[{"data":1,"prerenderedAt":458},["ShallowReactive",2],{"blog-post-detail-the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9":3,"blogs-all-posts-detail-suggestions-en":29,"blog-comments-the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9-en":393},{"status":4,"source":5,"data":6},"success","markdown-file",{"id":7,"title":8,"slug":9,"lang":10,"category":11,"categorySlug":12,"summary":13,"excerpt":13,"author":14,"date":15,"readTime":16,"image":17,"tags":18,"publishedAt":23,"createdAt":23,"updatedAt":23,"filePath":24,"sourceUrl":25,"content":26,"seoTitle":27,"seoDescription":13,"canonicalUrl":28},"cron-1786956117904-en","The Write Policy Is the Hard Part: Promotion Pipelines for Agent Memory","the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9","en","AI Agents","ai-agents","Storing agent memory is easy. Deciding what earns a permanent write, and keeping the write-path alive through RBAC and network policy, is the real work.","Guatu","8\u002F17\u002F2026","6 min read","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fguatulabs.dev%2Fog%2Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory.png",[11,19,20,21,22],"aiagents","agentmemory","rbac","networkpolicies","2026-08-17T08:41:57.903Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9.md","https:\u002F\u002Fdev.to\u002Ffuthgar\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-5mc","\nMost \"agent memory\" tutorials stop at the retrieval side. They show you a Qdrant collection, a `qdrant-find` call, an embedding model, and call it done. Retrieval is the easy 20%. The part that quietly eats your week is the write-path: deciding what deserves to be written, sanitizing it, and keeping the network and RBAC plumbing intact so the agent can actually reach the store it's allowed to write to.\n\nIf you run agents that update their own knowledge base, this is for you. The failure modes here aren't AI problems. They're distributed-systems problems wearing an AI costume: a `403 Forbidden` on a write, a `default-deny-ingress` policy that silently blinds an agent to its own memory, a vector store slowly rotting into landfill because nobody gated the writes.\n\n## Retrieval is solved. Promotion isn't.\n\nThe read-side has good primitives. You embed a query, you search, you rank, you feed the top-k back into context. I've written about the recall half of this before in [Cognitive Memory for Agents](\u002Fposts\u002Fcognitive-memory-for-agents-vector-search-vs-activation-based-recall\u002F), where the interesting question is whether you use plain vector similarity or activation-based recall.\n\nPromotion has no such consensus. Every observation an agent makes during a session is a candidate for long-term memory, and almost none of them should be promoted. A single session produces hundreds of transient facts: the value of a variable, a file it read, a command that failed, a user's throwaway comment. Write all of that to a permanent store and you don't have a memory. You have a landfill with a search index bolted on.\n\nSo the real design question isn't \"how do I store this.\" It's \"what is my write policy, and how do I enforce it without breaking security.\" That's two problems stacked on top of each other, and people usually only notice the second one after the first one is already leaking noise into their vector DB.\n\n## What I tried first: write-everything, filter-later\n\nThe obvious first move is to write everything and sort it out at read time. Cheap to build. Every observation goes straight into the vector store, and you rely on similarity ranking to surface the good stuff and bury the noise.\n\nThat falls apart for a boring reason: embeddings don't distinguish signal from noise, they distinguish topics from topics. A useless observation that happens to be on-topic ranks just as high as a genuine insight. Search \"how do I fix the Longhorn PDB drain issue\" and you get back the one real fix alongside six half-formed guesses the agent muttered mid-session and never confirmed. The index is technically working. The memory is useless.\n\nA simple recency window was the second thing I reached for. Keep the last N observations, drop the rest. That's not a memory either, that's a ring buffer. It throws away the rare high-value insight from three weeks ago and keeps the noise from ten minutes ago, purely because noise is more recent. Recency is a terrible proxy for worth.\n\nBoth approaches share the same missing piece: there's no decision point where something gets *judged* before it's written. No gate. The whole thing was reactive. And once you've dumped enough uncurated writes into a store, you inherit a second problem: eviction. Now you need a decay policy to claw back the space, which I covered in [Eviction Without Deletion](\u002Fposts\u002Feviction-without-deletion-running-an-act-r-decay-policy-for-agent-memory-in-production\u002F). The cleaner fix is to not let the garbage in during the write in the first place.\n\n## The actual solution: a promotion pipeline with a gatekeeper\n\nTreat long-term memory like a production branch. Nothing merges without passing checks. Observations live in a cheap, volatile scratchpad. Promotion to the permanent store is an explicit, gated event, not a side effect of the agent talking.\n\nThe pipeline has four stages:\n\n1. **Capture** into a transient scratchpad (session-scoped, no gating).\n2. **Score** each candidate for importance and novelty.\n3. **Validate and sanitize** (dedup, schema check, strip secrets).