Posts

Observability answers why it's slow. Audit answers who's accountable. A hash-chained, redacted decision trail — with runnable code and tests.

An injection that only asks the agent to remember something passes every guardrail. Scope memory by key derivation, type it, and gate durability.

Post-filtering retrieval leaks. Authorise inside the query, then verify every citation against what this user was actually allowed to see.

The same card number needs four different representations in one agent run. Boundary-specific redaction plus tokenisation, with runnable code.

If a human approves everything, you have no approval gate — you have a rubber stamp. Risk-tiered, fingerprinted human-in-the-loop, with runnable code.

Detecting indirect prompt injection is a race you will lose. Capability binding contains a successful injection — with runnable code and tests.