[{"data":1,"prerenderedAt":458},["ShallowReactive",2],{"blog-post-detail-i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m":3,"blogs-all-posts-detail-suggestions-en":28,"blog-comments-i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m-en":393},{"status":4,"source":5,"data":6},"success","markdown-file",{"id":7,"title":8,"slug":9,"lang":10,"category":11,"categorySlug":12,"summary":13,"excerpt":13,"author":14,"date":15,"readTime":16,"image":17,"tags":18,"publishedAt":22,"createdAt":22,"updatedAt":22,"filePath":23,"sourceUrl":24,"content":25,"seoTitle":26,"seoDescription":13,"canonicalUrl":27},"cron-1786954321092","I Stopped Trusting AI Agents With Tools. So I Built a Gatekeeper.","i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m","en","Security","security","Update 08\u002F15 0.2.0 Released   github.com\u002Fdeghosal-2026\u002Fagent-tooltrust · pip install agent-tooltrust...","Debashish Ghosal","17\u002F8\u002F2026","6 phút","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fr97gsrqar0qk7ejjibih.png",[11,19,20,12,21],"ai","agents","gatekeeper","2026-08-17T08:12:01.092Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m.md","https:\u002F\u002Fdev.to\u002Fdebashish_ghosal\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-26fb","\n**Update 08\u002F15** [0.2.0 Released](https:\u002F\u002Fdev.to\u002Fdebashish_ghosal\u002Fi-shipped-an-agent-gatekeeper-v01-14-developers-showed-me-what-i-missed-heres-v02-a-4n2n)\n> [github.com\u002Fdeghosal-2026\u002Fagent-tooltrust](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust) · `pip install agent-tooltrust` · [field test report](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002FFIELD_TEST_REPORT.md) · [design decisions](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Fdesign\u002Fdesign-decisions.md)\n\n## Quick Note - Field Test was on my mind from the start\nMy last three projects taught me the same thing. Mock agents lie. Unit tests pass. Demos look clean. Then real agents run and everything breaks.\n\nOn my [eval harness](https:\u002F\u002Fdev.to\u002Fdebashish_ghosal\u002Fi-built-an-agent-eval-harness-real-agents-broke-the-clean-version-of-the-story-53dj), I admitted it: field testing \"got added ad hoc, late in the build, because I started getting nervous that unit tests and mock agents were hiding real integration problems.\" On my observability tool: \"I thought it was a detector problem. I was wrong.\"\n\nSame lesson. Three times. But lessons only matter if you change what you do next.\n\nSo this time I did the opposite. Zero mock agents. 83 real ones across 10 frameworks. A covering design that cut a 12-day test matrix into one afternoon. And a release gate that said: no ship until real agents prove the policy works.\n\nIt worked. 2,490 tests green. 83\u002F83 agents passed. PyPI published. Repo public. And the 7 failures taught me something I couldn't have learned any other way.\n\n## The Problem With Allow-Lists\n\nEveryone is racing to give AI agents more tools. Almost no one is building the permission system that decides when those tools should fire.\n\nRight now, agent permissions are binary: allowed or denied. That's reachability, not authorization. The same tool is harmless in staging and dangerous in production. The same read is fine on public docs and risky on customer data. A `delete` in a CI sandbox is not the same as `delete` in production.\n\nAbout 18% of MCP server deployments implement any access scoping. 80% of orgs admit agents have taken actions beyond intended scope. OWASP classifies agent tool misuse as a first-class risk.\n\nGiving an agent tools is the easy part. The hard part is deciding what it should be allowed to do, where, and under what guardrails. I wrote a [PRD](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Fdesign\u002FPRD.md) and [architecture spec](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Farchitecture-v0.1.0.md) before touching engine code — partly to keep myself honest, partly because I've learned the hard way that skipping design leads to shipping the wrong thing.\n\n## What I Built\n\nAgent ToolTrust is a contextual risk and permission engine. Before an agent's tool call executes, the engine runs a five-stage pipeline — normalize, score, decide, explain, audit — and returns one of four decisions: allow, audit, escalate, or deny.\n\n```python\nfrom agent_tooltrust.engine.engine import Engine\nfrom agent_tooltrust.policy.models import default_policy\nfrom agent_tooltrust.adapters.raw import RawAdapter\n\nengine = Engine(default_policy(\"balanced\"))\nadapter = RawAdapter(engine)\n\n@adapter.guard(\n    tool_name=\"deploy_service\",\n    action=\"deploy\",\n    envir,\n    data_class=\"restricted\",\n)\ndef deploy_service(service: str) -> str:\n    return f\"deployed {service}\"\n\n# Agent calls the tool. Engine evaluates first.\n# production deploy on restricted data → escalate\ndeploy_service(\"payment-api\")\n# ToolTrustDecisionError: escalate — \"Write action (deploy) in production\n# on restricted data requires approval...\"\n```\n\nThe decorator is the integration point. The agent calls the tool. The engine intercepts, evaluates, and either lets it through, audits it, escalates to a human, or denies it. The agent never sees the policy. The LLM never knows the rules exist.\n\nThe engine is deterministic. The LLM proposes, policy disposes. No amount of prompt engineering can override a deny — because the engine is outside the model, not inside the prompt.\n\nFour decisions, not two. `allow` and `deny` are obvious. `audit` means \"allow but log everything — this is a read on sensitive data.\" `escalate` means \"stop and get a human.\" Binary allow\u002Fdeny forces you to choose between over-privileged agents and approval fatigue. Four states give you a middle ground.\n\nEvery decision comes with an explanation — a reason code, a human sentence, and a factor breakdown showing which dimension drove the call. Optional LLM prose, off by default. The LLM cannot change the decision.\n\nEvery decision is audited — JSONL, SQLite, or Postgres, with policy version, timestamp, and session ID.\n\nThree posture presets ship out of the box — strict, balanced, permissive — so no one starts from a blank file. YAML policy backend for humans, OPA\u002FRego backend for teams that already have Rego policies. Shadow mode so you can deploy, observe what would have been denied, tune, then enforce — without changing agent code.