[{"data":1,"prerenderedAt":457},["ShallowReactive",2],{"blog-post-detail-test-what-your-ai-agents-must-not-do-fj6y":3,"blogs-all-posts-detail-suggestions-en":29,"blog-comments-test-what-your-ai-agents-must-not-do-fj6y-en":393},{"status":4,"source":5,"data":6},"success","markdown-file",{"id":7,"title":8,"slug":9,"lang":10,"category":11,"categorySlug":12,"summary":13,"excerpt":13,"author":14,"date":15,"readTime":16,"image":17,"tags":18,"publishedAt":23,"createdAt":23,"updatedAt":23,"filePath":24,"sourceUrl":25,"content":26,"seoTitle":27,"seoDescription":13,"canonicalUrl":28},"cron-1786954879160","Test What Your AI Agents Must Not Do","test-what-your-ai-agents-must-not-do-fj6y","en","AI Agents","ai-agents","A Guardrail Without A Negative Test Is Still An Assumption   Most AI agent governance starts...","Bobai Kato","8\u002F17\u002F2026","6 phút","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fres.cloudinary.com%2Fota-run%2Fimage%2Fupload%2Fq_auto%2Ftest-what-your-ai-agents-must-not-do.png",[11,19,20,21,22],"aiagents","agentsafety","negativetesting","executiongovernance","2026-08-17T08:21:19.160Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ftest-what-your-ai-agents-must-not-do-fj6y.md","https:\u002F\u002Fdev.to\u002Fotaready\u002Ftest-what-your-ai-agents-must-not-do-3e1a","\n---\ntitle: \"Test What Your AI Agents Must Not Do\"\nslug: \"test-what-your-ai-agents-must-not-do\"\nsummary: \"AI agent guardrails need negative tests. Ota refusal canaries verify that the real execution boundary still rejects selected unsafe tasks and workflows before any work starts.\"\npublishedAt: \"2026-08-12T13:00:00Z\"\ncategory: \"field-note\"\nstatus: \"published\"\nauthor: \"bobai\"\notaVersion: \"1.6.25\"\ncover_image: \"https:\u002F\u002Fres.cloudinary.com\u002Fota-run\u002Fimage\u002Fupload\u002Fq_auto\u002Ftest-what-your-ai-agents-must-not-do.png\"\n \n \ntags:\n  - aiagents\n  - agentsafety\n  - negativetesting\n  - executiongovernance\n \n---\n\n## A Guardrail Without A Negative Test Is Still An Assumption\n\nMost AI agent governance starts with the positive path.\n\nA repository tells an agent which task it may run. The agent invokes that task. The test suite\npasses. CI goes green.\n\nThat proves one useful thing: the allowed path still works.\n\nIt does not prove that the forbidden path is still forbidden.\n\nA stale allowlist, an incomplete dependency closure, a runner regression, or a hand-maintained CI\ncondition can quietly widen what an agent is able to execute. Every positive check may remain green\nwhile the safety boundary has stopped doing its job.\n\nThis is why agent guardrails need negative tests.\n\nOta calls those tests **refusal canaries**.\n\nThey are available in Ota `v1.6.25`, and they reflect a deliberate product position:\n\n> Agent safety should be executable contract truth, not a promise that the model will remember to\n> behave.\n\nOta uses the same `ota.yaml` contract to define the safe task surface, evaluate the complete\nselected closure, refuse unsafe execution, emit machine-readable evidence, and project the canary\ninto CI. There is no separate shell rule for the negative test to drift away from.\n\nThat is the difference between documenting a guardrail and operating one.\n\n## What A Refusal Canary Tests\n\nA refusal canary names a task or workflow that must remain outside the repository's agent-safe\nexecution boundary.\n\nFor example, a repository may allow agents to run verification while reserving publishing for a\nhuman-controlled path:\n\n```yaml\nagent:\n  safe_tasks:\n    - verify\n  refusal_canaries:\n    - task: publish\n    - workflow: release\n\ntasks:\n  verify:\n    command:\n      exe: pnpm\n      args: [test]\n    safe_for_agent: true\n\n  publish:\n    command:\n      exe: pnpm\n      args: [publish]\n    safe_for_agent: false\n\nworkflows:\n  release:\n    intent: release\n    run:\n      task: publish\n```\n\nThe positive check proves that the allowed lane remains callable:\n\n```bash \nota run verify --agent\n```\n\nThe refusal canary tests the opposite boundary:\n\n```bash \nota run publish --agent --expect-refusal\nota up --workflow release --agent --expect-refusal\n```\n\nThese commands do not run the unsafe task and then inspect its exit code. Ota exercises the same\nagent admission boundary used by ordinary execution and requires refusal before the selected task,\nits dependencies, or the workflow closure starts.\n\nThat distinction matters. The canary tests the execution boundary, not the behavior of a dangerous\ncommand after it has already begun.\n\n## Expected Refusal Becomes A Passing Test\n\nAn ordinary agent refusal is a blocked execution result. That is the correct behavior for a direct\nattempt to run an unsafe task, but it is inconvenient as a CI assertion because the shell sees a\nnon-zero exit.\n\n`--expect-refusal` gives that result explicit negative-control semantics:\n\n- `refused_as_expected` means the declared agent-safety boundary refused the selected target before\n  execution and the canary passes;\n- `refusal_not_observed` means the target was admitted, so the canary fails; and\n- `wrong_refusal_boundary` means execution was blocked for another reason, so the canary still\n  fails.