## Synthesis additions (2026-10-18 — permissions for an agent on a live WordPress site) - [[3. Resources/Readwise/Articles/The WordPress MCP Adapter Is Ready for Production. Is Your Site Ready for It|The WordPress MCP Adapter Is Ready for Production…]] — three recommendations follow from a stated mechanism (a dedicated low-role user, an ability inventory, never allow deletion); five are asserted (staging period, logging, approval tier, table defaults, three buckets). Prompt injection and authentication are not covered. - [[3. Resources/Readwise/Articles/How to Connect Claude AI to WordPress Using MCP|How to Connect Claude AI to WordPress Using MCP (live demo)]] — a live password appears on screen and in a config file; the transcript doesn't say whether the shown one was revoked. ## Synthesis additions (2026-10-17 — an older note registered: completion reports) - [[3. Resources/Permanent Notes/A Confident Completion Report Is More Dangerous Than a Failure]] — a system that reports success on partly finished work defeats verification more than one that fails outright, because failure triggers inspection and success doesn't. ## Synthesis additions (2026-10-15 — credential reach) - [[3. Resources/Permanent Notes/An Agent Finishing a Task Will Clean Up Whatever Its Credential Can Reach]] — scope an agent's credential to a tagged set that excludes its own environment (Crawshaw) ## Synthesis additions (2026-09-10 — classification as the upstream safety decision) - [[3. Resources/Permanent Notes/A Threat Taxonomy Is a Policy Decision Not a Neutral Description]] — every automated monitoring decision inherits whatever the taxonomy above it decided counts as a threat. # AI Agent Safety MOC ## Synthesis additions (2026-10-01 — agent harness contracts and production reliability) - [[3. Resources/Readwise/Articles/Your Agent Loop Is Not a Production System]] — Sriram Madapusi Vasudevan, drawing on one system (AWS DevOps Agent), proposes five harness contracts (context, state, tools, control, completion) to enforce before an agent gets write access; argues mutation is the production boundary. - [[3. Resources/Readwise/Articles/Shipping Secure, Reliable and High Performance AI Agents]] — LeadDev talk by two speakers from a company the captions spell "Gradian Labs": security, reliability, and speed come from the harness (per-message scoped tokens, durable execution, failover); practice described, no measurements. - [[3. Resources/Readwise/Articles/Harness - Don’t Let AI Model Changes Break Your Workflow]] — LeadDev panel sponsored by harness.io (Whisper-only transcript, speaker names unconfirmed): model changes are routine, so control comes from layered checks, evals, and tiered rollout; panelist product claims are unverified. - [[3. Resources/Permanent Notes/An Agent Credential Should Expire With the Action It Serves Not the Conversation]] — a credential presented on each tool call should be scoped to one user and expire when the action ends; a conversation-scoped token lives as long as the conversation. Drawn from one conference talk. ## Synthesis additions (2026-10-01 — failure modes: complex systems and error budgets) - [[3. Resources/Readwise/Articles/Closed That Tab What How Complex Systems Fail Teaches Software Engineers]] — Overcommitted hosts Erika Eggemeyer and Bethany Janos discuss Richard Cook's paper: systems run degraded and catastrophe comes from small failures lining up; they keep incident reviews if psychological safety comes first. - [[3. Resources/Readwise/Articles/Your Error Budgets Don’t Know AI Exists]] — LeadDev opinion piece (no byline captured, one hypothetical scenario): error budgets measure consumed failure, not whether owners understand a change; AI cuts the cost of producing changes, not of understanding them. - [[3. Resources/Permanent Notes/An Error Budget Prices Failure and Cannot See Whether Owners Understand the Change]] — a team can hold its SLO while owners lose the ability to explain why a change behaves as it does; rests on one opinion piece with no incidence data. ## Synthesis additions (2026-10-01 — chatbot harms and guardrail limits) - [[3. Resources/Readwise/Articles/ChatBots Are Killing People!]] — Cal Newport argues LLM chatbots already contribute to child and adult harm because token-by-token generation and reinforcement-learning guardrails weaken over long conversations; cites news cases and two studies. Content note: discusses suicide. ## Synthesis additions (2026-10-01 — agent-facing web contracts) - [[3. Resources/Readwise/Articles/Recap of the Web & AI International Standards Seminar Generative UI and WebSkill]] — W3C recap of a 2026-09-06 Shenzhen seminar: speakers say the web is becoming an action space for agents; WebMCP and WebSkill are parallel proposals, neither a W3C standard, and agent identity and authorization remain open. ## Synthesis additions (2026-09-23 — agent-readable text and terminal states) - [[3. Resources/Permanent Notes/Any Text an Agent Reads Is a Control Surface]] — Oishi Banerjee: docs, error strings and readmes flow into agents, so they need the review a system prompt gets; "the assistant is not broken but the channel is." - [[3. Resources/Permanent Notes/An Agent Prompt Must Name Its Stopping Point]] — Theo Browne on Fable 5.1 prompting: tasks with no terminal state are where scope creep and wasted tokens come from; Anthropic's own scope-creep instruction is the one measured claim in the video. ## Synthesis additions (2026-09-23 — access cutoff as an operational risk) - [[3. Resources/Literature Notes/Fable 5 ban, 4 open models responded (The New Stack)]] — a vendor cutoff is a failure mode to plan for like an outage; the note records who could and could not switch during the ban window. ## Synthesis additions (2026-09-26 — disagreement vs deference in agents) - [[3. Resources/Readwise/Articles/Why AI Agents Shouldn’t Always Agree With You]] — Jesse Vincent