\n4. **Promote** the survivors into the durable store with provenance.\n\nAt the heart of it sits the gatekeeper. It's not AI magic, it's a function with a threshold. Here's the shape I use:\n\n```python\ndef gatekeeper(observation, store):\n    # 1. Cheap reject: too short, or a known non-fact pattern\n    if len(observation.text) \u003C 40 or is_ephemeral(observation):\n        return Decision.DROP\n\n    # 2. Score. Importance is explicit, novelty is measured.\n    importance = score_importance(observation)      # 0.0 - 1.0\n    nearest = store.search(observation.embedding, k=1)\n    novelty = 1.0 - (nearest.score if nearest else 0.0)\n\n    # 3. Gate: must clear the bar AND not be a near-duplicate\n    if importance \u003C 0.55 or novelty \u003C 0.15:\n        return Decision.DROP\n\n    # 4. Sanitize before it ever touches the durable store\n    clean = strip_secrets(observation.text)\n    if clean != observation.text:\n        observation = observation.replace(text=clean)\n\n    return Decision.PROMOTE\n```\n\nTwo knobs matter here. The importance threshold controls how strict promotion is. The novelty check is what keeps you from writing the same fact forty times with slightly different wording, which is the single most common way vector stores bloat. A near-duplicate of something you already stored is worth nothing, no matter how important the underlying fact is.\n\n`score_importance` doesn't have to be an LLM call. I've had good results with a hybrid: a set of cheap heuristics that run on every observation, with an optional LLM tiebreaker reserved for the borderline cases. Cheap signals do most of the work:\n\n```python\ndef score_importance(obs):\n    score = 0.0\n    # Fixes, decisions, and root causes are worth keeping\n    if re.search(r\"\\b(root cause|fixed by|the fix was|decided to)\\b\", obs.text, re.I):\n        score += 0.4\n    # Concrete, reusable artifacts: commands, configs, versions\n```\n    if re.search(r\"(\\bv\\d+\\.\\d+|--?[a-z-]+=|kubectl |sysctl )\", obs.text):\n        score += 0.25\n    # User explicitly asked to remember it\n    if obs.flags.get(\"user_pinned\"):\n        score += 0.5\n    # Pure status chatter is worth nothing\n    if re.search(r\"^\\s*(ok|done|running|checking)\\b\", obs.text, re.I):\n        score -= 0.3\n    return max(0.0, min(1.0, score))\n```plaintext\n\n```\nOnly when the heuristic lands in the ambiguous band (say 0.4 to 0.6) do I spend an LLM call to break the tie. That keeps the pipeline cheap. Most observations never touch a model. The ones that do are already suspected to be worth the tokens.\n\nProvenance is the stage people skip and regret. When you promote, attach where it came from: the session ID, the timestamp, the tool that produced it, and the importance score that let it through. Later, when a memory turns out to be wrong, you want to trace it back and either correct the source or tighten the gate. Without provenance you have facts floating free of any way to audit them, which is how a confidently-wrong memory poisons every future retrieval.\n\n## Then security breaks the whole thing\n\nHere's the part the memory tutorials never mention, because they all run on `localhost` where everything is implicitly trusted. Move that same agent into a real cluster and the write-path stops working in ways that have nothing to do with your gatekeeper logic.\n\nThe classic version: your MCP client talks to a memory server that was fine on localhost, you move the server into an LXC or a pod, and now every write comes back `403 Forbidden`. The gatekeeper approved the write. The network rejected it. Those are different layers, and conflating them wastes an afternoon.\n\nA localhost MCP config assumes no auth. It looks like this and works only because nothing is checking:\n\n```json\n{\n  \"mcpServers\": {\n    \"memory\": {\n      \"url\": \"http:\u002F\u002F127.0.0.1:8080\u002Fmcp\"\n    }\n  }\n}\n```\n\nMove that server behind an authenticating proxy and the same config gets a `401` or `403`. The fix is to pass a bearer token, and the token must never sit in the file as plaintext. Source it at launch instead:\n\n```json\n{\n  \"mcpServers\": {\n    \"memory\": {\n      \"url\": \"https:\u002F\u002Fmemory.internal.example.com\u002Fmcp\",\n      \"headers\": {\n        \"Authorization\": \"Bearer ${MEMORY_WRITE_TOKEN}\"\n      }\n    }\n  }\n}\n```\n\nWhere `MEMORY_WRITE_TOKEN` is injected from a secrets manager at process start, not committed anywhere. I run agent tokens through the same two-tier service-account pattern I described in [Agent Credential Management](\u002Fposts\u002Fagent-credential-management-two-tier-service-accounts\u002F): a read-only identity for retrieval, a separate write identity for promotion, so a compromised reader can't corrupt the store. That split matters more for memory than for most workloads, because the read path runs constantly and the write path runs rarely. Give them the same credential and every retrieval carries write authority it never needs.\n\nRBAC tightening is the second way this bites. A lot of default service accounts have drifted toward `reader`-only roles, which is correct for most agents and silently fatal for one that promotes memory. The agent retrieves fine, scores fine, decides to promote, and the write returns `403`. Nothing in the AI layer is wrong. The role binding is missing a verb. If you run least-privilege service accounts (and you should), the promotion identity needs an explicit write grant scoped to exactly the memory namespace and nothing else.