\n\nThe third state prevents an important false positive.\n\nSuppose `publish` accidentally becomes agent-safe, but an unrelated organization policy still\ndenies the command. A weak negative test would see \"something failed\" and call the guardrail\nhealthy. Ota does not. The canary passes only when the safety boundary it was created to test is\nthe boundary that refused the lane.\n\nFor machine consumers, the same result is available as structured JSON:\n\n```bash \nota run publish --agent --expect-refusal --json\n```\n\nThe output carries the canary target, the runner-authored refusal record, whether execution\nstarted, and the associated blocked receipt when refusal was observed. The agent does not\nself-report that it behaved safely.\n\nThis is where Ota is intentionally more opinionated than a task runner. A task runner answers,\n\"Can I invoke this command?\" Ota also asks, \"Should this actor be admitted to this complete\nexecution closure, and what evidence should exist when the answer is no?\"\n\n## Why This Must Run Through The Real Runner\n\nIt is easy to imitate a refusal canary with shell logic:\n\n```bash\nif [ \"$AGENT_MODE\" = \"true\" ]; then\n  exit 1\nfi\n```\n\nThat only proves the shell condition still exists.\n\nIt does not prove that Ota's selected task closure, safety declaration, dependency expansion, and\nexecution admission agree. It can also drift independently from local execution, turning CI into a\nsecond policy system.\n\nA useful refusal canary has to pass through the same chokepoint as the real action. Otherwise the\ntest and the boundary can fail independently while both appear green.\n\nOta therefore derives the refusal from current contract truth at execution time. Authors declare\nwhich task or workflow is the canary; they do not author the reason that should make it pass.\n\n## Put Refusal Canaries In CI\n\nLocal refusal gives agents and developers fast feedback. CI turns the same boundary into a\nrepository-level control.\n\nA mature governance lane should test both directions:\n\n1. At least one meaningful safe verification path is admitted and completes.\n2. Each material unsafe path selected as a canary is refused by the agent boundary.\n\nOta's provider-neutral CI projection includes each declared refusal canary. The GitHub adapter\nemits each one as its own provider check with a stable merge-check identity. That lets a repository\nmake the negative control merge-required instead of hiding several boundaries inside one opaque\nscript step.\n\nThis is stronger than one broad \"agent safety\" job. If the publish canary fails while verification\nstill passes, the provider shows exactly which execution boundary widened.\n\nBranch protection remains provider-owned. Ota can generate and identify the GitHub check, but the\nrepository's GitHub policy must make it required if the organization wants a non-optional merge\ngate. Future provider adapters must preserve the same ownership boundary rather than pretending\nOta controls provider policy.\n\n## What Refusal Canaries Prove\n\nA passing refusal canary proves a narrow and valuable claim:\n\n> At this contract snapshot and runner boundary, the selected task or workflow was refused for the\n> expected agent-safety reason before execution started.\n\nIt does not prove:\n\n- that every dangerous repository action has been declared;\n- that the maintainer classified every task correctly;\n- that raw shell execution outside Ota is impossible;\n- that CI branch protection requires the canary check;\n- that runtime filesystem, network, credential, or provider controls were enforced; or\n- that the repository is globally safe for autonomous operation.\n\nThose are different obligations.\n\nContract-claim assurance can evaluate whether observable repository evidence supports a declared\nsafety claim. Sandbox and capability providers can enforce runtime controls. CI policy can make\nchecks mandatory. Refusal canaries test whether one declared runner boundary still refuses what it\nis supposed to refuse.\n\nKeeping those claims separate is what makes the result trustworthy.\n\n## Turn Incidents Into Permanent Negative Tests\n\nA refusal canary protects a boundary the repository has already identified. It cannot protect an\nomitted path merely because that path reaches a similar outcome.\n\nIf `publish` is refused, Ota has proved that the selected `publish` closure was refused. It has not\nproved that another task, migration, helper script, or raw shell command cannot reach the same\nexternal effect. Presenting task-level refusal as effect-level protection would turn a precise\nnegative test into a broader claim the evidence does not support.\n\nThe practical operating model is a ratchet: when an incident or review exposes another material\nexecution path, add that real task or workflow as a permanent canary. The incident should improve\nthe executable governance suite, not remain only in a retrospective document.