on O'Reilly (2026-09-25, 61-second clip): the practitioner's daily problem is sycophancy, not autonomy; "if the agent is only ever going to effectively type for me, I don't need an agent"; the clip argues for disagreement on quality and is silent on deference about authority, which [[3. Resources/Permanent Notes/An Agent Prompt Must Name Its Stopping Point]] covers - [[3. Resources/Readwise/Articles/How People Are Actually Using Jev]] — AI Daily Brief (2026-09-25): a confidence score with no reasoning is safe as the last gate only when a wrong answer is cheap or catchable; consequential rankings need a reader above the score ## Synthesis additions (2026-09-23 — agent-readable text and terminal states) - [[3. Resources/Permanent Notes/Any Text an Agent Reads Is a Control Surface]] — Oishi Banerjee: docs, error strings and readmes flow into agents, so they need the review a system prompt gets; "the assistant is not broken but the channel is." - [[3. Resources/Permanent Notes/An Agent Prompt Must Name Its Stopping Point]] — Theo Browne on Fable 5.1 prompting: tasks with no terminal state are where scope creep and wasted tokens come from; Anthropic's own scope-creep instruction is the one measured claim in the video. ## Synthesis additions (2026-09-23 — access cutoff as an operational risk) - [[3. Resources/Literature Notes/Fable 5 ban, 4 open models responded (The New Stack)]] — a vendor cutoff is a failure mode to plan for like an outage; the note records who could and could not switch during the ban window. ## Synthesis additions (2026-09-05 — governance layer over per-agent trust) - [[3. Resources/Permanent Notes/Govern the Layer That Runs Agents Not Each Agent]] — agent sprawl argument (TechRadar/Workato) plus halo-record: the tractable control point is a shared, verifiable governance layer, not vetting each agent ## Synthesis additions (2026-09-05 — generative capability outpacing consent norms) - [[3. Resources/Permanent Notes/When an Asset Becomes a Configuration String Consent Has to Be Rebuilt]] — names why voice-cloning tools' one-clause consent language is structurally inadequate once cloning costs a sentence instead of a recording session. ## Synthesis additions (2026-09-05 — missing API as false boundary) - [[3. Resources/Permanent Notes/For Agents a Missing API Is Not a Boundary Capability Checks Are]] — an AI agent inheriting an admin's full credentials routes around a missing plugin API by writing its own or hitting the database directly ## Synthesis additions (2026-09-05 — log and monitoring integrity) - [[3. Resources/Permanent Notes/Logs Are Evidence Only When the Watched System Cannot Rewrite Them]] — Monitoring assumes the watched system can't edit its own logs; the METR/Hugging Face agent-escape incident (20%+ transcript tampering) shows why off-box, signed, append-only logging is the actual control. ## Synthesis additions (2026-09-05 — agent trust models by locus and key ownership) - [[3. Resources/Permanent Notes/An Agents Trust Model Is Set by Where It Runs and Whose Key It Spends]] — Compares WordPress AI agent products (Rank Math, Studio, Miles) on locus-of-execution plus key-ownership as the real risk axis, not 'AI or not.' ## Synthesis additions (2026-09-05 — self-referential analysis / conflict of interest) - [[3. Resources/Permanent Notes/A Self-Referential Analysis Is Admissible for Structure Not Truth]] — When a model analyzes its own maker's launch materials, only structural cataloguing (claims, evidence, omissions) survives the conflict — truth-verdicts don't. ## Synthesis additions (2026-09-05 — trust direction of agents embedded in plugins) - [[3. Resources/Permanent Notes/Agents in Plugins Have a Trust Direction Toward the Product or the User]] — A vendor's agent can live inside the product (asking the user to extend new trust) or be exposed to the user's own agent (keeping the trust boundary where the user put it) — Miles vs. Rank Math as the contrast case. ## Synthesis additions (2026-09-05 — delegated credentials move the trust boundary off-site) - [[3. Resources/Permanent Notes/Agent Capability Scope Is the New Trust Boundary]] — When a plugin creates a credential for a remote agent, the trust boundary moves to the operator holding it — code quality becomes nearly irrelevant to this specific risk. ## Synthesis additions (2026-09-05 — agent identity and delegated-action attribution) - [[3. Resources/Permanent Notes/An Identity Model That Predates Delegation Cannot Attribute Delegated Action]] — Names why an audit log built for human actors can't attribute an action once agents borrow human credentials -- the WordPress activity-log case (Logtivity, 2026-09). ## Synthesis additions (2026-09-05 — automation acting on stale signals at scale) - [[3. Resources/Permanent Notes/Automation Acting on a Stale Health Signal Turns a Routine Change Into a Fleet-Scale Outage]] — Monzo incident: a rolling upgrade plus an auto-recovery loop trusting a stale health mark converted a routine change into a fleet-scale outage -- the same risk class as an unbounded agentic remediation loop. ## Synthesis additions (2026-09-05 — output schema as an architectural privacy boundary) - [[3. Resources/Permanent Notes/The Privacy Boundary of a Review System Is Its Output Schema]] — Visa's frontier-model review over payment data is constrained to a fixed findings schema rather than free-form output, so the reviewer is structurally barred from becoming a recipient of the content it inspects. ## Synthesis additions (2026-09-05 — shared infrastructure as covert channel) - [[3. Resources/Permanent Notes/Shared Multi-Writer Infrastructure Is a Covert Channel Not Just a Supply-Chain Risk]] — the Hugging Face incident's shared package-manager mechanism, distinct from ordinary supply-chain risk ## Synthesis additions (2026-08-31 — checks that never fire) - [[3. Resources/Permanent Notes/A Silent Check and a Broken