\n\n## Network policy: the silent blinding\n\nEven with the token and the role sorted, there's a third layer that fails silently: the network policy. This one is nastier because it doesn't return a clean `403`. It returns a hang, or a connection timeout, which looks like the memory store is down rather than firewalled off.\n\nIf you run `default-deny-ingress` on your cluster (and for a memory store holding curated agent knowledge, you should), then the Qdrant or memory pod rejects all traffic until you explicitly allow the agent's namespace. Miss that rule and the agent is blind to its own memory. It doesn't error loudly. It just retrieves nothing and promotes nothing, and you spend an hour convinced your embedding model broke.\n\nHere's the allow rule that opens exactly one path, agent namespace to memory store, and nothing else:\n\n```yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: allow-agents-to-memory\n  namespace: memory\nspec:\n  podSelector:\n    matchLabels:\n      app: qdrant\n  policyTypes:\n    - Ingress\n  ingress:\n    - from:\n        - namespaceSelector:\n            matchLabels:\n              purpose: agents      # only the agent namespace\n      ports:\n        - protocol: TCP\n          port: 6333               # Qdrant HTTP API\n```\n\nThat keeps the `default-deny` posture intact while carving a single hole for the traffic that has to flow. If you want the deeper treatment of default-deny and namespace isolation, I wrote that up in [Network Policies with Calico](\u002Fposts\u002Fnetwork-policies-with-calico-default-deny-and-namespace-isolation\u002F). The point for memory specifically: your write policy is only as good as the packets that reach the store. A perfect gatekeeper behind a closed network policy promotes nothing.\n\n## When the automated pipeline fails, promote out of band\n\nPipelines break. A token expires mid-run, a policy rollout blocks a port, a registry starts rejecting pushes. When that happens and you've got a batch of validated memories that passed the gate but couldn't land, you want a manual promotion path so the work isn't lost.\n\nI keep the scratchpad durable enough to survive a failed promotion. If the write to the durable store fails, the candidates stay in the scratchpad flagged `pending_promotion`, and a small out-of-band job retries them once the plumbing is fixed. This is the same instinct as importing a container image by hand with `ctr -n k8s.io images import` when a registry push is blocked: the automated path is preferred, but you never let a transient infra failure eat validated work. Design for the pipeline to fail and leave the survivors somewhere you can replay them.\n\n## Why gating at write-time beats filtering at read-time\n\nThe deeper reason to gate on the way in, rather than filter on the way out, is that write-time is the only moment you have full context. At promotion time the agent knows the session, the task, whether the user pinned the fact, and whether the command actually succeeded. Read-time has none of that. All read-time sees is an embedding and a similarity score, stripped of the context that made the observation meaningful or worthless.\n\nFiltering late also compounds. Every uncurated write costs you three times: once in storage, once in every retrieval that now has to rank around it, and once when the decay policy eventually has to evict it. Gating early pays all three back. A store of 2,000 curated memories retrieves faster and cleaner than a store of 50,000 raw observations, and it's cheaper to run because you're embedding and indexing a fraction of the volume.\n\nThere's a governance angle too. A gated write-path gives you one chokepoint where sanitization happens. Secret-stripping, PII redaction, schema validation: they all live in the gatekeeper, so you can reason about what's in the store instead of hoping nothing sensitive slipped through a thousand scattered write calls. For anyone building agent systems where the memory store might hold customer data or infrastructure detail, that single chokepoint is the difference between an auditable system and a liability. It's the kind of design decision I end up walking clients through when they [build agent pipelines](https:\u002F\u002Fguatulabs.com\u002Fservices) that touch real data.\n\n## Lessons learned\n\nThe thing that surprised me most: the AI part of agent memory is the small part. The gatekeeper is fifty lines. The threshold tuning takes an afternoon. What actually consumes the time is the boundary between the agent and its store, which is pure distributed systems. Tokens, roles, network policy, retry logic. If you come at agent memory from the ML side, that boundary blindsides you, because none of it shows up on localhost.\n\nWhat I'd do differently: I'd instrument the gatekeeper's *rejections* from day one, not just its promotions. For a long time I only logged what got written. The far more useful signal was what got dropped and why, because that's how you catch a threshold that's too strict silently throwing away good memories, or a novelty check that's deduping things it shouldn't. A promotion pipeline you can't observe is a promotion pipeline you can't tune.