\n\nOta's current refusal canaries are task- and workflow-bound. Effect-level assurance across\nequivalent execution paths is a separate, planned governance boundary; it is not something this\nfeature claims to provide today. Until that boundary is implemented and pressure-tested, canary\ncoverage should remain explicit about which declared lanes it exercises and which equivalent paths\nremain unproved.\n\n## Choosing Useful Canaries\n\nDo not turn every non-agent-safe helper into a canary. Choose actions whose accidental admission\nwould materially weaken the repository's governance story.\n\nGood candidates include:\n\n- package publishing and release workflows;\n- production deployment;\n- destructive database operations;\n- credentialed external mutations;\n- infrastructure apply or teardown tasks; and\n- expensive or metered execution that should require a different authority path.\n\nThe canary should name the real contract task or workflow. Do not create a fake unsafe command\nwhose only purpose is to be refused; that proves the fixture, not the material repository boundary.\n\nAlso keep the positive lane. A system that refuses everything is not safely governed execution. It\nis unavailable software. The useful result is selective admission: routine work remains easy, and\nmaterially different work remains outside the agent-safe closure.\n\n## Try It In Your Repository\n\nThe fastest way to understand refusal canaries is to make one fail deliberately on a temporary\nbranch.\n\nFirst, [install Ota](https:\u002F\u002Fota.run\u002Fdocs\u002Finstall), then inspect the repository before changing its\ncontract:\n\n```bash \nota doctor\nota tasks --use\nota tasks --safe --use\n```\n\nAdd one real unsafe task or workflow to `agent.refusal_canaries`. Choose publishing, deployment,\ninfrastructure mutation, or another material lane that already exists in the repository. Then\nvalidate both directions:\n\n```bash \nota validate\nota run verify --agent\nota run publish --agent --expect-refusal --json\n```\n\nNow temporarily make `publish` agent-safe. The positive verification lane can remain green, but the\nrefusal canary changes to `refusal_not_observed` and exits non-zero. That is the failure shape the\nfeature exists to expose: the repository still works, but its agent execution boundary has widened.\n\nWhen the local contract is correct, inspect the provider-neutral CI projection:\n\n```bash \nota ci projection \\\n  --workflow verify \\\n  --mode native \\\n  --target-os linux \\\n  --json\n```\n\nFor GitHub Actions, Ota can render the governed reusable workflow from that projection:\n\n```bash \nota ci github render \\\n  --workflow verify \\\n  --mode native \\\n  --target-os linux\n```\n\nThe repository keeps ownership of triggers, permissions, secrets, runners, environments, and\nbranch protection. Ota owns the contract-derived execution and refusal checks. That boundary lets\nteams adopt Ota without replacing their CI provider or creating another hand-maintained workflow\nlanguage.\n\n## The Larger Point\n\nAI governance cannot stop at telling agents what they may do.\n\nIt also needs tests for what they must not be allowed to execute.\n\nPositive tests prove that an allowed path still works. Refusal canaries prove that a selected\nforbidden path still stops at the runner boundary. Together they turn an agent allowlist from\nstatic metadata into executable governance.\n\nThat is the standard Ota is building toward: boundaries that are declared once, exercised through\nthe real chokepoint, and retained as evidence rather than trusted as prose.\n\nIf your repository already tells agents what they may run, the next useful question is simple:\n\n**Which one unsafe action would you want CI to prove they still cannot run?**\n\n## Go Deeper\n\n- [Safe Agent Execution and Refusal](https:\u002F\u002Fota.run\u002Fdocs\u002Freference\u002Fsafe-agent-execution-and-refusal)\n- [Contract-to-CI Governance](https:\u002F\u002Fota.run\u002Fdocs\u002Freference\u002Fcontract-to-ci-governance)\n- [Why Agent Safety Needs Enforced Boundaries, Not Just Declared Ones](https:\u002F\u002Fota.run\u002Fblog\u002Fwhy-agent-safety-needs-enforced-boundaries-not-just-declared-ones-4m7q)\n- [One Contract, Multiple Enforcement Points for Safe AI Agent Execution](https:\u002F\u002Fota.run\u002Fblog\u002Fone-contract-multiple-enforcement-points-for-safe-ai-agent-execution)\n\n--- \nOriginally posted here: https:\u002F\u002Fota.run\u002Fblog\u002Ftest-what-your-ai-agents-must-not-do\n\n---\n\n> 🔗 **Nguồn bài viết gốc**: [Bobai Kato](https:\u002F\u002Fdev.to\u002Fotaready\u002Ftest-what-your-ai-agents-must-not-do-3e1a)\n","Test What Your AI Agents Must Not Do - Intlight Insights","https:\u002F\u002Fintlighttech.com\u002Fblogs\u002Ftest-what-your-ai-agents-must-not-do-fj6y",{"items":30,"total":356,"page":357,"totalPages":357,"limit":358,"lang":10,"categories":359,"popularTags":373},[31,46,62,78,94,108,120,133,147,161,163,175,188,200,214,227,241,253,267,280,294,307,319,332,344],{"id":32,"title":33,"slug":34,"lang":10,"category":11,"categorySlug":12,"summary":35,"excerpt":35,"author":36,"date":15,"readTime":37,"image":38,"tags":39,"publishedAt":43,"createdAt":43,"updatedAt":43,"filePath":44,"sourceUrl":45},"cron-1786956218725-en","I Thought I'd Lost the Plot. I Was Writing It.","i-thought-id-lost-the-plot-i-was-writing-it-wjvz","I Thought I'd Lost the Plot. I Was Writing It.            