\n\nFail-closed everywhere. Unknown tool → deny. Malformed input → deny. Engine crash → deny. The alternative is fail-open, which means an attacker who can crash the engine gets unrestricted tool access. That's [design decision DD-14](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Fdesign\u002Fdesign-decisions.md) — written before the first line of code, not retrofitted after a near-miss.\n\nThat's the architecture. But architecture is the easy part. Does it actually work when real agents try to use it?\n\n## This Time, I Applied the Learning\n\nOn previous projects, the field test was the thing I skipped and regretted. On EvalForge, I added it late and discovered the pass rate was 9% — not because the tool was bad, but because mock agents had hidden every integration problem. On AgentObservatory, I learned that \"the integration, not the judge, broke me.\"\n\nThis time, I put it in the spec before writing any adapter code. [DD-11](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Fdesign\u002Fdesign-decisions.md): \"Field tests must pass before any release. They run real agents, not mocks.\" DD-12: \"8-10 real agents across major platforms.\"\n\nI went further than both. Not 8-10 agents. 83 real agents across 10 frameworks. And the [field test plan](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002Ffield-test-plan.md) was in the WBS from day one.\n\nThis is the difference between learning a lesson and applying one.\n\n## Building the Adapters Was Exploratory\n\nI wanted this to work across the real agent ecosystem, not just one framework I happened to know. So I built adapters for 10 frameworks:\n\n**LangGraph, PydanticAI, CrewAI, OpenAI Agents SDK, Google ADK, AutoGen\u002FAG2, LlamaIndex, smolagents, SWE-bench (self-test), ToolTrust MCP** (self-test).\n\nEvery adapter follows the same contract — extract a `CallContext`, forward it to `Engine.evaluate()`, surface the decision back:\n\n```python\n@dataclass(frozen=True)\nclass CallContext:\n    tool_name: str\n    action: str\n    environment: str\n    data_class: str\n    agent_id: str\n    session_id: str | N    arguments: dict[str, Any] | N contract is clean. Getting there was not.\n\nEach framework has its own opinions about how tools are registered, how they're invoked, and how errors surface. I'd write the adapter, run it against a real agent, watch it fail in some framework-specific way, fix it, and repeat. Every failure taught me something about how that framework actually works — not how the docs describe it, but how it behaves when a real agent is driving it. The full per-framework wiring notes are in [§5 of the field test report](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002FFIELD_TEST_REPORT.md) — 12 separate learnings.\n\nLangGraph's `ToolTrustToolNode` subclasses `ToolNode` and overrides `_run_one()`. But in langgraph v1.x, the node isn't callable — so I fell back to wrapping the tool before it enters the graph:\n\n```python\n# LangGraph — wrap the tool, then hand it to the graph\nadapter = RawAdapter(engine)\nguarded_tool = adapter.guard(\n    tool_name=\"query_logs\",\n    action=\"read\",\n    envir,\n    data_class=\"internal\",\n)(query_logs_fn)\n\n# Now hand guarded_tool to create_react_agent(llm, tools=[guarded_tool])\n```\n\nGoogle ADK's LLM registry only knows about Gemini. To use a local model, you pass `LiteLlm(model=f\"openai\u002F{MODEL}\", api_base=ENDPOINT)`. And `InMemorySessionService.create_session()` is a coroutine — you have to `await` it, not call it synchronously. The docs don't mention this. The runtime teaches you.\n\nLlamaIndex's legacy `ReActAgent` has no `.query()` or `.chat()`. You need the workflow agent from `llama_index.core.agent.workflow`. And execution is driven by `async for event in handler.stream_events()` — a separate `await handler` yields nothing. The `async for` is what drives the agent forward. Without it, the agent silently does nothing. I spent an hour on that.\n\nAutoGen needs hyphens sanitized from agent IDs (`ag-01` → `ag_01`). The local Qwen model answers textually unless you tell it: \"you MUST call the tool exactly named `scn_\u003Cid>`. Do not skip the tool call.\"\n\nsmolagents requires full docstrings with per-arg descriptions on every `@tool` — or it throws `DocstringParsingException`. CrewAI needs `litellm` as a fallback. OpenAI Agents SDK needs `function_tool(..., strict_mode=False)` to fix a pydantic conflict.\n\nNone of these show up with mock agents. They only surface when you run real code from real repos. And every one I fixed made the adapter stronger.\n\nBy the end, all 10 frameworks built, recorded decisions, and ran real agents through the engine. Ten frameworks where the interception point is proven, not theoretical.\n\n## 83 Real Agents, 30 Scenarios, Zero Mocks\n\nI sourced 83 real agents from GitHub. Not toy examples — real repos with real dependencies, real packaging, real opinions about how to invoke an LLM.\n\nI wrote 30 scenarios: 20 decision scenarios covering all four decision types across 5 agent classes (ci-bot, engineer, general, analyst, sensitive), plus 10 adversarial scenarios — prompt injection, Unicode obfuscation, replay attempts, blank tool names, malformed inputs, grant-bypass attempts. The full matrix is in the [field test report](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002FFIELD_TEST_REPORT.md) — every agent, every scenario, every expected and actual decision.\n\nThe math: 83 agents × 30 scenarios = 2,490 runs. Each run calls a local LLM — `Qwen3.5-4B-4bit` via OMLX on Apple Silicon. Each call takes 30-80 seconds. That's roughly 2.7 hours at 10 workers.\n\nBut 2,490 is the theoretical minimum. In practice, you debug. Adapters break. Agents fail to import. The LLM answers textually instead of calling a tool. You fix, re-run, fix again. The actual number of LLM calls was 4-5x higher — over 10,000 calls to a local 4B model.\n\nThis is the cost of zero mock agents. I'd pay it again.\n\nMock agents don't need an LLM. They don't take 80 seconds. They don't bring a C extension with the wrong ABI. They don't hardcode API keys at module scope. They don't write to `\u002Froot` at import time.