Blog

Field notes from a career spent close to the metal. 22 posts so far.

  1. An AI assistant needs one door into your data, not a key to every SaaS appSteward gives Claude a single read-only tool over the curated warehouse, with field-level authorization compiled to Cedar. Here is why I built it that way instead of wiring up one connector per product.AI6 min
  2. An ADR is only as good as what actually reads itA decision record that only lives as prose is something an agent has to be told to go open. The ones that survive are the ones also wired into a table, a script, or a test the agent's normal workflow already touches.Development4 min
  3. Bedrock model access is three gates, not one permissionA Bedrock AccessDeniedException can mean three different things, so we built a nightly discovery job and a runbook that checks each gate in order.Infrastructure4 min
  4. The credential nobody watchedA shared service-account token expired silently and took a production integration down for 40 hours. The fix that mattered wasn't rotation. It was making four causes of the same error distinguishable.Infrastructure4 min
  5. I deleted five AI review agents and the reviews got betterA five-specialist review fan-out looked thorough. One session cost $5.88 and 905 seconds for zero findings, and that's what actually changed the design.AI4 min
  6. A green test suite is not proof a non-programmer's edit was safeA change-tier system and a verifier that fails risky edits even when every test passes, because a green suite is not evidence the change was safe.AI5 min
  7. Don't trust a model's arithmetic, only its tool callsWhy I moved every numeric answer out of model prose and into a calculator tool call, and what a data-quality investigation taught me about trusting the output.AI5 min
  8. Field-level authorization for AI agents, enforced in-processRow-level access control tells an agent nothing exists. Section-level tells it the entity exists with fewer fields, and that difference changes what an agent can safely ask.AI4 min
  9. Forcing the model to do arithmetic in PythonAn LLM cannot be trusted to self-report whether it actually did math, so a Stop hook checks mechanically whether a real calculation tool ran first.AI4 min
  10. 47 ADRs on one plugin in six weeks, what amend-in-place bought usA decision log is valuable because it preserves disagreement with your past self, illustrated by ADRs that reversed their own measured evidence in place.Development5 min
  11. A green pipeline is not evidenceTwo load-bearing CI gates ran green for months without comparing anything, because the base image had no git and nobody noticed the difference between passing and not running.Development4 min
  12. Your infrastructure has a new client, and it pushes changesThe architecture diagram for our shared AWS platform names two human actors and lists an AI coding agent's own cloud egress as a third. That's a trust-model decision, not a diagram detail.Infrastructure4 min
  13. The judge that never firesA quality check the model can choose to invoke isn't weak enforcement. It's no enforcement, and the corpus behind it has a measured number to prove it.AI4 min
  14. A hand-rolled agent loop that works is not a reason to keep itWhen a vendor SDK actively maintains the parts of an agent loop you built by hand, the build-vs-adopt math changes even if your version already works.AI4 min
  15. One gateway, eight backends, and no MCP session in sightWhy an internal MCP aggregation gateway hand-rolls raw HTTP instead of the standard SDK client, and how it disambiguates tool names across eight backends.Infrastructure6 min
  16. A shared library across two languages needs a contract, not parityRunning the same MCP service shape in TypeScript and Rust only works if you decide, in writing, which parts are a contract and let everything else diverge.Infrastructure4 min
  17. The prompt-cache floor that made the cheap model expensiveA two-tier triage pipeline assumed its cheap model's shared prompt was cached. Real token telemetry showed it never once was.AI4 min
  18. What a bot vote is allowed to decideThe architecture decision trail behind letting an AI code-review job cast a real merge approval, and the explicit line we drew around what that vote can never do alone.AI5 min
  19. Delegating to agents without losing the threadFanning work out to parallel agents is easy. Staying responsible for the result is the part that needs a method.AI4 min
  20. Hosting a Claude Code marketplace on your own domainIt works, but three undocumented-feeling constraints will bite you. Here they are before they do.AI3 min
  21. Static exports do not forgiveFour ways a Next.js static export broke during a rebuild, and what each one was actually telling me.Development3 min
  22. What outlives the TerraformMoving off AWS is mostly deletion. The risk is entirely in the handful of things deletion does not cover.Infrastructure4 min