I set out to build autonomous...","Joe Black","6 min read","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fa3l9h76kr920p8bm2mjp.png",[11,40,19,41,42],"claudecode","developmenttools","autonomousagents","2026-08-17T08:43:38.725Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fi-thought-id-lost-the-plot-i-was-writing-it-wjvz.md","https:\u002F\u002Fdev.to\u002Fjoeblackwaslike\u002Fi-thought-id-lost-the-plot-i-was-writing-it-5fil",{"id":47,"title":48,"slug":49,"lang":10,"category":50,"categorySlug":51,"summary":52,"excerpt":52,"author":53,"date":15,"readTime":37,"image":54,"tags":55,"publishedAt":59,"createdAt":59,"updatedAt":59,"filePath":60,"sourceUrl":61},"cron-1786956216746-en","What Is the Circuit Breaker Pattern? A Practical Guide","what-is-the-circuit-breaker-pattern-a-practical-guide-4j68","Microservices","microservices","What Is the Circuit Breaker Pattern? A Practical Guide for Developers   Imagine your...","Avijit Bera","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fi6cy1uyqxjd14ikkveev.png",[50,51,56,57,58],"backend","api","Trending","2026-08-17T08:43:36.746Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fwhat-is-the-circuit-breaker-pattern-a-practical-guide-4j68.md","https:\u002F\u002Fdev.to\u002Favijitbera\u002Fwhat-is-the-circuit-breaker-pattern-a-practical-guide-20i4",{"id":63,"title":64,"slug":65,"lang":10,"category":66,"categorySlug":67,"summary":68,"excerpt":68,"author":69,"date":15,"readTime":37,"image":70,"tags":71,"publishedAt":75,"createdAt":75,"updatedAt":75,"filePath":76,"sourceUrl":77},"cron-1786956214008-en","I attacked my own npm package before launching it. It let the proposer approve their own writes","i-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-oi6y","Security","security","My library exists so a human approves an LLM's UPDATE before it runs. It never checked that the approver was somebody other than the proposer — and wrote \\\"approved\\\" into the audit trail anyway.","hyuga","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F65yv5n4qvrgn3t6ot4gy.png",[66,72,73,67,74],"opensource","ai","database","2026-08-17T08:43:34.007Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-oi6y.md","https:\u002F\u002Fdev.to\u002Fhyuga611\u002Fi-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-4mki",{"id":79,"title":80,"slug":81,"lang":10,"category":82,"categorySlug":83,"summary":84,"excerpt":84,"author":85,"date":15,"readTime":37,"image":86,"tags":87,"publishedAt":91,"createdAt":91,"updatedAt":91,"filePath":92,"sourceUrl":93},"cron-1786956210950-en","Build an MCP Server in Go (Part 1): Designing a diagnostic-grade Kubernetes client","build-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-p1d4","Kubernetes","kubernetes","This post designs the Kubernetes client. The next post wraps it as an MCP server and wires it to an...","Fer Rios","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fpw4b055hh8hxl5unrmvv.png",[82,83,88,89,90],"go","devops","mcp","2026-08-17T08:43:30.949Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fbuild-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-p1d4.md","https:\u002F\u002Fdev.to\u002Fferztyle\u002Fbuild-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-49a2",{"id":95,"title":96,"slug":97,"lang":10,"category":11,"categorySlug":12,"summary":98,"excerpt":98,"author":99,"date":15,"readTime":37,"image":100,"tags":101,"publishedAt":105,"createdAt":105,"updatedAt":105,"filePath":106,"sourceUrl":107},"cron-1786956117904-en","The Write Policy Is the Hard Part: Promotion Pipelines for Agent Memory","the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9","Storing agent memory is easy. Deciding what earns a permanent write, and keeping the write-path alive through RBAC and network policy, is the real work.","Guatu","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fguatulabs.dev%2Fog%2Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory.png",[11,19,102,103,104],"agentmemory","rbac","networkpolicies","2026-08-17T08:41:57.903Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9.md","https:\u002F\u002Fdev.to\u002Ffuthgar\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-5mc",{"id":109,"title":110,"slug":111,"lang":10,"category":11,"categorySlug":12,"summary":112,"excerpt":112,"author":113,"date":15,"readTime":16,"image":114,"tags":115,"publishedAt":117,"createdAt":117,"updatedAt":117,"filePath":118,"sourceUrl":119},"cron-1786955347611","I Changed How I Think About AI Memory","i-changed-how-i-think-about-ai-memory-fnpm","I Changed How I Think About AI Memory   When I first built Lean AI Memory, I focused too...","Phúc Phùng","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F0oqod5zshdan74573bau.png",[11,73,19,72,116],"git","2026-08-17T08:29:07.610Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fi-changed-how-i-think-about-ai-memory-fnpm.md","https:\u002F\u002Fdev.to\u002Fphucphungbk\u002Fi-changed-how-i-think-about-ai-memory-4mkd",{"id":121,"title":122,"slug":123,"lang":10,"category":50,"categorySlug":51,"summary":124,"excerpt":124,"author":125,"date":15,"readTime":16,"image":126,"tags":127,"publishedAt":130,"createdAt":130,"updatedAt":130,"filePath":131,"sourceUrl":132},"cron-1786955347443","Real-Life