\n\nTwo caveats worth stating plainly. First, thresholds are workload-specific. My importance bar of 0.55 works for an infrastructure agent that mostly logs fixes and decisions. A research agent that summarizes papers needs a completely different scoring function, because \"novelty\" means something different when the whole job is synthesizing new material. Don't copy my numbers, copy the structure and tune the numbers against your own rejection logs.\n\nSecond, don't over-engineer the gate before you have traffic. Start with the cheap heuristic and a hard threshold. Add the LLM tiebreaker only when you can point at real borderline cases it would resolve. I've watched people build elaborate multi-model scoring ensembles for a store that had eleven memories in it. The write policy is the hard part, but hard doesn't mean complicated. It means deliberate: a clear decision about what earns a permanent write, and enough infrastructure discipline to keep that decision enforceable once security gets involved.\n\n---\n\n> 🔗 **Original Source**: [Guatu](https:\u002F\u002Fdev.to\u002Ffuthgar\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-5mc)\n","The Write Policy Is the Hard Part: Promotion Pipelines for Agent Memory - Intlight Insights","https:\u002F\u002Fintlighttech.com\u002Fblogs\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9",{"items":30,"total":356,"page":357,"totalPages":357,"limit":358,"lang":10,"categories":359,"popularTags":373},[31,45,61,77,93,95,108,121,135,149,163,175,188,200,214,227,241,253,267,280,294,307,319,332,344],{"id":32,"title":33,"slug":34,"lang":10,"category":11,"categorySlug":12,"summary":35,"excerpt":35,"author":36,"date":15,"readTime":16,"image":37,"tags":38,"publishedAt":42,"createdAt":42,"updatedAt":42,"filePath":43,"sourceUrl":44},"cron-1786956218725-en","I Thought I'd Lost the Plot. I Was Writing It.","i-thought-id-lost-the-plot-i-was-writing-it-wjvz","I Thought I'd Lost the Plot. I Was Writing It.            I set out to build autonomous...","Joe Black","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fa3l9h76kr920p8bm2mjp.png",[11,39,19,40,41],"claudecode","developmenttools","autonomousagents","2026-08-17T08:43:38.725Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fi-thought-id-lost-the-plot-i-was-writing-it-wjvz.md","https:\u002F\u002Fdev.to\u002Fjoeblackwaslike\u002Fi-thought-id-lost-the-plot-i-was-writing-it-5fil",{"id":46,"title":47,"slug":48,"lang":10,"category":49,"categorySlug":50,"summary":51,"excerpt":51,"author":52,"date":15,"readTime":16,"image":53,"tags":54,"publishedAt":58,"createdAt":58,"updatedAt":58,"filePath":59,"sourceUrl":60},"cron-1786956216746-en","What Is the Circuit Breaker Pattern? A Practical Guide","what-is-the-circuit-breaker-pattern-a-practical-guide-4j68","Microservices","microservices","What Is the Circuit Breaker Pattern? A Practical Guide for Developers   Imagine your...","Avijit Bera","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fi6cy1uyqxjd14ikkveev.png",[49,50,55,56,57],"backend","api","Trending","2026-08-17T08:43:36.746Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fwhat-is-the-circuit-breaker-pattern-a-practical-guide-4j68.md","https:\u002F\u002Fdev.to\u002Favijitbera\u002Fwhat-is-the-circuit-breaker-pattern-a-practical-guide-20i4",{"id":62,"title":63,"slug":64,"lang":10,"category":65,"categorySlug":66,"summary":67,"excerpt":67,"author":68,"date":15,"readTime":16,"image":69,"tags":70,"publishedAt":74,"createdAt":74,"updatedAt":74,"filePath":75,"sourceUrl":76},"cron-1786956214008-en","I attacked my own npm package before launching it. It let the proposer approve their own writes","i-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-oi6y","Security","security","My library exists so a human approves an LLM's UPDATE before it runs. It never checked that the approver was somebody other than the proposer — and wrote \\\"approved\\\" into the audit trail anyway.","hyuga","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F65yv5n4qvrgn3t6ot4gy.png",[65,71,72,66,73],"opensource","ai","database","2026-08-17T08:43:34.007Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-oi6y.md","https:\u002F\u002Fdev.to\u002Fhyuga611\u002Fi-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-4mki",{"id":78,"title":79,"slug":80,"lang":10,"category":81,"categorySlug":82,"summary":83,"excerpt":83,"author":84,"date":15,"readTime":16,"image":85,"tags":86,"publishedAt":90,"createdAt":90,"updatedAt":90,"filePath":91,"sourceUrl":92},"cron-1786956210950-en","Build an MCP Server in Go (Part 1): Designing a diagnostic-grade Kubernetes client","build-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-p1d4","Kubernetes","kubernetes","This post designs the Kubernetes client. The next post wraps it as an MCP server and wires it to an...","Fer Rios","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fpw4b055hh8hxl5unrmvv.png",[81,82,87,88,89],"go","devops","mcp","2026-08-17T08:43:30.949Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fbuild-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-p1d4.md","https:\u002F\u002Fdev.to\u002Fferztyle\u002Fbuild-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-49a2",{"id":7,"title":8,"slug":9,"lang":10,"category":11,"categorySlug":12,"summary":13,"excerpt":13,"author":14,"date":15,"readTime":16,"image":17,"tags":94,"publishedAt":23,"createdAt":23,"updatedAt":23,"filePath":24,"sourceUrl":25},[11,19,20,21,22],{"id":96,"title":97,"slug":98,"lang":10,"category":11,"categorySlug":12,"summary":99,"excerpt":99,"author":100,"date":15,"readTime":101,"image":102,"tags":103,"publishedAt":105,"createdAt":105,"updatedAt":105,"filePath":106,"sourceUrl":107},"cron-1786955347611","I Changed How I Think About