\n\nReal agents do all of that. And every one of those failures is a bug that would have shipped if I'd used mocks.\n\n## Turning 12 Days Into 1\n\nHere's where I stopped brute-forcing. 2,490 runs through a local 4B model to re-prove what deterministic tests already cover made no sense. Engine correctness was already validated — 2,490 assertions, zero LLM calls, 100% green. The engine is framework-agnostic. `Engine.evaluate()` doesn't care whether the caller is LangGraph or CrewAI. Re-running every cell was redundant.\n\nThe field test's real job was adapter proof — does each framework correctly surface allow, audit, escalate, and deny in a real agent loop? That's a covering problem, not a cross-product problem.\n\nSo I split it into two plans.\n\n**Plan A — one scenario per agent (83 runs).** Each agent gets exactly one scenario. The assignment covers all 30 scenarios, all 10 frameworks, all 5 agent classes. Result: **83\u002F83, 100%.**\n\n**Plan B — per-framework decision-type proof (123 runs).** For each framework, run a tier-1 agent against all 4 decision types plus adversarial scenarios. Result: **116\u002F123, 94%.**\n\nTogether: **206 runs instead of 2,490. Same coverage — 30\u002F30 scenarios, 83\u002F83 agents, 10\u002F10 frameworks, 5\u002F5 classes. ~12x reduction.** The full coverage rationale is in [§8 of the field test report](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002FFIELD_TEST_REPORT.md).\n\nThis is the part I'm most proud of. Not the engine — that's straightforward. The covering design. The recognition that expensive LLM calls should be spent on what only real agents can prove, not on re-proving what deterministic tests already cover.\n\nThe full cross product would have taken ~12 days. The covering design took one afternoon. Same confidence. On previous projects, I would have either skipped the field test or brute-forced it and run out of time. This time, I optimized.\n\n## What the 7 Failures Taught Me\n\nThe 7 Plan B failures were the most valuable part of the field test. Not because they broke something — because they revealed something no mock would have caught.\n\nAll 7 shared one pattern: `not-available`. The guard never fired because the LLM didn't call the tool. The local Qwen model, when given 5 tools at once, sometimes answered textually instead of invoking the guarded tool. The engine never got a chance to decide.\n\nA mock agent always calls the tool. A real 4B model sometimes doesn't.\n\n**Never interpret `not-available` as a policy failure.** It means the LLM didn't call the tool. That's different from `unexpected-decision` — when the guard ran and the engine made the wrong call. Only the latter is a real regression.\n\nEvery tool call that actually executed in Plan B produced the correct decision. The 7 failures pointed at the LLM, not the engine.\n\nThis matters for CI. If you fail on `not-available`, your gate is flaky because of model nondeterminism. If you fail only on `unexpected-decision`, your gate is strict but stable. The [field test report](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002FFIELD_TEST_REPORT.md) recommends committing a golden `not-available` allowance so CI fails on real regressions, not on the LLM having a bad day.\n\nI couldn't have learned this with mocks. It took 83 real agents.\n\n## The Replan Loop\n\nThe result I'm most satisfied with: the deny → replan → allow safety loop.\n\nWhen an agent tries `drop_database`, the engine denies it. A good agent doesn't just stop — it replans. It picks a different, benign tool. The engine allows it. Both calls are audited.\n\n```python\n@adapter.guard(\n    tool_name=\"drop_database\",\n    action=\"delete\",\n    envir,\n    data_class=\"restricted\",\n)\ndef drop_database(db: str) -> str:\n    return f\"dropped {db}\"\n\n@adapter.guard(\n    tool_name=\"query_audit_log\",\n    action=\"read\",\n    envir,\n    data_class=\"internal\",\n)\ndef query_audit_log(query: str) -> str:\n    return f\"audit rows for {query}\"\n\n# Agent tries drop_database → engine denies (delete in production)\n# Agent replans → calls query_audit_log → engine allows (read in production)\n# Both decisions audited. Agent redirected, not blocked.\n```\n\nTested across all 8 LLM frameworks. **8\u002F8 live, 8\u002F8 scripted.** Every framework denied the destructive call, replanned to a benign read, and got an allow. The full replan results are in [§2.5 of the field test report](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002FFIELD_TEST_REPORT.md).\n\nThe agent isn't blocked — it's redirected. And every step is on the audit trail. This is the pattern I'll build on in v0.2: the escalation round-trip, where a human approves or denies, and the agent resumes.\n\n## What I Learned\n\nOn previous projects, I learned that field testing should be planned, not improvised. This time I learned something deeper: **it should be optimized, not brute-forced.**\n\nThe covering design — Plan A + Plan B — is the application of that learning. 206 runs instead of 2,490. Same coverage. The expensive resource spent on what only real agents can prove. The progression: skip it → add it late → plan it from the start → optimize it. Four projects, four steps.\n\n**Zero mock agents is the right call.** The integration cost is real — 8 compatibility wrappers, 3 pyproject fixes, 1 quarantined C extension, 12 framework quirks [documented in the report](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002FFIELD_TEST_REPORT.md). But every fix caught a real bug that a mock would have hidden. The cost of mocks is invisible until production. The cost of real agents is visible from the first run.\n\n**`not-available` is not a policy failure — it's an LLM reliability signal.** Distinguishing it from `unexpected-decision` is the difference between a flaky CI gate and a strict one.\n\n**Fail-closed everywhere is non-negotiable.** [DD-14](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Fdesign\u002Fdesign-decisions.md), written before the first line of code.\n\n**The replan loop works at scale.** 8\u002F8 frameworks. The agent isn't blocked — it's redirected.\n\n**10 frameworks is the right number for v0.1.** Enough to prove the adapter contract generalizes. Not so many that integration drowns the engine. The 8 that needed LLM calls all passed. The 2 self-test frameworks ran deterministically in CI.