Refactoring Example: ~3x Less Code to Read","real-life-refactoring-example-3x-less-code-to-read-dccm","There is a popular idea that refactoring is making code shorter. It is not entirely wrong....","Valentine Shi","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Foubl9dlj23byhsak2mqy.png",[50,128,129,56,51],"node","software","2026-08-17T08:29:07.443Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Freal-life-refactoring-example-3x-less-code-to-read-dccm.md","https:\u002F\u002Fdev.to\u002Fvalentineshi-dev\u002Freal-life-refactoring-example-3x-less-code-to-read-3mdl",{"id":134,"title":135,"slug":136,"lang":10,"category":66,"categorySlug":67,"summary":137,"excerpt":137,"author":138,"date":15,"readTime":16,"image":139,"tags":140,"publishedAt":144,"createdAt":144,"updatedAt":144,"filePath":145,"sourceUrl":146},"cron-1786955347034","The Tragedy of the Clean-Handed Auditor","the-tragedy-of-the-clean-handed-auditor-rgoz","\\\"I could save them if they'd only listen...\\\"  Hey, you. Yeah, you: the compliance or governance...","Ben Link","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F5z426h3tt6e2b3sthd2f.png",[66,67,141,142,143],"compliance","developers","careerdevelopment","2026-08-17T08:29:07.034Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fthe-tragedy-of-the-clean-handed-auditor-rgoz.md","https:\u002F\u002Fdev.to\u002Flinkbenjamin\u002Fthe-tragedy-of-the-clean-handed-auditor-1253",{"id":148,"title":149,"slug":150,"lang":10,"category":82,"categorySlug":83,"summary":151,"excerpt":151,"author":152,"date":15,"readTime":16,"image":153,"tags":154,"publishedAt":158,"createdAt":158,"updatedAt":158,"filePath":159,"sourceUrl":160},"cron-1786955346614","Building Sluice: QoS-Aware Capacity Governance for Self-Hosted LLM Inference","building-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-flbu","📦 Project: https:\u002F\u002Fgithub.com\u002FVampiricCyborg\u002Fsluice           1. The Problem: When Capacity Becomes...","Madhav M S","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fh3vuie9oakcn3bqzxtbh.png",[82,155,156,83,157],"distributedsystems","llm","systemdesign","2026-08-17T08:29:06.613Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fbuilding-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-flbu.md","https:\u002F\u002Fdev.to\u002Fvampiriccyborg\u002Fbuilding-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-13ja",{"id":7,"title":8,"slug":9,"lang":10,"category":11,"categorySlug":12,"summary":13,"excerpt":13,"author":14,"date":15,"readTime":16,"image":17,"tags":162,"publishedAt":23,"createdAt":23,"updatedAt":23,"filePath":24,"sourceUrl":25},[11,19,20,21,22],{"id":164,"title":165,"slug":166,"lang":10,"category":50,"categorySlug":51,"summary":167,"excerpt":167,"author":168,"date":15,"readTime":16,"image":169,"tags":170,"publishedAt":172,"createdAt":172,"updatedAt":172,"filePath":173,"sourceUrl":174},"cron-1786954878754","Protecting Microservices: Implementing End-to-End Encryption Across REST APIs","protecting-microservices-implementing-end-to-end-encryption-across-rest-apis-gtfz","End-to-end encryption across REST APIs is the difference between a microservices architecture that...","Fu'ad Husnan","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fba3onadsxu08gb14brer.png",[50,57,51,58,171],"2026","2026-08-17T08:21:18.754Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fprotecting-microservices-implementing-end-to-end-encryption-across-rest-apis-gtfz.md","https:\u002F\u002Fdev.to\u002Ffuadhusnan_f44f3e13\u002Fprotecting-microservices-implementing-end-to-end-encryption-across-rest-apis-26hb",{"id":176,"title":177,"slug":178,"lang":10,"category":66,"categorySlug":67,"summary":179,"excerpt":179,"author":180,"date":15,"readTime":16,"image":181,"tags":182,"publishedAt":185,"createdAt":185,"updatedAt":185,"filePath":186,"sourceUrl":187},"cron-1786954878272","I Gave My Agent One Signed Permission It Couldn’t Mint Itself","i-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-nm1o","Evidence status. The supervised operator run completed on 2026-08-09. An operator-signed job...","Self-Correcting Systems","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fg1gjbzx4muvma5fznpjl.png",[66,183,89,67,184],"machinelearning","agents","2026-08-17T08:21:18.271Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-nm1o.md","https:\u002F\u002Fdev.to\u002Fkenielzep97\u002Fi-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-2lpc",{"id":189,"title":190,"slug":191,"lang":10,"category":82,"categorySlug":83,"summary":192,"excerpt":192,"author":193,"date":15,"readTime":16,"image":194,"tags":195,"publishedAt":197,"createdAt":197,"updatedAt":197,"filePath":198,"sourceUrl":199},"cron-1786954877848","One GPU, four ways to share it: ten scenarios, and the headline finding I had to retract","one-gpu-four-ways-to-share-it-ten-scenarios-and-the-headline-finding-i-had-to-retract-3y1v","I measured every