AI Memory","i-changed-how-i-think-about-ai-memory-fnpm","I Changed How I Think About AI Memory   When I first built Lean AI Memory, I focused too...","Phúc Phùng","6 phút","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F0oqod5zshdan74573bau.png",[11,72,19,71,104],"git","2026-08-17T08:29:07.610Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fi-changed-how-i-think-about-ai-memory-fnpm.md","https:\u002F\u002Fdev.to\u002Fphucphungbk\u002Fi-changed-how-i-think-about-ai-memory-4mkd",{"id":109,"title":110,"slug":111,"lang":10,"category":49,"categorySlug":50,"summary":112,"excerpt":112,"author":113,"date":15,"readTime":101,"image":114,"tags":115,"publishedAt":118,"createdAt":118,"updatedAt":118,"filePath":119,"sourceUrl":120},"cron-1786955347443","Real-Life Refactoring Example: ~3x Less Code to Read","real-life-refactoring-example-3x-less-code-to-read-dccm","There is a popular idea that refactoring is making code shorter. It is not entirely wrong....","Valentine Shi","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Foubl9dlj23byhsak2mqy.png",[49,116,117,55,50],"node","software","2026-08-17T08:29:07.443Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Freal-life-refactoring-example-3x-less-code-to-read-dccm.md","https:\u002F\u002Fdev.to\u002Fvalentineshi-dev\u002Freal-life-refactoring-example-3x-less-code-to-read-3mdl",{"id":122,"title":123,"slug":124,"lang":10,"category":65,"categorySlug":66,"summary":125,"excerpt":125,"author":126,"date":15,"readTime":101,"image":127,"tags":128,"publishedAt":132,"createdAt":132,"updatedAt":132,"filePath":133,"sourceUrl":134},"cron-1786955347034","The Tragedy of the Clean-Handed Auditor","the-tragedy-of-the-clean-handed-auditor-rgoz","\\\"I could save them if they'd only listen...\\\"  Hey, you. Yeah, you: the compliance or governance...","Ben Link","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F5z426h3tt6e2b3sthd2f.png",[65,66,129,130,131],"compliance","developers","careerdevelopment","2026-08-17T08:29:07.034Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fthe-tragedy-of-the-clean-handed-auditor-rgoz.md","https:\u002F\u002Fdev.to\u002Flinkbenjamin\u002Fthe-tragedy-of-the-clean-handed-auditor-1253",{"id":136,"title":137,"slug":138,"lang":10,"category":81,"categorySlug":82,"summary":139,"excerpt":139,"author":140,"date":15,"readTime":101,"image":141,"tags":142,"publishedAt":146,"createdAt":146,"updatedAt":146,"filePath":147,"sourceUrl":148},"cron-1786955346614","Building Sluice: QoS-Aware Capacity Governance for Self-Hosted LLM Inference","building-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-flbu","📦 Project: https:\u002F\u002Fgithub.com\u002FVampiricCyborg\u002Fsluice           1. The Problem: When Capacity Becomes...","Madhav M S","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fh3vuie9oakcn3bqzxtbh.png",[81,143,144,82,145],"distributedsystems","llm","systemdesign","2026-08-17T08:29:06.613Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fbuilding-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-flbu.md","https:\u002F\u002Fdev.to\u002Fvampiriccyborg\u002Fbuilding-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-13ja",{"id":150,"title":151,"slug":152,"lang":10,"category":11,"categorySlug":12,"summary":153,"excerpt":153,"author":154,"date":15,"readTime":101,"image":155,"tags":156,"publishedAt":160,"createdAt":160,"updatedAt":160,"filePath":161,"sourceUrl":162},"cron-1786954879160","Test What Your AI Agents Must Not Do","test-what-your-ai-agents-must-not-do-fj6y","A Guardrail Without A Negative Test Is Still An Assumption   Most AI agent governance starts...","Bobai Kato","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fres.cloudinary.com%2Fota-run%2Fimage%2Fupload%2Fq_auto%2Ftest-what-your-ai-agents-must-not-do.png",[11,19,157,158,159],"agentsafety","negativetesting","executiongovernance","2026-08-17T08:21:19.160Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ftest-what-your-ai-agents-must-not-do-fj6y.md","https:\u002F\u002Fdev.to\u002Fotaready\u002Ftest-what-your-ai-agents-must-not-do-3e1a",{"id":164,"title":165,"slug":166,"lang":10,"category":49,"categorySlug":50,"summary":167,"excerpt":167,"author":168,"date":15,"readTime":101,"image":169,"tags":170,"publishedAt":172,"createdAt":172,"updatedAt":172,"filePath":173,"sourceUrl":174},"cron-1786954878754","Protecting Microservices: Implementing End-to-End Encryption Across REST APIs","protecting-microservices-implementing-end-to-end-encryption-across-rest-apis-gtfz","End-to-end encryption across REST APIs is the difference between a microservices architecture that...","Fu'ad Husnan","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fba3onadsxu08gb14brer.png",[49,56,50,57,171],"2026","2026-08-17T08:21:18.754Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fprotecting-microservices-implementing-end-to-end-encryption-across-rest-apis-gtfz.md","https:\u002F\u002Fdev.to\u002Ffuadhusnan_f44f3e13\u002Fprotecting-microservices-implementing-end-to-end-encryption-across-rest-apis-26hb",{"id":176,"title":177,"slug":178,"lang":10,"category":65,"categorySlug":66,"summary":179,"excerpt":179,"author":180,"date":15,"readTime":101,"image":181,"tags":182,"publishedAt":185,"createdAt":185,"updatedAt":185,"filePath":186,"sourceUrl":187},"cron-1786954878272","I Gave My Agent One Signed Permission It Couldn’t Mint Itself","i-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-nm1o","Evidence status. The supervised operator run completed on 2026-08-09. An operator-signed