\n\n## What You Can Use\n\n**Building agents with tools?** `pip install agent-tooltrust`, run `tooltrust init --posture balanced`, decorate your tools. Four-state decisions with explanations and audit trails. No infrastructure. The [quickstart](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Freference\u002Fquickstart.md) walks through it.\n\n```bash\npip install agent-tooltrust\ntooltrust init --posture balanced\n```\n\n**Have existing OPA\u002FRego policies?** The dual backend reuses them. Same input, same output. No rewrite. The [API reference](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Freference\u002Fapi.md) covers both.\n\n**Want to observe before enforcing?** Shadow mode (`dry_run=True`) logs every decision without blocking. Deploy, observe, tune, enforce.\n\n**Using LangGraph, PydanticAI, CrewAI, OpenAI Agents SDK, Google ADK, AutoGen, LlamaIndex, or smolagents?** There's an adapter tested against real agents. The [integration guide](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Freal-agent-integration\u002FREADME.md) has per-framework wiring.\n\n## How You Can Extend It\n\n**Custom risk functions** — register your own with `@tooltrust.risk_function`, plug into the weighted sum, don't touch the engine.\n\n**Community policy packs** — map a tool ecosystem (GitHub admin, AWS cost ops, Notion writes) onto the taxonomy. `tooltrust pack validate`, `tooltrust pack add`.\n\n**New audit sinks** — the `AuditSink` interface is pluggable. Splunk, Datadog, whatever your SIEM is.\n\n**New framework adapters** — `BaseAdapter` is three methods. Extract the context, forward to the engine, surface the decision. Maybe 50 lines. The pattern is proven across 10 frameworks.\n\n**Custom posture presets** — the three shipped presets are YAML files. Fork one, tune thresholds, ship your org's default.\n\nThe [architecture doc](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Farchitecture-v0.1.0.md) and [14 design decisions](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Fdesign\u002Fdesign-decisions.md) are in the repo if you want the internals.\n\n## What's Shipped\n\nRepo: [github.com\u002Fdeghosal-2026\u002Fagent-tooltrust](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust)\nPyPI: `pip install agent-tooltrust` (v0.1.1)\n\n2,490 deterministic tests. Ruff 0. Mypy strict 0. Docker pass. SWE-bench verified. OWASP 5\u002F10. OpenSSF Silver. 10 frameworks, 83 real agents, 30 scenarios, zero mocks. 83\u002F83 Plan A. 116\u002F123 Plan B. 8\u002F8 replan loop. Branch protected. Repo public.\n\nThis is v0.1.0. The engine is shipped and proven. The platform — escalation round-trip, policy packs, rule composition, HTTP \u002Fauthorize, replay detection, child-agent delegation — is 32 open issues for v0.2.0. The [WBS](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Fwbs\u002FREADME.md) tracks it all. The [field test report](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002FFIELD_TEST_REPORT.md) is honest about what's proven and what's not.\n\n## Questions\n\n- What happens when your agent tries to call a tool it shouldn't? Does your system know the difference between a read in staging and a write in production? Or are you using an allow-list and hoping?\n\n- If you've field-tested agents across multiple frameworks, what broke first — the policy, the adapter, or the LLM? Did mocks hide problems that surfaced later?\n\n- Has anyone hit the `not-available` problem — the LLM doesn't call the tool and you can't tell if it's a policy failure or a model issue? How do you handle it in CI?\n\n- Is four-state (allow\u002Faudit\u002Fescalate\u002Fdeny) the right granularity, or overkill compared to binary? The `audit` state was the one I wasn't sure about.\n\n- For OPA\u002FRego users — does dual-backend (YAML + Rego) make sense, or would you rather have Rego-only?\n\n- The covering design cut the matrix 12x. Has anyone else applied combinatorial testing to LLM-based agent testing? I haven't seen this pattern elsewhere — is it novel or just underdocumented?\n\nThe [repo](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust) has the full [PRD](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Fdesign\u002FPRD.md), [architecture](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Farchitecture-v0.1.0.md), [design decisions](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Fdesign\u002Fdesign-decisions.md), [field test plan](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002Ffield-test-plan.md), and [field test report](https:\u002F\u002Fgithub.com\u002Fdeghosal-2026\u002Fagent-tooltrust\u002Fblob\u002Fmain\u002Fdocs\u002Ffield-test\u002FFIELD_TEST_REPORT.md). Star it, fork it, break it. I'd rather you break it now than after you ship it to production.\n\n---\n\n> 🔗 **Nguồn bài viết gốc**: [Debashish Ghosal](https:\u002F\u002Fdev.to\u002Fdebashish_ghosal\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-26fb)\n","I Stopped Trusting AI Agents With Tools. So I Built a Gatekeeper. - Intlight Insights","https:\u002F\u002Fintlighttech.com\u002Fblogs\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m",{"items":29,"total":356,"page":357,"totalPages":357,"limit":358,"lang":10,"categories":359,"popularTags":373},[30,49,65,78,94,108,120,133,147,161,175,187,199,211,224,237,251,263,277,290,304,317,329,342,344],{"id":31,"title":32,"slug":33,"lang":10,"category":34,"categorySlug":35,"summary":36,"excerpt":36,"author":37,"date":38,"readTime":39,"image":40,"tags":41,"publishedAt":46,"createdAt":46,"updatedAt":46,"filePath":47,"sourceUrl":48},"cron-1786956218725-en","I Thought I'd Lost the Plot. I Was Writing It.","i-thought-id-lost-the-plot-i-was-writing-it-wjvz","AI Agents","ai-agents","I Thought I'd Lost the Plot. I Was Writing It.            