GPU sharing mode across ten scenarios, published a headline finding that duplicate models are nearly free on unified memory, then failed to replicate it and retracted it. Here is what the controlled replication showed and how the original measurement fooled me.","Christopher Maher","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fllmkube.com%2Fog-gpu-sharing-four-ways-devto.png",[82,83,196,73,89],"gpu","2026-08-17T08:21:17.847Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fone-gpu-four-ways-to-share-it-ten-scenarios-and-the-headline-finding-i-had-to-retract-3y1v.md","https:\u002F\u002Fdev.to\u002Fdefilan\u002Fone-gpu-four-ways-to-share-it-ten-scenarios-and-the-one-number-that-inverts-on-your-hardware-1bih",{"id":201,"title":202,"slug":203,"lang":10,"category":11,"categorySlug":12,"summary":204,"excerpt":204,"author":99,"date":205,"readTime":16,"image":206,"tags":207,"publishedAt":211,"createdAt":211,"updatedAt":211,"filePath":212,"sourceUrl":213},"cron-1786954563310","FastMCP Agent Mail: RBAC Tokens vs Anonymous Access, and the 403 Errors in Between","fastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-ef0p","Why a FastMCP agent mail server that works anonymously in dev returns 403 behind TLS ingress, and how to wire bearer tokens without leaking them.","17\u002F8\u002F2026","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fguatulabs.dev%2Fog%2Ffastmcp-agent-mail-rbac-token-vs-anonymous-lessons-from-403-errors.png",[11,208,209,19,210],"fastmcp","mcpservers","authentication","2026-08-17T08:16:03.310Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ffastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-ef0p.md","https:\u002F\u002Fdev.to\u002Ffuthgar\u002Ffastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-22pk",{"id":215,"title":216,"slug":217,"lang":10,"category":50,"categorySlug":51,"summary":218,"excerpt":218,"author":219,"date":205,"readTime":16,"image":220,"tags":221,"publishedAt":224,"createdAt":224,"updatedAt":224,"filePath":225,"sourceUrl":226},"cron-1786954562962","eBPF-Powered Request Tracing in Go Microservices Without Instrumentation Tax","ebpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-k53p","How eBPF uprobes and ring buffers replace manual trace propagation in Go services—mechanics, tradeoffs, and failure modes.","Neeraj Singhi","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fws515jitp8rvalxr8d63.png",[50,222,88,51,223],"architecture","performance","2026-08-17T08:16:02.962Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Febpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-k53p.md","https:\u002F\u002Fdev.to\u002Fneeraj_singhi_golang\u002Febpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-34kf",{"id":228,"title":229,"slug":230,"lang":10,"category":66,"categorySlug":67,"summary":231,"excerpt":231,"author":232,"date":205,"readTime":16,"image":233,"tags":234,"publishedAt":238,"createdAt":238,"updatedAt":238,"filePath":239,"sourceUrl":240},"cron-1786954562825","How Dopamine Works: The Architecture of a Modern iOS Jailbreak","how-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-woxq","Most developers will never jailbreak a phone. That is fine. This article is not a how-to, and there...","ArshTechPro","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F0gnfjvl3fzvb1r1rpvci.png",[66,235,236,67,237],"ios","mobile","programming","2026-08-17T08:16:02.825Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fhow-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-woxq.md","https:\u002F\u002Fdev.to\u002Farshtechpro\u002Fhow-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-2hj3",{"id":242,"title":243,"slug":244,"lang":10,"category":82,"categorySlug":83,"summary":245,"excerpt":245,"author":246,"date":205,"readTime":16,"image":247,"tags":248,"publishedAt":250,"createdAt":250,"updatedAt":250,"filePath":251,"sourceUrl":252},"cron-1786954562468","I got tired of SSHing into 10 VMs a day, so I built a live map of my whole infrastructure","i-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-iqz9","Every day at work looked the same. Something breaks, or I need to push a new image, and I'm SSHing...","ByteStrix","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4xdxpc7fsu7nv8usri7a.png",[82,249,89,72,83],"productivity","2026-08-17T08:16:02.468Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fi-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-iqz9.md","https:\u002F\u002Fdev.to\u002Fbytestrix\u002Fi-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-2iil",{"id":254,"title":255,"slug":256,"lang":10,"category":11,"categorySlug":12,"summary":257,"excerpt":257,"author":258,"date":205,"readTime":16,"image":259,"tags":260,"publishedAt":264,"createdAt":264,"updatedAt":264,"filePath":265,"sourceUrl":266},"cron-1786954558132","The Coordinated Rename Is the Agent's Most Dangerous Refactor","the-coordinated-rename-is-the-agents-most-dangerous-refactor-iazu","Multi-agent rename tooling rewrites two hundred files in ten seconds because it noticed the drift. Half the time the drift was a load-bearing distinction the team encoded on purpose. Vocabulary curation is a real-time review surface