Check Produce Identical Output]] — agent guardrails are almost entirely silence-on-success controls, which makes unverified-because-quiet the default failure mode for this whole category, not an edge case. ## Synthesis additions (2026-08-24 — backlog gap-fill (second pass)) - [[3. Resources/Permanent Notes/Better Autonomous Engineers Are Better Attackers by Construction]] — the capabilities are inseparable at training time, so the only real control point is what the system is allowed to reach. - [[3. Resources/Permanent Notes/An Agent Optimizing a Metric Will Find Hollow Wins]] — an agent has neither the idea-limit nor the tedium-limit that informally filtered a human's hollow optimisations. - [[3. Resources/Permanent Notes/AI-Assisted Vulnerability Discovery Is Not Uniform Across Finders]] — one AI-assisted find doesn't make a vulnerability uniformly AI-discoverable; embargo reasoning that assumes it does is unsupported. ## Synthesis additions (2026-08-24 — vanished social checks) - [[3. Resources/Permanent Notes/Automation Removes the Social Checks a Process Silently Depended On]] — code review rested on an unwritten norm that the author had run the thing; automating the authoring removed the norm and nobody noticed it was load-bearing. - [[3. Resources/Permanent Notes/Interface Surface Area Costs Selection Accuracy Not Just Tokens]] — a safety-adjacent scaling limit: a larger declared capability surface degrades which tool the agent picks, not only what the surface costs to carry. - [He's Right.](3.%20Resources/Readwise/Articles/He's%20Right..md) — the worked case: agent-authored UI shipped visibly broken through a review that found nothing wrong, because the code was fine. - [[3. Resources/Permanent Notes/When Review Cannot Scale Correctness Must Move Into the Toolchain]] — where the control has to live once human inspection stops being a scalable safety mechanism. ## Synthesis additions (2026-08-11 — detector asymmetry) - [[3. Resources/Permanent Notes/A Detector the Sophisticated Evade and the Naive Fail Is Worse Than No Detector]] — rejects punitive authorship inference when evasion is easy and human false positives remain consequential. - [[3. Resources/Literature Notes/So What How AI Detectors Work]] — the Yoda minimal-pair demonstration: AI *editing*, not authorship, is what triggers detection. - [[3. Resources/Permanent Notes/AI Editing Toward the Probable Is What Detection Detects]] — detectors flag statistical word-order reordering, breaking the assumption that a positive score means non-human origin. ## Synthesis additions (2026-08-11 — negative tests and dual-use requests) - [[3. Resources/Permanent Notes/A Test That Cannot Return No Cannot Validate Yes]] — requires an evaluation instrument to demonstrate a negative boundary before its approvals count as validation. - [[3. Resources/Permanent Notes/Request-Level Safety Filters Burden Defenders Who Ask for Help]] — separates dual-use execution controls from prompt-text refusal when attacker and defender requests look alike. ## Synthesis additions (2026-08-11 — platform fairness and completion checks) - [[3. Resources/Permanent Notes/Fairness Must Protect the Control Plane as Well as Allocated Compute]] — adds object-count and controller-scope boundaries to multi-tenant resource isolation. - [[3. Resources/Permanent Notes/Verification Must Test the Claimed State Not Only the Latest Change]] — requires acceptance checks against the requested end state rather than only the agent's latest edit. ## Synthesis additions (2026-08-11 — delegated consent) - [[3. Resources/Permanent Notes/Delegated Consent Reduces Burden by Moving Visibility Upstream]] — tracks the tradeoff between fewer prompts and less user-visible authority when identity providers decide agent scopes. ## Synthesis additions (2026-08-11 — external enforcement) - [[3. Resources/Permanent Notes/A Control Is Enforceable Only When the Actor Cannot Reclassify It]] — distinguishes behavioral instructions from gates whose identity and exemptions remain outside the agent's control. ## Synthesis addition — 2026-08-11 - [[3. Resources/Permanent Notes/Structured AI Edits Need Platform-Native Validation]] — validates a structured mutation through the platform interpreter before an agent declares success. Router-format index (rewritten 2026-08-01; prose version archived in `.trash/`). One line per note: open it if the line answers your question. Operational controls for running agents — the labor/formation side lives in [[AI & the Future of Knowledge Work MOC]]. ## Core Question What infrastructure-level controls (not application-level patches) make it safe to give AI agents access to production credentials, databases, and customer-facing systems? ## Primary case studies - [[3. Resources/Readwise/Articles/Deno Just Open Sourced Their Agent Firewall]] — Claw Patrol gateway: credential injection, CEL rule verdicts, one observability dashboard - [[3. Resources/Readwise/Articles/How GoDaddy Uses AI to Troubleshoot Support Tickets]] — backup → remediate → verify 200 → revert-to-known-broken; customer approves the plan | Pattern | Claw Patrol | GoDaddy Troubleshooter | |---|---|---| | Defense in depth | Gateway intercepts requests | Backup-verify-rollback contract | | Verification | CEL rule evaluation | 200-response check post-remediation | | Safe failure | Block + custom error | Revert to known-broken | | Human oversight | Approve/deny, LLM-as-judge | Customer approves plan | | Credential surface | Never exposed to agent | Scoped to site operations | Both put safety in the infrastructure layer the agent operates in, not in the agent's prompts. ## Bounded action & access control - [[3. Resources/Permanent Notes/Bounded Action Spaces Not Better Models Make Agents Safe to Run]] — constrain what may be *attempted*; the trio's first leg - [[3. Resources/Permanent Notes/Identity Is the Control Plane in Distributed