I set out to build autonomous...","Joe Black","8\u002F17\u002F2026","6 min read","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fa3l9h76kr920p8bm2mjp.png",[34,42,43,44,45],"claudecode","aiagents","developmenttools","autonomousagents","2026-08-17T08:43:38.725Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fi-thought-id-lost-the-plot-i-was-writing-it-wjvz.md","https:\u002F\u002Fdev.to\u002Fjoeblackwaslike\u002Fi-thought-id-lost-the-plot-i-was-writing-it-5fil",{"id":50,"title":51,"slug":52,"lang":10,"category":53,"categorySlug":54,"summary":55,"excerpt":55,"author":56,"date":38,"readTime":39,"image":57,"tags":58,"publishedAt":62,"createdAt":62,"updatedAt":62,"filePath":63,"sourceUrl":64},"cron-1786956216746-en","What Is the Circuit Breaker Pattern? A Practical Guide","what-is-the-circuit-breaker-pattern-a-practical-guide-4j68","Microservices","microservices","What Is the Circuit Breaker Pattern? A Practical Guide for Developers   Imagine your...","Avijit Bera","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fi6cy1uyqxjd14ikkveev.png",[53,54,59,60,61],"backend","api","Trending","2026-08-17T08:43:36.746Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fwhat-is-the-circuit-breaker-pattern-a-practical-guide-4j68.md","https:\u002F\u002Fdev.to\u002Favijitbera\u002Fwhat-is-the-circuit-breaker-pattern-a-practical-guide-20i4",{"id":66,"title":67,"slug":68,"lang":10,"category":11,"categorySlug":12,"summary":69,"excerpt":69,"author":70,"date":38,"readTime":39,"image":71,"tags":72,"publishedAt":75,"createdAt":75,"updatedAt":75,"filePath":76,"sourceUrl":77},"cron-1786956214008-en","I attacked my own npm package before launching it. It let the proposer approve their own writes","i-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-oi6y","My library exists so a human approves an LLM's UPDATE before it runs. It never checked that the approver was somebody other than the proposer — and wrote \\\"approved\\\" into the audit trail anyway.","hyuga","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F65yv5n4qvrgn3t6ot4gy.png",[11,73,19,12,74],"opensource","database","2026-08-17T08:43:34.007Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-oi6y.md","https:\u002F\u002Fdev.to\u002Fhyuga611\u002Fi-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-4mki",{"id":79,"title":80,"slug":81,"lang":10,"category":82,"categorySlug":83,"summary":84,"excerpt":84,"author":85,"date":38,"readTime":39,"image":86,"tags":87,"publishedAt":91,"createdAt":91,"updatedAt":91,"filePath":92,"sourceUrl":93},"cron-1786956210950-en","Build an MCP Server in Go (Part 1): Designing a diagnostic-grade Kubernetes client","build-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-p1d4","Kubernetes","kubernetes","This post designs the Kubernetes client. The next post wraps it as an MCP server and wires it to an...","Fer Rios","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fpw4b055hh8hxl5unrmvv.png",[82,83,88,89,90],"go","devops","mcp","2026-08-17T08:43:30.949Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fbuild-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-p1d4.md","https:\u002F\u002Fdev.to\u002Fferztyle\u002Fbuild-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-49a2",{"id":95,"title":96,"slug":97,"lang":10,"category":34,"categorySlug":35,"summary":98,"excerpt":98,"author":99,"date":38,"readTime":39,"image":100,"tags":101,"publishedAt":105,"createdAt":105,"updatedAt":105,"filePath":106,"sourceUrl":107},"cron-1786956117904-en","The Write Policy Is the Hard Part: Promotion Pipelines for Agent Memory","the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9","Storing agent memory is easy. Deciding what earns a permanent write, and keeping the write-path alive through RBAC and network policy, is the real work.","Guatu","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fguatulabs.dev%2Fog%2Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory.png",[34,43,102,103,104],"agentmemory","rbac","networkpolicies","2026-08-17T08:41:57.903Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9.md","https:\u002F\u002Fdev.to\u002Ffuthgar\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-5mc",{"id":109,"title":110,"slug":111,"lang":10,"category":34,"categorySlug":35,"summary":112,"excerpt":112,"author":113,"date":38,"readTime":16,"image":114,"tags":115,"publishedAt":117,"createdAt":117,"updatedAt":117,"filePath":118,"sourceUrl":119},"cron-1786955347611","I Changed How I Think About AI Memory","i-changed-how-i-think-about-ai-memory-fnpm","I Changed How I Think About AI Memory   When I first built Lean AI Memory, I focused too...","Phúc Phùng","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F0oqod5zshdan74573bau.png",[34,19,43,73,116],"git","2026-08-17T08:29:07.610Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fi-changed-how-i-think-about-ai-memory-fnpm.md","https:\u002F\u002Fdev.to\u002Fphucphungbk\u002Fi-changed-how-i-think-about-ai-memory-4mkd",{"id":121,"title":122,"slug":123,"lang":10,"category":53,"categorySlug":54,"summary":124,"excerpt":124,"author":125,"date":38,"readTime":16,"image":126,"tags":127,"publishedAt":130,"createdAt":130,"updatedAt":130,"filePath":131,"sourceUrl":132},"cron-1786955347443","Real-Life Refactoring Example: ~3x Less Code to Read","real-life-refactoring-example-3x-less-code-to-read-dccm","There is a popular idea that refactoring is making code shorter. It is not entirely wrong....","Valentine Shi","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Foubl9dlj23byhsak2mqy.png",[53,128,129,59,54],"node","software","2026-08-17T08:29:07.443Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Freal-life-refactoring-example-3x-less-code-to-read-dccm.md","https:\u002F\u002Fdev.to\u002Fvalentineshi-dev\u002Freal-life-refactoring-example-3x-less-code-to-read-3mdl",{"id":134,"title":135,"slug":136,"lang":10,"category":11,"categorySlug":12,"summary":137,"excerpt":137,"author":138,"date":38,"readTime":16,"image":139,"tags":140,"publishedAt":144,"createdAt":144,"updatedAt":144,"filePath":145,"sourceUrl":146},"cron-1786955347034","The Tragedy of the Clean-Handed Auditor","the-tragedy-of-the-clean-handed-auditor-rgoz","\\\"I could save them if they'd only listen...