job...","Self-Correcting Systems","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fg1gjbzx4muvma5fznpjl.png",[65,183,88,66,184],"machinelearning","agents","2026-08-17T08:21:18.271Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-nm1o.md","https:\u002F\u002Fdev.to\u002Fkenielzep97\u002Fi-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-2lpc",{"id":189,"title":190,"slug":191,"lang":10,"category":81,"categorySlug":82,"summary":192,"excerpt":192,"author":193,"date":15,"readTime":101,"image":194,"tags":195,"publishedAt":197,"createdAt":197,"updatedAt":197,"filePath":198,"sourceUrl":199},"cron-1786954877848","One GPU, four ways to share it: ten scenarios, and the headline finding I had to retract","one-gpu-four-ways-to-share-it-ten-scenarios-and-the-headline-finding-i-had-to-retract-3y1v","I measured every GPU sharing mode across ten scenarios, published a headline finding that duplicate models are nearly free on unified memory, then failed to replicate it and retracted it. Here is what the controlled replication showed and how the original measurement fooled me.","Christopher Maher","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fllmkube.com%2Fog-gpu-sharing-four-ways-devto.png",[81,82,196,72,88],"gpu","2026-08-17T08:21:17.847Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fone-gpu-four-ways-to-share-it-ten-scenarios-and-the-headline-finding-i-had-to-retract-3y1v.md","https:\u002F\u002Fdev.to\u002Fdefilan\u002Fone-gpu-four-ways-to-share-it-ten-scenarios-and-the-one-number-that-inverts-on-your-hardware-1bih",{"id":201,"title":202,"slug":203,"lang":10,"category":11,"categorySlug":12,"summary":204,"excerpt":204,"author":14,"date":205,"readTime":101,"image":206,"tags":207,"publishedAt":211,"createdAt":211,"updatedAt":211,"filePath":212,"sourceUrl":213},"cron-1786954563310","FastMCP Agent Mail: RBAC Tokens vs Anonymous Access, and the 403 Errors in Between","fastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-ef0p","Why a FastMCP agent mail server that works anonymously in dev returns 403 behind TLS ingress, and how to wire bearer tokens without leaking them.","17\u002F8\u002F2026","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fguatulabs.dev%2Fog%2Ffastmcp-agent-mail-rbac-token-vs-anonymous-lessons-from-403-errors.png",[11,208,209,19,210],"fastmcp","mcpservers","authentication","2026-08-17T08:16:03.310Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ffastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-ef0p.md","https:\u002F\u002Fdev.to\u002Ffuthgar\u002Ffastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-22pk",{"id":215,"title":216,"slug":217,"lang":10,"category":49,"categorySlug":50,"summary":218,"excerpt":218,"author":219,"date":205,"readTime":101,"image":220,"tags":221,"publishedAt":224,"createdAt":224,"updatedAt":224,"filePath":225,"sourceUrl":226},"cron-1786954562962","eBPF-Powered Request Tracing in Go Microservices Without Instrumentation Tax","ebpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-k53p","How eBPF uprobes and ring buffers replace manual trace propagation in Go services—mechanics, tradeoffs, and failure modes.","Neeraj Singhi","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fws515jitp8rvalxr8d63.png",[49,222,87,50,223],"architecture","performance","2026-08-17T08:16:02.962Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Febpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-k53p.md","https:\u002F\u002Fdev.to\u002Fneeraj_singhi_golang\u002Febpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-34kf",{"id":228,"title":229,"slug":230,"lang":10,"category":65,"categorySlug":66,"summary":231,"excerpt":231,"author":232,"date":205,"readTime":101,"image":233,"tags":234,"publishedAt":238,"createdAt":238,"updatedAt":238,"filePath":239,"sourceUrl":240},"cron-1786954562825","How Dopamine Works: The Architecture of a Modern iOS Jailbreak","how-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-woxq","Most developers will never jailbreak a phone. That is fine. This article is not a how-to, and there...","ArshTechPro","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F0gnfjvl3fzvb1r1rpvci.png",[65,235,236,66,237],"ios","mobile","programming","2026-08-17T08:16:02.825Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fhow-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-woxq.md","https:\u002F\u002Fdev.to\u002Farshtechpro\u002Fhow-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-2hj3",{"id":242,"title":243,"slug":244,"lang":10,"category":81,"categorySlug":82,"summary":245,"excerpt":245,"author":246,"date":205,"readTime":101,"image":247,"tags":248,"publishedAt":250,"createdAt":250,"updatedAt":250,"filePath":251,"sourceUrl":252},"cron-1786954562468","I got tired of SSHing into 10 VMs a day, so I built a live map of my whole infrastructure","i-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-iqz9","Every day at work looked the same. Something breaks, or I need to push a new image, and I'm SSHing...","ByteStrix","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4xdxpc7fsu7nv8usri7a.png",[81,249,88,71,82],"productivity","2026-08-17T08:16:02.468Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fi-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-iqz9.md","https:\u002F\u002Fdev.to\u002Fbytestrix\u002Fi-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-2iil",{"id":254,"title":255,"slug":256,"lang":10,"category":11,"categorySlug":12,"summary":257,"excerpt":257,"author":258,"date":205,"readTime":101,"image":259,"tags":260,"publishedAt":264,"createdAt":264,"updatedAt":264,"filePath":265,"sourceUrl":266},"cron-1786954558132","The