Almost every instruction an agent receives is under-specified in some way. A human hands off a goal that seemed complete when they wrote it, and the agent discovers, partway in, that the words admit more than one reasonable reading. The output format was never stated. The scope has a soft edge. A pronoun points at two possible things. This is not a failure…
The hard part of connecting a model to the world was never the model. It was the connection. Every agent that does anything useful reaches outside itself into a database, an internal service, a search index, a ticketing system, and each of those reaches is an integration that someone has to write, secure, and keep working. As long as each of those integrations is…
A system prompt is an instruction the model is asked to follow, and most of the time it does. That reliability is real, and it is easy to mistake for a control. It is not one. A prompt shapes the distribution of outputs a model tends to produce; it does not close off the outputs you told it to avoid. On the…
Deterministic validation can only enforce standards you can state as a rule. A schema check, a range check, a check that two fields agree: each one closes a failure you were able to write down in advance. But a large share of what makes an output good cannot be written down that way. Is this summary faithful to what it summarizes? Does…
Most discussions of controlling a model’s output collapse into a single move. For one team it is prefilling the first token; for another it is a longer, more emphatic instruction; for a third it is a schema bolted onto the response. Each of those is a real technique, and each is being asked to carry work it was never shaped to…
The most-watched numbers in an agent system are usually the prompt and the model’s own output. The instructions get versioned, the responses get graded, the system prompt gets audited line by line. Meanwhile the largest and least-examined source of tokens in a long-running agent is often the raw output of the tools it calls. A single API response can be…
In a single-agent system, the risky moments are the tool calls: the points where the model reaches out and something in the world might not behave. In a multi-agent system, a second class of risk appears, and it is easy to miss because nothing about it looks like an error. It lives at the boundary between one agent and the next. Every…
The moment a plan begins to run, it meets a world it did not fully model. A tool returns something the plan never anticipated, a resource that existed at design time has moved, a value comes back valid but wrong for what the next step assumed. This is not a defect in the planning. It is the ordinary condition of acting…
Most agents end up holding more tools than they use. Each one seemed reasonable to add at the time, and none of them seemed expensive to keep. The place this reasoning breaks is in what a tool actually is to the model. A tool is not an action the agent reaches for only when the moment calls for it. It…
Most failure handling is built around the case where the system eventually gets what it wanted. Retry the call and it works the second time. Reach for the alternate tool and it returns. That branch is satisfying to design because every path on it ends in success, and it absorbs most of the attention a team gives to reliability. The…