\\\"  Hey, you. Yeah, you: the compliance or governance...","Ben Link","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F5z426h3tt6e2b3sthd2f.png",[11,12,141,142,143],"compliance","developers","careerdevelopment","2026-08-17T08:29:07.034Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fthe-tragedy-of-the-clean-handed-auditor-rgoz.md","https:\u002F\u002Fdev.to\u002Flinkbenjamin\u002Fthe-tragedy-of-the-clean-handed-auditor-1253",{"id":148,"title":149,"slug":150,"lang":10,"category":82,"categorySlug":83,"summary":151,"excerpt":151,"author":152,"date":38,"readTime":16,"image":153,"tags":154,"publishedAt":158,"createdAt":158,"updatedAt":158,"filePath":159,"sourceUrl":160},"cron-1786955346614","Building Sluice: QoS-Aware Capacity Governance for Self-Hosted LLM Inference","building-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-flbu","📦 Project: https:\u002F\u002Fgithub.com\u002FVampiricCyborg\u002Fsluice           1. The Problem: When Capacity Becomes...","Madhav M S","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fh3vuie9oakcn3bqzxtbh.png",[82,155,156,83,157],"distributedsystems","llm","systemdesign","2026-08-17T08:29:06.613Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fbuilding-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-flbu.md","https:\u002F\u002Fdev.to\u002Fvampiriccyborg\u002Fbuilding-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-13ja",{"id":162,"title":163,"slug":164,"lang":10,"category":34,"categorySlug":35,"summary":165,"excerpt":165,"author":166,"date":38,"readTime":16,"image":167,"tags":168,"publishedAt":172,"createdAt":172,"updatedAt":172,"filePath":173,"sourceUrl":174},"cron-1786954879160","Test What Your AI Agents Must Not Do","test-what-your-ai-agents-must-not-do-fj6y","A Guardrail Without A Negative Test Is Still An Assumption   Most AI agent governance starts...","Bobai Kato","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fres.cloudinary.com%2Fota-run%2Fimage%2Fupload%2Fq_auto%2Ftest-what-your-ai-agents-must-not-do.png",[34,43,169,170,171],"agentsafety","negativetesting","executiongovernance","2026-08-17T08:21:19.160Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ftest-what-your-ai-agents-must-not-do-fj6y.md","https:\u002F\u002Fdev.to\u002Fotaready\u002Ftest-what-your-ai-agents-must-not-do-3e1a",{"id":176,"title":177,"slug":178,"lang":10,"category":53,"categorySlug":54,"summary":179,"excerpt":179,"author":180,"date":38,"readTime":16,"image":181,"tags":182,"publishedAt":184,"createdAt":184,"updatedAt":184,"filePath":185,"sourceUrl":186},"cron-1786954878754","Protecting Microservices: Implementing End-to-End Encryption Across REST APIs","protecting-microservices-implementing-end-to-end-encryption-across-rest-apis-gtfz","End-to-end encryption across REST APIs is the difference between a microservices architecture that...","Fu'ad Husnan","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fba3onadsxu08gb14brer.png",[53,60,54,61,183],"2026","2026-08-17T08:21:18.754Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fprotecting-microservices-implementing-end-to-end-encryption-across-rest-apis-gtfz.md","https:\u002F\u002Fdev.to\u002Ffuadhusnan_f44f3e13\u002Fprotecting-microservices-implementing-end-to-end-encryption-across-rest-apis-26hb",{"id":188,"title":189,"slug":190,"lang":10,"category":11,"categorySlug":12,"summary":191,"excerpt":191,"author":192,"date":38,"readTime":16,"image":193,"tags":194,"publishedAt":196,"createdAt":196,"updatedAt":196,"filePath":197,"sourceUrl":198},"cron-1786954878272","I Gave My Agent One Signed Permission It Couldn’t Mint Itself","i-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-nm1o","Evidence status. The supervised operator run completed on 2026-08-09. An operator-signed job...","Self-Correcting Systems","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fg1gjbzx4muvma5fznpjl.png",[11,195,89,12,20],"machinelearning","2026-08-17T08:21:18.271Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-nm1o.md","https:\u002F\u002Fdev.to\u002Fkenielzep97\u002Fi-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-2lpc",{"id":200,"title":201,"slug":202,"lang":10,"category":82,"categorySlug":83,"summary":203,"excerpt":203,"author":204,"date":38,"readTime":16,"image":205,"tags":206,"publishedAt":208,"createdAt":208,"updatedAt":208,"filePath":209,"sourceUrl":210},"cron-1786954877848","One GPU, four ways to share it: ten scenarios, and the headline finding I had to retract","one-gpu-four-ways-to-share-it-ten-scenarios-and-the-headline-finding-i-had-to-retract-3y1v","I measured every GPU sharing mode across ten scenarios, published a headline finding that duplicate models are nearly free on unified memory, then failed to replicate it and retracted it. Here is what the controlled replication showed and how the original measurement fooled me.","Christopher Maher","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fllmkube.com%2Fog-gpu-sharing-four-ways-devto.png",[82,83,207,19,89],"gpu","2026-08-17T08:21:17.847Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fone-gpu-four-ways-to-share-it-ten-scenarios-and-the-headline-finding-i-had-to-retract-3y1v.md","https:\u002F\u002Fdev.to\u002Fdefilan\u002Fone-gpu-four-ways-to-share-it-ten-scenarios-and-the-one-number-that-inverts-on-your-hardware-1bih",{"id":212,"title":213,"slug":214,"lang":10,"category":34,"categorySlug":35,"summary":215,"excerpt":215,"author":99,"date":15,"readTime":16,"image":216,"tags":217,"publishedAt":221,"createdAt":221,"updatedAt":221,"filePath":222,"sourceUrl":223},"cron-1786954563310","FastMCP Agent Mail: RBAC Tokens vs Anonymous Access, and the 403 Errors in Between","fastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-ef0p","Why a FastMCP agent mail server that works anonymously in dev returns 403 behind TLS ingress, and how to wire bearer tokens without leaking them.","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fguatulabs.dev%2Fog%2Ffastmcp-agent-mail-rbac-token-vs-anonymous-lessons-from-403-errors.png",[34,218,219,43,220],"fastmcp","mcpservers","authentication","2026-08-17T08:16:03.310Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ffastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-ef0p.md","https:\u002F\u002Fdev.to\u002Ffuthgar\u002Ffastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-22pk",{"id":225,"title":226,"slug":227,"lang":10,"category":53,"categorySlug":54,"summary":228,"excerpt":228,"author":229,"date":15,"readTime":16,"image":230,"tags":231,"publishedAt":234,"createdAt":234,"updatedAt":234,"filePath":235,"sourceUrl":236},"cron-1786954562962","eBPF-Powered Request Tracing in Go Microservices Without Instrumentation Tax","ebpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-k53p","How eBPF uprobes and ring buffers replace manual trace propagation in Go services—mechanics, tradeoffs, and failure modes.","Neeraj