Posts
Independent essays on AI-native work patterns, agent infrastructure, and what actually works when running agents as real tools.
-
A shared service account cannot tell one rep's pipeline from another's
A personal agent that reaches the CRM through one shared account shows a rep every region's pipeline and leaves no record of whose question it was. Per-person token exchange fixes both, and shows a gap in agent identity.
-
Logprobs vs Decisions: When High Scores Still Get It Wrong.
What logprobs and Decisions scores mean, how they can route answers to human review, and what a 64-call classification test found.
-
Parallel Web Systems: The Web API Surface for Agents
Updated:Parallel sells web search, typed decisions, research, discovery, and monitoring to AI agents through APIs, MCP servers, a CLI, and agent-harness plugins.
-
Structured Outputs on Amazon Bedrock: Make the Model's Response a Contract
Updated:Structured outputs constrain a model's response to a JSON schema you supply. What they are, why they matter, where they apply, which Claude 5 models support them, what they cost, and how to call them through Amazon Bedrock, with the response shown with and without a schema.
-
Opus 5.5 Leads a Four-Model OWASP Java Test by 7 to 9 Points. Kimi K3, GLM 5.3, and GPT-6 Sol Tie.
A 660-case OWASP Benchmark Java test at maximum reasoning effort across four models on Amazon Bedrock, with accuracy, missed flaws, false alarms, token use, and cost per correct answer.
-
Most Enterprises Are Chasing AI Autonomy Before Defining the Outcome
Executives are asking how autonomous their AI should become before defining the outcome, workflow, authority, evidence, and recovery model. Autonomy belongs to workflows, not enterprises.
-
One Agent Credential Pattern, From Solo Builder to Enterprise
Updated:1Password holds credentials; OAuth/OIDC scopes M2M clients. Adding users changes identity and vault policy, not the protected APIs.
-
Scope the 1Password Vault, Then Scope the Token
Updated:A purpose-specific 1Password vault and read-only service account bound an always-on agent box to five secrets and blocked writes as configured.