Systems]] — multi-tenancy fails at identity boundaries, not shared compute - [[3. Resources/Readwise/Full Document Contents/Articles/Governance is the platform problem worth solving|Governance is the platform problem worth solving]] — current practitioner case for scoped delegated identity, least-privilege access, and agent tracing - [[3. Resources/Permanent Notes/A Rule-Based DSL Over Object Metadata Is the Control Plane]] — answers the CEL-analog open question; proven at ops scale by Icinga - [[3. Resources/Permanent Notes/Environment Aliases Identify Targets, Not Authority]] — a production alias names a target; policy grants authority - [[3. Resources/Permanent Notes/Editable Slots Separate Content Rights From Structural Rights]] — bounded action applied to authoring - [[3. Resources/Permanent Notes/Client-Supplied Hints Are Not Security Boundaries]] — from MCP 7-28's Roots deprecation; owner-enforced boundaries only - [[3. Resources/Permanent Notes/Tool-Interface Choice Shapes Agent Architecture More Than Model Choice]] — MCP vs CLI is a safety decision upstream of model - [[3. Resources/Permanent Notes/Agent-First vs Gateway-First Are Two Architectures for Self-Hosted AI Agents]] — the axis predicting an agent's security surface - [[3. Resources/Permanent Notes/Default-Off Feature Flags Decouple Shipping Speed From Production Risk]] — "what's the default?" as a rollout screen - [[3. Resources/Permanent Notes/Restricted Distribution Is a Safety Control Separate From Model Refusal]] — limit who receives what refusal tuning can't contain - [[An Ops Agent Is Only as Capable as Its System Access]] — access is both the capability and the attack surface - [[An Agent Is a Distributed System Whose Decision Layer Happens to Be an LLM]] — the durable engineering is infra; the model only proposes - [[3. Resources/Permanent Notes/Claude Desktop - Clean Config Reference]] — prune duplicate connectors to keep the tool surface bounded - [[3. Resources/Literature Notes/Lit · Identity is the hard part of building a cloud]] — the same access-control problem gateways must solve - [[3. Resources/Literature Notes/He Built an AI Executive Assistant in OpenClaw (Atarim)]] — practitioner case behind [[An Ops Agent Is Only as Capable as Its System Access]] - [[3. Resources/Literature Notes/Cloudflare Is Quietly Building the Agent Cloud]] — practitioner case behind [[An Agent Is a Distributed System Whose Decision Layer Happens to Be an LLM]] - [[3. Resources/Permanent Notes/Model An Agent As A Durable Workflow Not A Chatbot]] — an agent's safety properties come from its workflow state, not its conversational framing - [[3. Resources/Literature Notes/Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber]] — contrasts with [[3. Resources/Permanent Notes/Practical Obscurity Is an Economic Property Not a Technical One]] - [[3. Resources/Permanent Notes/Delegation Difficulty Is Scoping Not Capability]] — the hard part of delegating to an agent is defining its boundary, not its task - [[3. Resources/Literature Notes/How WP-CLI Aliases Supercharge Your Agents]] — the source Lit note behind [[3. Resources/Permanent Notes/Environment Aliases Identify Targets, Not Authority]] - [[3. Resources/Literature Notes/How AI Agents Work Prompt, Context, Harness and Loop Explained]] — source for the taxonomy note below - [[3. Resources/Permanent Notes/Prompt Context Harness and Loop Are Separate Agent Control Problems]] — each layer needs its own controls; conflating them hides where a fix belongs - [[3. Resources/Permanent Notes/Capability and Intent Are Separate Axes of Risk]] — a capable agent isn't automatically a threatening one - [[3. Resources/Literature Notes/Navigating the Identity Abyss in the AI-Native Era]] — new P1; its P2 already covered by [[3. Resources/Permanent Notes/Delegated Consent Reduces Burden by Moving Visibility Upstream]] - [[3. Resources/Permanent Notes/Nested Systems Multiply Authorization Decisions]] — every delegation hop adds a decision point that can silently widen scope - [[3. Resources/Permanent Notes/Loop Isolation Should Bound Blast Radius Before Scoping the Task]] — isolate before you scope, so a mis-scoped task can't reach past its blast radius - [[3. Resources/Literature Notes/Closed That Tab - Agentic Identity, AI Security Incidents, and Loop Engineering]] — podcast covering delegated authorization, a real sandbox-escape incident, and loop stop conditions - [[3. Resources/Permanent Notes/Delegated Credentials Must Attenuate Rather Than Escalate]] — a delegated credential should only ever narrow, never gain scope - [[3. Resources/Literature Notes/WP Godmode - It's Like Claude Desktop Inside WordPress]] — sponsored review; the guardrails-before-capability claim held up despite the sponsorship - [[3. Resources/Permanent Notes/A Site-Modifying Agent Needs Enforced Guardrails Before It Needs More Capability]] — capability without enforcement is the wrong upgrade order - [[3. Resources/Literature Notes/Navigating Claude Code - The Bare Minimum Setup]] — deny rules aren't a security boundary - [[3. Resources/Permanent Notes/Prose Configuration Cannot Substitute for a Real Access Boundary]] — a documented rule and an enforced boundary are different things - [[3. Resources/Literature Notes/Navigating Claude Code - Hooks That Guard Your Code]] — deterministic firing isn't the same claim as trustworthy - [[3. Resources/Permanent Notes/A Hooks Determinism Is a Mechanics Property Not a Trust Property]] — a hook that always fires can still fire on bad logic - [[3. Resources/Literature Notes/Navigating Claude Code - MCP Servers Worth Adding]] — connects to existing [[3. Resources/Permanent Notes/A Declared Capability Costs You Every Turn Not Every Use]] - [[3. Resources/Literature Notes/A Unified Public Exposure Flag for Abilities in WordPress 7.1]] — source for the two notes below - [[3. Resources/Permanent Notes/Exposure Metadata