Singhi","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fws515jitp8rvalxr8d63.png",[53,232,88,54,233],"architecture","performance","2026-08-17T08:16:02.962Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Febpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-k53p.md","https:\u002F\u002Fdev.to\u002Fneeraj_singhi_golang\u002Febpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-34kf",{"id":238,"title":239,"slug":240,"lang":10,"category":11,"categorySlug":12,"summary":241,"excerpt":241,"author":242,"date":15,"readTime":16,"image":243,"tags":244,"publishedAt":248,"createdAt":248,"updatedAt":248,"filePath":249,"sourceUrl":250},"cron-1786954562825","How Dopamine Works: The Architecture of a Modern iOS Jailbreak","how-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-woxq","Most developers will never jailbreak a phone. That is fine. This article is not a how-to, and there...","ArshTechPro","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F0gnfjvl3fzvb1r1rpvci.png",[11,245,246,12,247],"ios","mobile","programming","2026-08-17T08:16:02.825Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fhow-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-woxq.md","https:\u002F\u002Fdev.to\u002Farshtechpro\u002Fhow-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-2hj3",{"id":252,"title":253,"slug":254,"lang":10,"category":82,"categorySlug":83,"summary":255,"excerpt":255,"author":256,"date":15,"readTime":16,"image":257,"tags":258,"publishedAt":260,"createdAt":260,"updatedAt":260,"filePath":261,"sourceUrl":262},"cron-1786954562468","I got tired of SSHing into 10 VMs a day, so I built a live map of my whole infrastructure","i-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-iqz9","Every day at work looked the same. Something breaks, or I need to push a new image, and I'm SSHing...","ByteStrix","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4xdxpc7fsu7nv8usri7a.png",[82,259,89,73,83],"productivity","2026-08-17T08:16:02.468Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fi-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-iqz9.md","https:\u002F\u002Fdev.to\u002Fbytestrix\u002Fi-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-2iil",{"id":264,"title":265,"slug":266,"lang":10,"category":34,"categorySlug":35,"summary":267,"excerpt":267,"author":268,"date":15,"readTime":16,"image":269,"tags":270,"publishedAt":274,"createdAt":274,"updatedAt":274,"filePath":275,"sourceUrl":276},"cron-1786954558132","The Coordinated Rename Is the Agent's Most Dangerous Refactor","the-coordinated-rename-is-the-agents-most-dangerous-refactor-iazu","Multi-agent rename tooling rewrites two hundred files in ten seconds because it noticed the drift. Half the time the drift was a load-bearing distinction the team encoded on purpose. Vocabulary curation is a real-time review surface now, and senior includes refusing changes that would be technically more consistent because the domain has two concepts the agent has no way to see.","Travis Frisinger","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fwww.tddbuddy.com%2Fimages%2Fcovers%2Fthe-coordinated-rename-is-the-dangerous-refactor.png",[34,271,43,272,273],"vocabulary","domainmodeling","codereview","2026-08-17T08:15:58.132Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fthe-coordinated-rename-is-the-agents-most-dangerous-refactor-iazu.md","https:\u002F\u002Fdev.to\u002Ftmfrisinger\u002Fthe-coordinated-rename-is-the-agents-most-dangerous-refactor-6a",{"id":278,"title":279,"slug":280,"lang":10,"category":53,"categorySlug":54,"summary":281,"excerpt":281,"author":282,"date":15,"readTime":16,"image":283,"tags":284,"publishedAt":287,"createdAt":287,"updatedAt":287,"filePath":288,"sourceUrl":289},"cron-1786954557526","Microservices: Building Applications as Independent, Communicating Services","microservices-building-applications-as-independent-communicating-services-c45k","Microservices: Building Applications as Independent, Communicating Services   A practical,...","Rhuturaj Takle","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F8puio1c7flrtyivr04hl.png",[53,54,285,247,286],"dotnet","learning","2026-08-17T08:15:57.526Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fmicroservices-building-applications-as-independent-communicating-services-c45k.md","https:\u002F\u002Fdev.to\u002Frhuturaj_takle\u002Fmicroservices-building-applications-as-independent-communicating-services-2eo8",{"id":291,"title":292,"slug":293,"lang":10,"category":11,"categorySlug":12,"summary":294,"excerpt":294,"author":295,"date":15,"readTime":16,"image":296,"tags":297,"publishedAt":301,"createdAt":301,"updatedAt":301,"filePath":302,"sourceUrl":303},"cron-1786954556056","From Arduino To Automotive: How I Escaped The IDE And Owned The Bus","from-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-hj7g","Arduino taught me how to build. Bare metal taught me how the build actually works.  I have a lot of...","v. Splicer","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fabn3138rnp9vm0nyk54b.jpg",[11,298,299,300,12],"esp32","arduino","canbus","2026-08-17T08:15:56.056Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Ffrom-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-hj7g.md","https:\u002F\u002Fdev.to\u002Fnumbpill3d\u002Ffrom-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-f8f",{"id":305,"title":306,"slug":307,"lang":10,"category":82,"categorySlug":83,"summary":308,"excerpt":308,"author":309,"date":15,"readTime":16,"image":310,"tags":311,"publishedAt":314,"createdAt":314,"updatedAt":314,"filePath":315,"sourceUrl":316},"cron-1786954555663","The Backup Awakens: A Star Wars Story","the-backup-awakens-a-star-wars-story-jzpq","The Quest Begins (The \\\"Why\\\")   Honestly, I used to think backups were the boring chores you...","Timevolt","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4ynsfxiz14nn4b9ylhn6.png",[82,89,312,83,313],"docker","cicd","2026-08-17T08:15:55.662Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fthe-backup-awakens-a-star-wars-story-jzpq.md","https:\u002F\u002Fdev.to\u002Ftimevolt\u002Fthe-backup-awakens-a-star-wars-story-1616",{"id":318,"title":319,"slug":320,"lang":10,"category":34,"categorySlug":35,"summary":321,"excerpt":321,"author":268,"date":15,"readTime":16,"image":322,"tags":323,"publishedAt":326,"createdAt":326,"updatedAt":326,"filePath":327,"sourceUrl":328},"cron-1786954321408","Test