The interface between an agent and the outside world is not a flat list of functions. When you look closely at what an agent can actually reach, the capabilities sort into a small number of kinds, and the line that separates them is not what each one does. It is who decides to use it. Some capabilities the model invokes…
Once you accept that code, not a prompt, has to enforce a high-stakes constraint, the interesting question is no longer whether to add enforcement but what that enforcement is as a piece of architecture. “Add a validation layer” is a slogan, not a design. A check placed where it cannot see the thing it is meant to catch protects nothing. A check that…
A prompt is not a document you write once and file away. It is a piece of production behavior. It decides what your system returns, it changes over the life of the system, and every change to it changes the output for every request that flows through it. That makes a prompt an artifact in the same sense that a…
A written instruction and a worked example can ask for the same output, and the example will get it more reliably almost every time. This is not a matter of the example being longer or more emphatic. It is a matter of what each one asks the model to do. An instruction describes the output you want and leaves…
Once you accept that a tool’s raw output should not enter context unchanged, the reflex is to treat trimming as a single technique with one implementation: strip the payload down to what the agent needs and pass along the remainder. That framing hides the actual decision. There is no single trim. There are three distinct strategies, they trade away different resources…
Every agent accumulates state as it runs: the plan it is working from, the outputs of the steps it has finished, the results of the tools it has called, the facts it retrieved to make a decision. That state has to live somewhere, and there are only two categories of somewhere. It can sit inside the context the model is already reading, or…
Almost every instruction an agent receives is under-specified in some way. A human hands off a goal that seemed complete when they wrote it, and the agent discovers, partway in, that the words admit more than one reasonable reading. The output format was never stated. The scope has a soft edge. A pronoun points at two possible things. This is not a failure…
The hard part of connecting a model to the world was never the model. It was the connection. Every agent that does anything useful reaches outside itself into a database, an internal service, a search index, a ticketing system, and each of those reaches is an integration that someone has to write, secure, and keep working. As long as each of those integrations is…
A system prompt is an instruction the model is asked to follow, and most of the time it does. That reliability is real, and it is easy to mistake for a control. It is not one. A prompt shapes the distribution of outputs a model tends to produce; it does not close off the outputs you told it to avoid. On the…
Deterministic validation can only enforce standards you can state as a rule. A schema check, a range check, a check that two fields agree: each one closes a failure you were able to write down in advance. But a large share of what makes an output good cannot be written down that way. Is this summary faithful to what it summarizes? Does…