Coordinated Rename Is the Agent's Most Dangerous Refactor","the-coordinated-rename-is-the-agents-most-dangerous-refactor-iazu","Multi-agent rename tooling rewrites two hundred files in ten seconds because it noticed the drift. Half the time the drift was a load-bearing distinction the team encoded on purpose. Vocabulary curation is a real-time review surface now, and senior includes refusing changes that would be technically more consistent because the domain has two concepts the agent has no way to see.","Travis Frisinger","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fwww.tddbuddy.com%2Fimages%2Fcovers%2Fthe-coordinated-rename-is-the-dangerous-refactor.png",[11,261,19,262,263],"vocabulary","domainmodeling","codereview","2026-08-17T08:15:58.132Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fthe-coordinated-rename-is-the-agents-most-dangerous-refactor-iazu.md","https:\u002F\u002Fdev.to\u002Ftmfrisinger\u002Fthe-coordinated-rename-is-the-agents-most-dangerous-refactor-6a",{"id":268,"title":269,"slug":270,"lang":10,"category":49,"categorySlug":50,"summary":271,"excerpt":271,"author":272,"date":205,"readTime":101,"image":273,"tags":274,"publishedAt":277,"createdAt":277,"updatedAt":277,"filePath":278,"sourceUrl":279},"cron-1786954557526","Microservices: Building Applications as Independent, Communicating Services","microservices-building-applications-as-independent-communicating-services-c45k","Microservices: Building Applications as Independent, Communicating Services   A practical,...","Rhuturaj Takle","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F8puio1c7flrtyivr04hl.png",[49,50,275,237,276],"dotnet","learning","2026-08-17T08:15:57.526Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fmicroservices-building-applications-as-independent-communicating-services-c45k.md","https:\u002F\u002Fdev.to\u002Frhuturaj_takle\u002Fmicroservices-building-applications-as-independent-communicating-services-2eo8",{"id":281,"title":282,"slug":283,"lang":10,"category":65,"categorySlug":66,"summary":284,"excerpt":284,"author":285,"date":205,"readTime":101,"image":286,"tags":287,"publishedAt":291,"createdAt":291,"updatedAt":291,"filePath":292,"sourceUrl":293},"cron-1786954556056","From Arduino To Automotive: How I Escaped The IDE And Owned The Bus","from-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-hj7g","Arduino taught me how to build. Bare metal taught me how the build actually works.  I have a lot of...","v. Splicer","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fabn3138rnp9vm0nyk54b.jpg",[65,288,289,290,66],"esp32","arduino","canbus","2026-08-17T08:15:56.056Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Ffrom-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-hj7g.md","https:\u002F\u002Fdev.to\u002Fnumbpill3d\u002Ffrom-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-f8f",{"id":295,"title":296,"slug":297,"lang":10,"category":81,"categorySlug":82,"summary":298,"excerpt":298,"author":299,"date":205,"readTime":101,"image":300,"tags":301,"publishedAt":304,"createdAt":304,"updatedAt":304,"filePath":305,"sourceUrl":306},"cron-1786954555663","The Backup Awakens: A Star Wars Story","the-backup-awakens-a-star-wars-story-jzpq","The Quest Begins (The \\\"Why\\\")   Honestly, I used to think backups were the boring chores you...","Timevolt","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4ynsfxiz14nn4b9ylhn6.png",[81,88,302,82,303],"docker","cicd","2026-08-17T08:15:55.662Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fthe-backup-awakens-a-star-wars-story-jzpq.md","https:\u002F\u002Fdev.to\u002Ftimevolt\u002Fthe-backup-awakens-a-star-wars-story-1616",{"id":308,"title":309,"slug":310,"lang":10,"category":11,"categorySlug":12,"summary":311,"excerpt":311,"author":258,"date":205,"readTime":101,"image":312,"tags":313,"publishedAt":316,"createdAt":316,"updatedAt":316,"filePath":317,"sourceUrl":318},"cron-1786954321408","Test Deletion Is a Privileged Operation","test-deletion-is-a-privileged-operation-2pfz","The cheapest way for an agent to make a failing test pass is to delete it. That is logical for the agent and catastrophic for the codebase. Tests are append-only by default. Deletion needs a human author, a separate commit, and a separate review.","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fwww.tddbuddy.com%2Fimages%2Fcovers%2Ftest-deletion-is-a-privileged-operation.png",[11,314,19,315,263],"tdd","testdesign","2026-08-17T08:12:01.408Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ftest-deletion-is-a-privileged-operation-2pfz.md","https:\u002F\u002Fdev.to\u002Ftmfrisinger\u002Ftest-deletion-is-a-privileged-operation-264a",{"id":320,"title":321,"slug":322,"lang":10,"category":49,"categorySlug":50,"summary":323,"excerpt":323,"author":324,"date":205,"readTime":101,"image":325,"tags":326,"publishedAt":329,"createdAt":329,"updatedAt":329,"filePath":330,"sourceUrl":331},"cron-1786954321239","You Don't Always Need a Workflow Engine to Roll Back a Failed Checkout","you-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-1iwf","Here's a sequence that shows up in almost every Laravel app that talks to the outside world:   