Deletion Is a Privileged Operation","test-deletion-is-a-privileged-operation-2pfz","The cheapest way for an agent to make a failing test pass is to delete it. That is logical for the agent and catastrophic for the codebase. Tests are append-only by default. Deletion needs a human author, a separate commit, and a separate review.","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fwww.tddbuddy.com%2Fimages%2Fcovers%2Ftest-deletion-is-a-privileged-operation.png",[34,324,43,325,273],"tdd","testdesign","2026-08-17T08:12:01.408Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ftest-deletion-is-a-privileged-operation-2pfz.md","https:\u002F\u002Fdev.to\u002Ftmfrisinger\u002Ftest-deletion-is-a-privileged-operation-264a",{"id":330,"title":331,"slug":332,"lang":10,"category":53,"categorySlug":54,"summary":333,"excerpt":333,"author":334,"date":15,"readTime":16,"image":335,"tags":336,"publishedAt":339,"createdAt":339,"updatedAt":339,"filePath":340,"sourceUrl":341},"cron-1786954321239","You Don't Always Need a Workflow Engine to Roll Back a Failed Checkout","you-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-1iwf","Here's a sequence that shows up in almost every Laravel app that talks to the outside world:   Charge...","Sient","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fu6g3j4z4af9tbuozbz2v.png",[53,337,338,232,54],"laravel","php","2026-08-17T08:12:01.239Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fyou-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-1iwf.md","https:\u002F\u002Fdev.to\u002Fsient\u002Fyou-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-5gop",{"id":7,"title":8,"slug":9,"lang":10,"category":11,"categorySlug":12,"summary":13,"excerpt":13,"author":14,"date":15,"readTime":16,"image":17,"tags":343,"publishedAt":22,"createdAt":22,"updatedAt":22,"filePath":23,"sourceUrl":24},[11,19,20,12,21],{"id":345,"title":346,"slug":347,"lang":10,"category":82,"categorySlug":83,"summary":348,"excerpt":348,"author":349,"date":15,"readTime":16,"image":350,"tags":351,"publishedAt":353,"createdAt":353,"updatedAt":353,"filePath":354,"sourceUrl":355},"cron-1786954320913","I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own Salary.","i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8","I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own...","Le Beltagy","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Frvjfi7ee0tmi1xp1mem5.png",[82,83,12,352,89],"gitops","2026-08-17T08:12:00.911Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8.md","https:\u002F\u002Fdev.to\u002Fle_beltagy\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-227e",25,1,50,[360,363,367,369,370,371],{"name":361,"slug":362,"count":356},"All","all",{"name":364,"slug":365,"count":366},"Nuxt 4","nuxt-4",0,{"name":82,"slug":83,"count":368},6,{"name":11,"slug":12,"count":368},{"name":53,"slug":54,"count":368},{"name":34,"slug":35,"count":372},7,[374,375,376,377,378,379,380,381,382,383,385,387,389,390,392],{"name":34,"slug":35,"count":372},{"name":43,"slug":43,"count":372},{"name":12,"slug":12,"count":372},{"name":53,"slug":54,"count":368},{"name":54,"slug":54,"count":368},{"name":11,"slug":12,"count":368},{"name":82,"slug":83,"count":368},{"name":83,"slug":83,"count":368},{"name":89,"slug":89,"count":368},{"name":19,"slug":19,"count":384},4,{"name":73,"slug":73,"count":386},3,{"name":59,"slug":59,"count":388},2,{"name":60,"slug":60,"count":388},{"name":61,"slug":391,"count":388},"trending",{"name":88,"slug":88,"count":388},{"success":394,"slug":9,"lang":10,"items":395,"total":456,"page":357,"limit":457,"hasMore":394,"remaining":368},true,[396,407,426,436,446],{"author":397,"avatar":398,"role":399,"date":400,"createdAt":401,"content":402,"likes":403,"isLiked":404,"replies":405,"id":406},"Kenji Sato","K","Principal Infrastructure Architect","2 days ago","2026-08-15T10:09:00.577Z","Intlight's multi-region architectural blueprints set the benchmark for ultra-resilient, enterprise-grade cloud systems in 2026.",53,false,[],"c-i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m-en-1",{"author":408,"avatar":409,"role":410,"date":411,"createdAt":412,"content":413,"likes":414,"isLiked":404,"replies":415,"id":425},"Marcus Vance","M","Head of AI Engineering @ NextWave","1 hour ago","2026-08-17T09:09:00.576Z","The Agent Memory Pipeline section hits the nail on the head. Hierarchical memory indexing with Qdrant vector search is the only sustainable way to scale long-context autonomous agents.",42,[416],{"author":417,"avatar":418,"role":419,"date":420,"createdAt":421,"content":422,"likes":423,"isLiked":404,"id":424},"Sarah Jenkins","S","LLM Research Scientist","30 mins ago","2026-08-17T09:39:00.576Z","Yes! Separating episodic memory from working context allows agents to operate indefinitely without token explosion.",19,"r-i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m-en-2-1","c-i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m-en-2",{"author":427,"avatar":428,"role":429,"date":430,"createdAt":431,"content":432,"likes":433,"isLiked":404,"replies":434,"id":435},"Priya Sharma","P","Distributed Database Architect","5 hours ago","2026-08-17T05:09:00.577Z","The latency comparisons between gRPC Protobuf binary encoding and standard JSON payloads demonstrate exactly why internal services should deprecate REST for high-throughput pipelines.",38,[],"c-i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m-en-3",{"author":437,"avatar":438,"role":439,"date":440,"createdAt":441,"content":442,"likes":443,"isLiked":404,"replies":444,"id":445},"Hannah Schmidt","H","DevOps & CI\u002FCD Lead","1 day ago","2026-08-16T10:09:00.577Z","Can confirm: automated canary deployments with Argo Rollouts and Prometheus metrics analysis prevented several outages for our payment gateways.",31,[],"c-i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m-en-4",{"author":447,"avatar":448,"role":449,"date":450,"createdAt":451,"content":452,"likes":453,"isLiked":404,"replies":454,"id":455},"Elena Rostova","E","Lead SRE & Platform Architect","45 mins ago","2026-08-17T09:24:00.576Z","The KEDA autoscaling setup with custom Prometheus metrics is production-grade. We observed a 60% compute cost reduction after switching to event-driven pod scaling.",34,[],"c-i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m-en-5",13,5,1786961341888]