the token — what counts as one, why input and output cost differently, and how to compute the true cost of a request.
You cannot optimize what you cannot price. Pricing an AI system starts with the token — what counts as one, why input and output cost differently, and how to compute the true cost of a request.
Every token in the window costs money, adds latency, and competes for the model's attention, so the first skill of context engineering is treating context as a scarce budget to be spent deliberately.
Every token in the window costs money, adds latency, and competes for attention. The first skill of context engineering is treating context as a scarce budget to spend deliberately.
Before one agent can delegate to another it has to find it and understand what it can do, and in A2A that self-description is a single structured document called the Agent Card.
Before one agent can delegate to another it must find it and understand it. In A2A that self-description is a single structured document — the Agent Card.
The same JSON-RPC messages can travel down a subprocess pipe or across the network, and choosing the right transport is mostly a question of where your server lives and who it serves.
The same MCP messages travel over a subprocess pipe or the network — stdio for local tools, streamable HTTP for remote services. How each works and when to choose it.
The prompt is the agent's program, so an agent that can rewrite its own prompts is an agent that can rewrite its own behavior — and there are now principled ways to make that search work.
The prompt is the agent's program. Self-Refine, DSPy, and Promptbreeder turn prompt engineering into an automated search the system runs on itself.
Slash commands and skills turn a workflow you keep re-explaining into something you invoke by name — packaging repeatable expertise so you (and your team) don't prompt it from scratch every time.
Packaging repeatable workflows: custom slash commands for frequent explicit tasks, and skills — self-contained procedures the agent loads when relevant — turning tribal knowledge into invokable, versioned team assets. Matching the mechanism to frequency.
The forward deployed engineer's edge isn't deep mastery of one stack — it's enough breadth to build an end-to-end solution alone, fast, against whatever the customer already has.
The FDE's edge is breadth, not deep single-stack mastery: comb-shaped competence across data, backend, a little frontend, and just-enough ops; choosing tools for speed and fit; a pragmatic default kit; and the meta-skills (learning speed, finishing) that outlast any framework.
Turning red-team attacks into metrics you can act on and track over time — attack success rate, coverage, severity, and trend — plus the honest limits of what any of those numbers can tell you.
Turning attacks into metrics: attack success rate and why it's subtle, scoring success (rule/classifier/LLM-judge with its biases), coverage across the taxonomy, severity weighting, tracking trends per model/prompt version, and honest reporting of residual risk.
Architecture is never finished. This post is about designing systems for the change you know is coming, guarding the characteristics you care about with automated fitness functions, and treating technical debt as an ongoing budget rather than a someday-rewrite.
Architecture is never done: evolutionary architecture and fitness functions that guard characteristics in CI, technical debt done right (deliberate vs reckless, managing the interest), and incremental strangler-fig migration instead of the doomed big rewrite.
How to run code review across a whole team or organization without turning it into a bottleneck: treat review latency as a first-class metric, distribute the load, let automation handle the toil, and measure the things that actually predict quality.
Making review work across a team without becoming a bottleneck: review velocity as a first-class metric, ownership and routing (CODEOWNERS), automating toil so humans do judgment, healthy SLAs, and measuring the right things.
Securing the runtime platform end to end — hardened images, least-privilege workloads, default-deny networks, and admission control as the gate that decides what is ever allowed to run.
Securing the runtime platform: minimal non-root images scanned for CVEs, the container isolation model and hardening (drop caps, read-only FS, seccomp), and Kubernetes — Pod Security Standards, RBAC, default-deny NetworkPolicies, and admission control (Gatekeeper/Kyverno).
Part seven of the API Security series: the perimeter and runtime layer that enforces security consistently — the gateway as a policy enforcement point, the limits of a WAF, keeping an honest inventory of every endpoint you expose, hardening defaults, and watching the traffic for abuse you can only see at runtime.
The perimeter and runtime layer: the API gateway as a policy enforcement point (and why it can't replace per-service authz), WAF limits, improper inventory management (shadow/zombie APIs), security misconfiguration, and runtime detection.