now, and senior includes refusing changes that would be technically more consistent because the domain has two concepts the agent has no way to see.","Travis Frisinger","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fwww.tddbuddy.com%2Fimages%2Fcovers%2Fthe-coordinated-rename-is-the-dangerous-refactor.png",[11,261,19,262,263],"vocabulary","domainmodeling","codereview","2026-08-17T08:15:58.132Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fthe-coordinated-rename-is-the-agents-most-dangerous-refactor-iazu.md","https:\u002F\u002Fdev.to\u002Ftmfrisinger\u002Fthe-coordinated-rename-is-the-agents-most-dangerous-refactor-6a",{"id":268,"title":269,"slug":270,"lang":10,"category":50,"categorySlug":51,"summary":271,"excerpt":271,"author":272,"date":205,"readTime":16,"image":273,"tags":274,"publishedAt":277,"createdAt":277,"updatedAt":277,"filePath":278,"sourceUrl":279},"cron-1786954557526","Microservices: Building Applications as Independent, Communicating Services","microservices-building-applications-as-independent-communicating-services-c45k","Microservices: Building Applications as Independent, Communicating Services   A practical,...","Rhuturaj Takle","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F8puio1c7flrtyivr04hl.png",[50,51,275,237,276],"dotnet","learning","2026-08-17T08:15:57.526Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fmicroservices-building-applications-as-independent-communicating-services-c45k.md","https:\u002F\u002Fdev.to\u002Frhuturaj_takle\u002Fmicroservices-building-applications-as-independent-communicating-services-2eo8",{"id":281,"title":282,"slug":283,"lang":10,"category":66,"categorySlug":67,"summary":284,"excerpt":284,"author":285,"date":205,"readTime":16,"image":286,"tags":287,"publishedAt":291,"createdAt":291,"updatedAt":291,"filePath":292,"sourceUrl":293},"cron-1786954556056","From Arduino To Automotive: How I Escaped The IDE And Owned The Bus","from-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-hj7g","Arduino taught me how to build. Bare metal taught me how the build actually works.  I have a lot of...","v. Splicer","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fabn3138rnp9vm0nyk54b.jpg",[66,288,289,290,67],"esp32","arduino","canbus","2026-08-17T08:15:56.056Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Ffrom-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-hj7g.md","https:\u002F\u002Fdev.to\u002Fnumbpill3d\u002Ffrom-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-f8f",{"id":295,"title":296,"slug":297,"lang":10,"category":82,"categorySlug":83,"summary":298,"excerpt":298,"author":299,"date":205,"readTime":16,"image":300,"tags":301,"publishedAt":304,"createdAt":304,"updatedAt":304,"filePath":305,"sourceUrl":306},"cron-1786954555663","The Backup Awakens: A Star Wars Story","the-backup-awakens-a-star-wars-story-jzpq","The Quest Begins (The \\\"Why\\\")   Honestly, I used to think backups were the boring chores you...","Timevolt","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4ynsfxiz14nn4b9ylhn6.png",[82,89,302,83,303],"docker","cicd","2026-08-17T08:15:55.662Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fthe-backup-awakens-a-star-wars-story-jzpq.md","https:\u002F\u002Fdev.to\u002Ftimevolt\u002Fthe-backup-awakens-a-star-wars-story-1616",{"id":308,"title":309,"slug":310,"lang":10,"category":11,"categorySlug":12,"summary":311,"excerpt":311,"author":258,"date":205,"readTime":16,"image":312,"tags":313,"publishedAt":316,"createdAt":316,"updatedAt":316,"filePath":317,"sourceUrl":318},"cron-1786954321408","Test Deletion Is a Privileged Operation","test-deletion-is-a-privileged-operation-2pfz","The cheapest way for an agent to make a failing test pass is to delete it. That is logical for the agent and catastrophic for the codebase. Tests are append-only by default. Deletion needs a human author, a separate commit, and a separate review.","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fwww.tddbuddy.com%2Fimages%2Fcovers%2Ftest-deletion-is-a-privileged-operation.png",[11,314,19,315,263],"tdd","testdesign","2026-08-17T08:12:01.408Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ftest-deletion-is-a-privileged-operation-2pfz.md","https:\u002F\u002Fdev.to\u002Ftmfrisinger\u002Ftest-deletion-is-a-privileged-operation-264a",{"id":320,"title":321,"slug":322,"lang":10,"category":50,"categorySlug":51,"summary":323,"excerpt":323,"author":324,"date":205,"readTime":16,"image":325,"tags":326,"publishedAt":329,"createdAt":329,"updatedAt":329,"filePath":330,"sourceUrl":331},"cron-1786954321239","You Don't Always Need a Workflow Engine to Roll Back a Failed Checkout","you-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-1iwf","Here's a sequence that shows up in almost every Laravel app that talks to the outside world:   Charge...","Sient","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fu6g3j4z4af9tbuozbz2v.png",[50,327,328,222,51],"laravel","php","2026-08-17T08:12:01.239Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fyou-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-1iwf.md","https:\u002F\u002Fdev.to\u002Fsient\u002Fyou-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-5gop",{"id":333,"title":334,"slug":335,"lang":10,"category":66,"categorySlug":67,"summary":336,"excerpt":336,"author":337,"date":205,"readTime":16,"image":338,"tags":339,"publishedAt":341,"createdAt":341,"updatedAt":341,"filePath":342,"sourceUrl":343},"cron-1786954321092","I