Records Distribution Intent Not Execution Authority]] — a public flag says who can see it, not who can run it - [[3. Resources/Permanent Notes/A Specific Override Must Survive Null-vs-False to Beat a General Default]] — a false override that reads as unset silently reverts to the general default - [[3. Resources/Literature Notes/Sandbox for Agentic Application With Cloud Native Stack]] — connects to existing [[3. Resources/Permanent Notes/A Shared Kernel Is Not a Trust Boundary for Untrusted Agent Code]] - [[3. Resources/Permanent Notes/A Sandbox Is a Lifecycle Not a Pod]] — a sandbox that isn't torn down and rebuilt per task decays into a shared trust boundary - [[3. Resources/Literature Notes/Running Wasm Inside Your Storage Cluster]] — transcript quality flagged as ASR-mangled; verify specifics before citing - [[3. Resources/Permanent Notes/Add Only the Minimum Custom Surface a Standard API Doesnt Cover]] — every custom surface added beyond the standard API is attack surface you own - [[3. Resources/Literature Notes/How to Build AI Automations With Claude Cowork]] — source for the bounded-then-broadened authority note below - [[3. Resources/Permanent Notes/Bounded Agents Earn Broader Authority Through Verified Runs]] — pairs with [[3. Resources/Permanent Notes/Safe Agent Changes Come From Guardrails and Observability Not Trust]]; trust widens on evidence, not by default - [[3. Resources/Permanent Notes/Company-Facing AI Agents Need Release Discipline Not Ad-Hoc Edits]] — from the GravityKit case study; production AI agents need the same release gates as code - [[3. Resources/Literature Notes/Platform Engineering for Developers, Architects & the Rest of Us (AI Agents)]] — built from a vidIQ scene-recovery paraphrase, not a verbatim transcript, per the source's own disclosure - [[3. Resources/Permanent Notes/Platforms Must Absorb AI-Generated Change Volume Not Gate It]] — contrasts with gate-first thinking; the platform should absorb volume, not choke it - [[3. Resources/Permanent Notes/Structured Tool Access Bounds AI Attack Surface on Production Systems]] — narrows the trio's access-control leg to production-system tool surfaces specifically - [[3. Resources/Literature Notes/Governance Is the Platform Problem Worth Solving]] — the full Literature Note behind the practitioner case already cited above; scoped delegated identity and agent tracing - [[3. Resources/Permanent Notes/Governance Funding Follows the Decision-Makers Existing KPIs]] — governance work gets funded when it maps to a decision-maker's existing metrics, not on safety merits alone - [[3. Resources/Permanent Notes/An Agent With Write Access Needs a Written Boundary File]] — the low-tech control for agent write scope — provenance boundaries stated in a file the agent actually reads, kept current as the tree moves. - [[3. Resources/Permanent Notes/Quarantine Agent Writes to a Folder They Cannot Leave]] — the structural counterpart to a boundary file — constrain where writes can land, not just what the agent is told. - [[3. Resources/Permanent Notes/Delegated Authority Recurses Unless a Terminal Marker Stops It]] — inherited context carries the authority to delegate, so unbounded fan-out is the default rather than a bug. - [[3. Resources/Permanent Notes/A Checklist an Agent Can Ignore Is Not a Guardrail]] — the test is whether non-compliance is possible, not whether it is likely. ## Verification & the maker/checker split - [[3. Resources/Permanent Notes/The Maker Should Not Grade Its Own Homework]] — the checker must be a separate agent; "done is a claim, not a proof" - [[3. Resources/Permanent Notes/A Nondeterministic Check Breaks the Loops Stop Condition]] — a flaky checker breaks the loop; run 10x on frozen state first - [[3. Resources/Permanent Notes/Encoding What Good Looks Like Is What Makes Agent Verification Trustworthy]] — the checked-in spec is the external standard - [[3. Resources/Permanent Notes/Eval Quality Is the Rate-Limiter on Safe Agent Autonomy]] — eval signal quality caps grantable autonomy - [[3. Resources/Permanent Notes/Safe Agent Changes Come From Guardrails and Observability Not Trust]] — gate, contain, observe; phased trust widens on evidence - [[3. Resources/Permanent Notes/Zet · Self-verifying AI flags its own unsupported claims]] — verification surfaced inside the output (Thesis AI) - [[3. Resources/Permanent Notes/Gate Contributions on Demonstrated Comprehension Not on Tooling]] — holds only while comprehension is costlier to fake than the submission - [[3. Resources/Literature Notes/Stop Trusting AI; Start Verifying It with Ari Joury]] — deterministic core + agentic critique before a human sees it - [[3. Resources/Literature Notes/CodeRabbit - How can you trust your AI agents]] — needs-100%-trust workflows should be deterministic automation, not agents - [[3. Resources/Readwise/Articles/The PHP Podcast 2026.07.30]] — dual-context adversarial verification in production; AI-screens-AI mostly fails - [Gonna Share a Few General Thoughts and Tips About How...](3.