Charge...","Sient","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fu6g3j4z4af9tbuozbz2v.png",[49,327,328,222,50],"laravel","php","2026-08-17T08:12:01.239Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fyou-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-1iwf.md","https:\u002F\u002Fdev.to\u002Fsient\u002Fyou-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-5gop",{"id":333,"title":334,"slug":335,"lang":10,"category":65,"categorySlug":66,"summary":336,"excerpt":336,"author":337,"date":205,"readTime":101,"image":338,"tags":339,"publishedAt":341,"createdAt":341,"updatedAt":341,"filePath":342,"sourceUrl":343},"cron-1786954321092","I Stopped Trusting AI Agents With Tools. So I Built a Gatekeeper.","i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m","Update 08\u002F15 0.2.0 Released   github.com\u002Fdeghosal-2026\u002Fagent-tooltrust · pip install agent-tooltrust...","Debashish Ghosal","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fr97gsrqar0qk7ejjibih.png",[65,72,184,66,340],"gatekeeper","2026-08-17T08:12:01.092Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m.md","https:\u002F\u002Fdev.to\u002Fdebashish_ghosal\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-26fb",{"id":345,"title":346,"slug":347,"lang":10,"category":81,"categorySlug":82,"summary":348,"excerpt":348,"author":349,"date":205,"readTime":101,"image":350,"tags":351,"publishedAt":353,"createdAt":353,"updatedAt":353,"filePath":354,"sourceUrl":355},"cron-1786954320913","I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own Salary.","i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8","I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own...","Le Beltagy","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Frvjfi7ee0tmi1xp1mem5.png",[81,82,66,352,88],"gitops","2026-08-17T08:12:00.911Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8.md","https:\u002F\u002Fdev.to\u002Fle_beltagy\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-227e",25,1,50,[360,363,367,369,370,371],{"name":361,"slug":362,"count":356},"All","all",{"name":364,"slug":365,"count":366},"Nuxt 4","nuxt-4",0,{"name":81,"slug":82,"count":368},6,{"name":65,"slug":66,"count":368},{"name":49,"slug":50,"count":368},{"name":11,"slug":12,"count":372},7,[374,375,376,377,378,379,380,381,382,383,385,387,389,390,392],{"name":11,"slug":12,"count":372},{"name":19,"slug":19,"count":372},{"name":66,"slug":66,"count":372},{"name":49,"slug":50,"count":368},{"name":50,"slug":50,"count":368},{"name":65,"slug":66,"count":368},{"name":81,"slug":82,"count":368},{"name":82,"slug":82,"count":368},{"name":88,"slug":88,"count":368},{"name":72,"slug":72,"count":384},4,{"name":71,"slug":71,"count":386},3,{"name":55,"slug":55,"count":388},2,{"name":56,"slug":56,"count":388},{"name":57,"slug":391,"count":388},"trending",{"name":87,"slug":87,"count":388},{"success":394,"slug":9,"lang":10,"items":395,"total":456,"page":357,"limit":457,"hasMore":394,"remaining":368},true,[396,416,426,436,446],{"author":397,"avatar":398,"role":399,"date":400,"createdAt":401,"content":402,"likes":403,"isLiked":404,"replies":405,"id":415},"Marcus Vance","M","Head of AI Engineering @ NextWave","1 hour ago","2026-08-17T09:09:00.576Z","The Agent Memory Pipeline section hits the nail on the head. Hierarchical memory indexing with Qdrant vector search is the only sustainable way to scale long-context autonomous agents.",42,false,[406],{"author":407,"avatar":408,"role":409,"date":410,"createdAt":411,"content":412,"likes":413,"isLiked":404,"id":414},"Sarah Jenkins","S","LLM Research Scientist","30 mins ago","2026-08-17T09:39:00.576Z","Yes! Separating episodic memory from working context allows agents to operate indefinitely without token explosion.",19,"r-the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9-en-1-1","c-the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9-en-1",{"author":417,"avatar":418,"role":419,"date":420,"createdAt":421,"content":422,"likes":423,"isLiked":404,"replies":424,"id":425},"Priya Sharma","P","Distributed Database Architect","5 hours ago","2026-08-17T05:09:00.577Z","The latency comparisons between gRPC Protobuf binary encoding and standard JSON payloads demonstrate exactly why internal services should deprecate REST for high-throughput pipelines.",38,[],"c-the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9-en-2",{"author":427,"avatar":428,"role":429,"date":430,"createdAt":431,"content":432,"likes":433,"isLiked":404,"replies":434,"id":435},"Hannah Schmidt","H","DevOps & CI\u002FCD Lead","1 day ago","2026-08-16T10:09:00.577Z","Can confirm: automated canary deployments with Argo Rollouts and Prometheus metrics analysis prevented several outages for our payment gateways.",31,[],"c-the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9-en-3",{"author":437,"avatar":438,"role":439,"date":440,"createdAt":441,"content":442,"likes":443,"isLiked":404,"replies":444,"id":445},"Elena Rostova","E","Lead SRE & Platform Architect","45 mins ago","2026-08-17T09:24:00.576Z","The KEDA autoscaling setup with custom Prometheus metrics is production-grade. We observed a 60% compute cost reduction after switching to event-driven pod scaling.",34,[],"c-the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9-en-4",{"author":447,"avatar":448,"role":449,"date":450,"createdAt":451,"content":452,"likes":453,"isLiked":404,"replies":454,"id":455},"Liam O'Connor","L","Frontend Performance Specialist","3 hours ago","2026-08-17T07:09:00.576Z","Nuxt 4 with selective hydration and zero-JS interactive islands delivers mind-blowing speed. Sub-100ms INP and 99+ Core Web Vitals out of the box.",21,[],"c-the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9-en-5",14,5,1786961340902]