Stopped Trusting AI Agents With Tools. So I Built a Gatekeeper.","i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m","Update 08\u002F15 0.2.0 Released   github.com\u002Fdeghosal-2026\u002Fagent-tooltrust · pip install agent-tooltrust...","Debashish Ghosal","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fr97gsrqar0qk7ejjibih.png",[66,73,184,67,340],"gatekeeper","2026-08-17T08:12:01.092Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m.md","https:\u002F\u002Fdev.to\u002Fdebashish_ghosal\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-26fb",{"id":345,"title":346,"slug":347,"lang":10,"category":82,"categorySlug":83,"summary":348,"excerpt":348,"author":349,"date":205,"readTime":16,"image":350,"tags":351,"publishedAt":353,"createdAt":353,"updatedAt":353,"filePath":354,"sourceUrl":355},"cron-1786954320913","I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own Salary.","i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8","I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own...","Le Beltagy","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Frvjfi7ee0tmi1xp1mem5.png",[82,83,67,352,89],"gitops","2026-08-17T08:12:00.911Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8.md","https:\u002F\u002Fdev.to\u002Fle_beltagy\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-227e",25,1,50,[360,363,367,369,370,371],{"name":361,"slug":362,"count":356},"All","all",{"name":364,"slug":365,"count":366},"Nuxt 4","nuxt-4",0,{"name":82,"slug":83,"count":368},6,{"name":66,"slug":67,"count":368},{"name":50,"slug":51,"count":368},{"name":11,"slug":12,"count":372},7,[374,375,376,377,378,379,380,381,382,383,385,387,389,390,392],{"name":11,"slug":12,"count":372},{"name":19,"slug":19,"count":372},{"name":67,"slug":67,"count":372},{"name":50,"slug":51,"count":368},{"name":51,"slug":51,"count":368},{"name":66,"slug":67,"count":368},{"name":82,"slug":83,"count":368},{"name":83,"slug":83,"count":368},{"name":89,"slug":89,"count":368},{"name":73,"slug":73,"count":384},4,{"name":72,"slug":72,"count":386},3,{"name":56,"slug":56,"count":388},2,{"name":57,"slug":57,"count":388},{"name":58,"slug":391,"count":388},"trending",{"name":88,"slug":88,"count":388},{"success":394,"slug":9,"lang":10,"items":395,"total":423,"page":357,"limit":456,"hasMore":394,"remaining":372},true,[396,407,426,436,446],{"author":397,"avatar":398,"role":399,"date":400,"createdAt":401,"content":402,"likes":403,"isLiked":404,"replies":405,"id":406},"Lucas Moreau","L","Cloud Native Developer","12 hours ago","2026-08-16T22:09:00.577Z","Kafka event streaming with schema registry ensures backward compatibility even as payload models evolve across microservice boundaries.",18,false,[],"c-test-what-your-ai-agents-must-not-do-fj6y-en-1",{"author":408,"avatar":409,"role":410,"date":411,"createdAt":412,"content":413,"likes":414,"isLiked":404,"replies":415,"id":425},"Alexander Wright","A","Principal Systems Architect @ Stripe","20 mins ago","2026-08-17T09:49:00.576Z","Superb architectural breakdown! The hybrid L1 in-memory + L2 distributed Redis cache pattern is crucial for mitigating high-concurrency thundering herd issues.",29,[416],{"author":417,"avatar":418,"role":419,"date":420,"createdAt":421,"content":422,"likes":423,"isLiked":404,"id":424},"David Chen","D","Staff Infrastructure Engineer","12 mins ago","2026-08-17T09:57:00.576Z","Totally agree, Alexander. Pairing that with singleflight request deduplication on the backend virtually eliminates DB spikes.",15,"r-test-what-your-ai-agents-must-not-do-fj6y-en-2-1","c-test-what-your-ai-agents-must-not-do-fj6y-en-2",{"author":427,"avatar":428,"role":429,"date":430,"createdAt":431,"content":432,"likes":433,"isLiked":404,"replies":434,"id":435},"Julian Sterling","J","Cybersecurity Director","2 hours ago","2026-08-17T08:09:00.576Z","Zero-Trust microsegmentation powered by eBPF and Cilium eliminates sidecar proxy overhead while delivering strict L7 network encryption. Excellent walkthrough!",27,[],"c-test-what-your-ai-agents-must-not-do-fj6y-en-3",{"author":437,"avatar":438,"role":439,"date":440,"createdAt":441,"content":442,"likes":443,"isLiked":404,"replies":444,"id":445},"Oliver Bennett","O","VP of Engineering","8 hours ago","2026-08-17T02:09:00.577Z","Top-tier technical writing. Clear architecture diagrams, reproducible benchmarks, and actionable code snippets. Bookmarked for our engineering team.",45,[],"c-test-what-your-ai-agents-must-not-do-fj6y-en-4",{"author":447,"avatar":448,"role":449,"date":450,"createdAt":451,"content":452,"likes":453,"isLiked":404,"replies":454,"id":455},"Kenji Sato","K","Principal Infrastructure Architect","2 days ago","2026-08-15T10:09:00.577Z","Intlight's multi-region architectural blueprints set the benchmark for ultra-resilient, enterprise-grade cloud systems in 2026.",53,[],"c-test-what-your-ai-agents-must-not-do-fj6y-en-5",5,1786961341612]