Consulting · AI & agent infrastructure
The model is rarely the hard part. The hard part is that an agent calling a tool is a distributed system with an unusual property: it decides at runtime what to do next. That turns ordinary questions — whose permissions apply, which version of a decision is current, what happens when it is confidently wrong — into architecture problems. I work on that layer, not on prompt tuning.
01Who this is for
02Approach
Identity first, then reach, then what the agent is trusted to remember. Each decision constrains the next.
User token, workload identity, both, or neither — each has a different failure mode. This choice constrains everything downstream, so it comes first.
Audience-scoped tokens and workload identity, so a stolen credential is useful in one place rather than everywhere. Agents get the surface they need, not the surface that exists.
Verified decisions should outrank inferred observations, and superseded knowledge should not win by default. Retrieval that ignores this is how agents contradict their own team.
Agent-written notes are untrusted input. A review step before model output becomes institutional knowledge is the difference between memory and rumour.
Structured records of what was called, under whose authority, and on what basis — so incident response has something to read.
03Tradeoffs
Every one of these has a downside. Here is what you are accepting and what you get for it.
More moving parts and more to operate. The alternative is a single credential whose compromise is indistinguishable from legitimate use.
A central policy plane becomes a dependency and a failure point needing its own capacity planning. With a handful of servers keep logic in the servers; with dozens or multiple tenants, the gateway earns its place.
Slower, and it needs someone to do the reviewing. It is also the only thing stopping a confident wrong inference from becoming permanent.
04Deliverables
Scoped as a focused assessment. Anything beyond this is agreed before it starts, not assumed.
05Evidence
Where the work is still in development, it is labelled as such rather than presented as a delivered result.
Project · MemLore · in development
An engineering intelligence layer, in active development, that gives coding agents in Cursor, Claude Code, and Codex the team's current, evidenced decisions over MCP, instead of whatever text happens to be most similar.
Technical write-up
Four ways to decide which identity sits behind an agent's tool call on Kubernetes, what each costs, and how to layer them.
Technical write-up
Why similarity search misleads coding agents, and what ranking context by authority and recency changes.
Next step
Which systems they reach, whose permissions they borrow, and what happens when one is confidently wrong. If the honest answer is that you are not ready to give agents production access yet, I will say that too.