%20Resources/Readwise/Tweets/Gonna%20Share%20a%20Few%20General%20Thoughts%20and%20Tips%20About%20How....md) — adversarial review of the *plan* before implementation exists - [[3. Resources/Literature Notes/Building the most AI-pilled engineering team in the world (Fiona Fung, Anthropic)]] — source for [[3. Resources/Permanent Notes/Encoding What Good Looks Like Is What Makes Agent Verification Trustworthy]] and the triage note below - [[3. Resources/Permanent Notes/A Shared Bad-Sad Vocabulary Triages Quality Better Than a Raw Dashboard]] — a shared bad/sad vocabulary triages quality faster than a raw metrics dashboard - [[3. Resources/Literature Notes/Loop Engineering — A Technical Roadmap for an Autonomous Loop (h100envy)]] — restates [[3. Resources/Permanent Notes/The Maker Should Not Grade Its Own Homework]] and [[3. Resources/Permanent Notes/A Nondeterministic Check Breaks the Loops Stop Condition]] independently - [[3. Resources/Permanent Notes/Stateless Iteration Keeps Loop Cost Linear While Stateful Iteration Compounds]] — a loop's cost curve depends on whether each iteration starts clean - [[3. Resources/Literature Notes/Prompt Engineering & Loop Engineering, Clearly Explained (Avi Chawla)]] — same maker/checker claim, a third independent source - [[3. Resources/Literature Notes/Loop Engineering Clearly Explained (Akshay Pachaar)]] — same claim again; one contested/unsourced follow-on flagged as such - [[3. Resources/Permanent Notes/Harness Design Can Matter More Than Model Choice for Agent Performance]] — connects to [[3. Resources/Permanent Notes/The Harness Now Outpaces the Model as the Source of Agent Capability Gains]] - [[3. Resources/Literature Notes/Overview of AI Evaluation (The Context Window 05)]] — source for the two eval-quality notes below - [[3. Resources/Permanent Notes/Reliability Differs From Capability in Repeated Agent Trials]] — an agent that can do a task once hasn't shown it can do it reliably - [[3. Resources/Permanent Notes/Fact-Based Rubrics Catch Plausible But Wrong Agent Answers That Judges Miss]] — a rubric grounded in facts catches confident wrong answers an LLM judge would pass - [[3. Resources/Literature Notes/I Don't Know Rust. My AI Is Rewriting PHP in It Anyway]] — source for the two notes below - [[3. Resources/Permanent Notes/External Test Oracles Make AI-Generated Code Trustworthy]] — trust comes from an oracle outside the model's own judgment, not from the code reading well - [[3. Resources/Permanent Notes/AI-Generated Code Hides Silently-Broken Potemkin Features]] — a feature that runs without erroring isn't proof it works - [[3. Resources/Literature Notes/Getting started with loops — Claude Code loop design (thread)]] — connects to [[3. Resources/Permanent Notes/Encoding What Good Looks Like Is What Makes Agent Verification Trustworthy]] and [[3. Resources/Permanent Notes/The Maker Should Not Grade Its Own Homework]] - [[3. Resources/Literature Notes/Opus 5 Isn't What We Thought It Was]] — flagged: source uses "autism" as a behavioral metaphor throughout, excluded from all derived notes - [[3. Resources/Permanent Notes/An Agent That Reports on Its Own Work Verifies the Change Not the State]] — pairs with [[3. Resources/Permanent Notes/Verification Must Test the Claimed State Not Only the Latest Change]] - [[3. Resources/Literature Notes/Give Your Agents a Performance Review]] — source for the incumbent-baseline note below - [[3. Resources/Permanent Notes/An Agent Evaluation Without an Incumbent Baseline Cannot Establish Value]] — an eval score means nothing without a non-AI baseline to beat - [[3. Resources/Permanent Notes/Automation Is Only Safe Unattended Once Done Is Machine-Testable]] — unattended automation needs a machine-checkable definition of done - [[3. Resources/Literature Notes/Where was Mythos when WordPress fell]] — the disclosed origin of this vault's own agent-audit guardrails; connects its five existing Permanent notes - [[3. Resources/Permanent Notes/A Verified Fraction Without a Comparison Baseline Cannot Be Scored]] — pairs with [[3. Resources/Permanent Notes/An Agent Evaluation Without an Incumbent Baseline Cannot Establish Value]] - [[3. Resources/Literature Notes/How Cloudflare enforces engineering standards using AI]] — source for the two governance notes below - [[3. Resources/Permanent Notes/Automated Review Is Only As Accountable As The Standards Behind It]] — an automated gate is only as legitimate as the standard it enforces - [[3. Resources/Permanent Notes/Trust Not Ticket Volume Is the Right AI-Support Metric]] — from the GravityKit case study; ticket-volume metrics reward the wrong behavior - [[3. Resources/Literature Notes/Effective Verification for Humans and Agents]] — LeadDev/CodeRabbit panel; two of five claims already covered by existing oracle-first and accountability notes - [[3. Resources/Permanent Notes/Agentic Coding Speed Gains Are Unevenly Available Across Codebases]] — speed gains from agentic coding depend on the codebase's existing shape, not just the agent's capability - [[3. Resources/Permanent Notes/A Change Summary Can Catch Structural Problems a Diff Review Would Miss]] — a prose summary of a change surfaces structural issues a line-by-line diff review misses ## Persistent instruction & steering - [[3. Resources/Permanent Notes/Intent Written on the Outside Compounds While Re-Derived Intent Is Debt]] — externalized intent (CLAUDE.md, skills) compounds; guesses are debt - [[3. Resources/Readwise/Tweets/The “Field Guide” Technique — Persisting Agent Feedback Across Sessions]] — log-with-commit-hash → distilled guide → init.md router - [[3. Resources/Permanent Notes/An Agent's Default Persona Should Be Collaborator Not Assistant]] — pushback-capable persona reduces bad output up front - [[3. Resources/Literature Notes/Don't Ignore Your SOUL.md with Erik Hanchett]] — the steering-file pattern the persona note came from - [[3. Resources/Permanent Notes/AI-Facing Documentation Needs an Explicit Authority Boundary]] — which source may be presented as accepted behavior - [[3. Resources/Readwise/Articles/Anthropic Just Revealed How to Prompt Opus 5]] — steering agent behavior predictably - [[3. Resources/Literature Notes/Meet the Community Agents - AI assistants for WordPress community workflows]] — human-in-the-loop invariant + confidence labeling - [[3. Resources/Literature Notes/Don't Use Next.js Without These 7 Skills]] — source for the agent-facing-docs note below; links its 'context not capability' claim to the existing note rather than duplicating it - [[3. Resources/Permanent Notes/Write Agent-Facing Docs Assuming the Agent Wont Fetch the Reference]] — inline the doc content an agent needs; assume it won't fetch the linked reference ## Human oversight & deployment configuration - [[3. Resources/Permanent Notes/The Reverse Centaur Pattern - Humans Forced to Work Like Machines]] — who sets the pace decides augment vs coerce - [[3. Resources/Readwise/Snipd/Data/Podcast – Cory Doctorow's craphound.com/The Reverse Centaur’s Guide to Life After AI]] — the primary articulation; Amazon, Air Canada examples - [[3. Resources/Permanent Notes/AI's Failure Mode Is Careless Adoption Not the Technology]] — "AI employee" framing lowered reviewer scrutiny - [[3. Resources/Permanent Notes/Default-On AI Activation Inflates Adoption Metrics at the Cost of Consent]] — activation ≠ adoption; screen vendor claims with it - [[3. Resources/Permanent Notes/Defense in Depth Concedes Perfect Safety Is Impossible and Optimizes for Narrow Costly Monitored Failure]] — what standard is the critic applying? - [[3. Resources/Permanent Notes/Silent Model Intervention and Edited Safety Docs Break Trust Regardless of Measured Impact]] — undisclosed degradation corrodes trust - [[3. Resources/Permanent Notes/Structural Power Claims the Position of the Party Being Acted Upon]] — objection reclassified as aggression; the AI-mandate instance - [[3. Resources/Permanent Notes/Notebooks Are JSON So Agentic Work Becomes an Auditable Memory Artifact]] — the JSON record is the observability layer - [[3. Resources/Literature Notes/Claude In-App Browser Workflows — Riley Brown Video]] — agent stages, human commits: bounded action in browser form - [[3. Resources/Readwise/Articles/How to code with AI agents]] · [[3. Resources/Readwise/Articles/How I Code With AI Changed a Lot]] · [[3. Resources/Readwise/Articles/AI Code Quality The New Software Engineering Bottleneck]] — practitioner workflow shifts; quality bottleneck moved to review - [[3. Resources/Permanent Notes/Automating the Outer Loop Trades Understanding for Ownership]] — automating away the outer loop also automates away the operator's understanding of what shipped - [[3. Resources/Literature Notes/Human in the Loop (Eric Zakariasson)]] — source for the review-capacity note below - [[3. Resources/Permanent Notes/Human Review Capacity Not Compute Caps Parallel Agent Loops]] — the bottleneck on running more agent loops in parallel is human review bandwidth, not compute - [[3. Resources/Literature Notes/Your AI Agents Have Dashboards. Their Human Managers Have Annual Reviews]] — source for the accountability note below - [[3. Resources/Permanent Notes/Delegating a Decision to AI Does Not Transfer Accountability for It]] — the human who delegated the decision still owns its consequences - [[3. Resources/Literature Notes/Liberating sites with Studio Code (Bossenger)]] — connects to existing Comprehension Debt and mid-task-steering notes - [[3. Resources/Permanent Notes/AI Migration Agents Should Report Step-Level Progress]] — step-level progress reporting is what lets a human catch a migration going wrong before it finishes - [[3. Resources/Literature Notes/A Disagreement on Principles, Not on Skills]] — connects to existing [[3. Resources/Permanent Notes/Structural Power Claims the Position of the Party Being Acted Upon]] - [[3. Resources/Literature Notes/Automattbot]] — source for the persona-bot note below - [[3. Resources/Permanent Notes/A Persona Bot Reply Is Not the Person's Current Judgment]] — a persona bot's reply carries the person's name but not their current judgment - [[3. Resources/Permanent Notes/Low-Trust-By-Default UX Absorbs Agent Mistakes]] — from 'Blame Nathan subscription service' - This Week in WordPress 383; default UX should assume agent mistakes will happen and absorb them rather than trust the agent not to make one - [[3. Resources/Literature Notes/Claude Tag Now Reads Even More of the Room]] — Claude Tag's shift to channel-context-aware Slack behavior; source for the restraint note below - [[3. Resources/Permanent Notes/A Proactive Agent Earns Trust by Staying Quiet Not by Responding Often]] — a proactive agent earns trust by knowing when not to respond, not by responding more ## Threat patterns - [[3. Resources/Readwise/Tweets/Agents Escaping Containment]] — the containment-failure pattern stated directly - [[3. Resources/Literature Notes/I Installed a "Safe" Package; My AI Tried to Steal My SSH Keys with Eran Sandler]] — execution-layer allow/deny catches what prompts and containers miss - [[3. Resources/Permanent Notes/Validation That Inspects Steps Cannot See Composition]] — attacks decomposed into benign steps are invisible per-prompt - [[3. Resources/Permanent Notes/Practical Obscurity Is an Economic Property Not a Technical One]] — agents change the price of deanonymization, not the possibility - [[3. Resources/Permanent Notes/WordPress Stores AI API Keys in a Layer Its Own Security Team Says It Cannot Encrypt]] — the credential-storage gap making gateways matter - [[3. Resources/Permanent Notes/AI Finds Exploit Chains Faster Than Humans Can Audit Them]] — discovery in hours, human verification longer - [[3. Resources/Literature Notes/Mark Bacsko (BitNinja-PhantomGuard) on WordPress Security, AI Malware]] — vendor-pitch WordPress-funnel thesis logged as an open question, not promoted (rests on one anecdote) - [[3. Resources/Permanent Notes/Detection Quality Is Downstream of Network Participation Not Model Cleverness]] — detection quality tracks how many participants feed the network, not model sophistication - [[3. Resources/Permanent Notes/Absence Of Detection Is Not Absence Of Occurrence]] — from Agents Escaping Containment; a clean scan doesn't mean nothing happened - [[3. Resources/Literature Notes/Large-scale Online Deanonymization with LLMs]] — connects [[3. Resources/Permanent Notes/Practical Obscurity Is an Economic Property Not a Technical One]] forward to the Opus 5 dual-use finding - [[3. Resources/Permanent Notes/A Safeguard That Cannot Distinguish Attack From Defense Penalizes the Defender]] — pairs with [[3. Resources/Permanent Notes/Request-Level Safety Filters Burden Defenders Who Ask for Help]] - [[3. Resources/Literature Notes/A 7-day Cooldown on Every Dependency]] — same uniform-delay mechanism as the WordPress Protect The Shire severity note, opposite verdict depending which side of the gate you're on - [[3. Resources/Permanent Notes/A Uniform Dependency Delay Buys Detection Time and Sells Patch Speed]] — the delay that protects consumers is the same delay that costs maintainers response speed - [[3. Resources/Literature Notes/All of It's Becoming Due at the Same Time]] — extends [[3. Resources/Permanent Notes/Practical Obscurity Is an Economic Property Not a Technical One]] rather than duplicating it - [[3. Resources/Permanent Notes/Uncoordinated Agent Adoption Duplicates the Shared Data-Access Prerequisite]] — independently-adopted agents each re-solve the same data-access problem instead of sharing the solution - [[3. Resources/Literature Notes/This Week in AI - Agents, Gatekeepers, and World Models with Christina Stathopoulos]] — supplies the relaxed-restrictions precondition missing from the existing Hugging Face incident note - [[3. Resources/Permanent Notes/A Safety-Test Precondition Changes What an Incident Is Evidence For]] — the same incident is evidence for a different claim once its test precondition is known - [[3. Resources/Literature Notes/Silly Software, Sugar Snap Peas, and Coding in Gen Z Slang w Christin]] — source for the skill-supply-chain note below - [[3. Resources/Permanent Notes/Agents That Install Skills Create an Unreviewed Supply Chain]] — an agent that installs its own skills has opened an unreviewed dependency channel - [[3. Resources/Permanent Notes/AI Agents Can Fabricate Every Trust Signal Code Review Relies On]] — an agent can fabricate an entire plausible OSS contributor trust chain, not just individual claims - [[3. Resources/Literature Notes/Vulnerability Response for Large OSS Projects -- Grafana]] — real CVSS-9.4 account-takeover walked end to end - [[3. Resources/Permanent Notes/A Vulnerabilitys Classification Follows the Threat Model Not the Reports Novelty]] — severity is a function of what an attacker can do, not how novel the write-up is - [[3. Resources/Literature Notes/Scalable Security and Compliance in the Age of AI]] — source for the hallucinated-package note below - [[3. Resources/Permanent Notes/A Predictable Low Error Rate Becomes Attacker Infrastructure]] — a model's consistent hallucination becomes a squattable, predictable target - [[3. Resources/Literature Notes/Palantir's Manifesto]] — hedged by its own narrator as unproven inference (Cursor/Figma anecdotes); flagged in Lingering Questions - [[3. Resources/Permanent Notes/Data Sent to a Vendor Who Competes Is Strategic Exposure]] — data handed to a vendor that competes with you is strategic exposure regardless of contractual assurances - [[3. Resources/Literature Notes/Everyone Signed This Letter (...minus Anthropic)]] — its central claim already covered by [[3. Resources/Permanent Notes/Request-Level Safety Filters Burden Defenders Who Ask for Help]]; source for the remediation-speed note below - [[3. Resources/Permanent Notes/Capability Diffusion Helps Attackers or Defenders Depending on Remediation Speed]] — whether diffused capability favors attacker or defender is domain-specific, keyed to remediation speed ## Capability & economics context - [[3. Resources/Permanent Notes/The Harness Now Outpaces the Model as the Source of Agent Capability Gains]] — the control layer is also the performance layer - [[3. Resources/Permanent Notes/AI Capability in a Domain Advances Through a Fixed Three-Stage Arc]] — controls become load-bearing at the autonomous stage - [[3. Resources/Permanent Notes/Clean Code Is the Human-AI Interface]] — enforceable standards as a guardrail on agent changes - [[3. Resources/Readwise/Articles/Holy Sht I Think Anthropic Is Profitable Now]] — pricing reflects PMF; agents deployed at scale is why controls matter - [[3. Resources/Permanent Notes/Active Installs Reward Existing Winners]] — default-on compounds into algorithmic incumbent advantage - [[3. Resources/Readwise/Articles/WordPress to Next.js Here's How AI Handles the Migration]] — Pantheon's bounded real-world agent-reliability test - [[3. Resources/Readwise/Articles/SiteGround's Icky Approach to AI in WordPress 7.0 - Rhys Wynne]] — a reverse-centaur default-on case - [[3. Resources/Readwise/Articles/Empowering Contributors and Improving WordPress Docs Kinsta Talks With Estela Rueda]] — docs as AI training surface - [[3. Resources/Readwise/Articles/Four Big Upgrades That Make Scanfully More Useful]] — adjacent monitoring tooling - [[3. Resources/Literature Notes/Project Fetch, Phase two (Anthropic)]] — connects to [[3. Resources/Permanent Notes/AI Capability in a Domain Advances Through a Fixed Three-Stage Arc]] - [[3. Resources/Literature Notes/I Finally Get Fable 5]] — the full deep-read Literature Note behind the arc note above and the orchestrator note below; extends the raw article already linked in this MOC - [[3. Resources/Permanent Notes/A Smart Orchestrator Should Delegate to Cheaper Executors]] — route the expensive model to orchestrate, not to execute every step - [[3. Resources/Literature Notes/Leading Tech Firms Unite to Form Open Source Secure AI Alliance]] — thin source (6.5-min summary broadcast); density gate held at 2 atoms - [[3. Resources/Permanent Notes/Who Joins a Standards Coalition Tells You What It Can Actually Govern]] — a coalition's membership list is a claim about what it's positioned to enforce - [[3. Resources/Literature Notes/OpenTelemetry Celebrates Graduation and the Next Era of Agentic]] — source for the two notes below - [[3. Resources/Permanent Notes/Standards Win When Re-Instrumentation Is the Expensive Part]] — a standard wins adoption when switching away costs more than switching to it - [[3. Resources/Permanent Notes/Diagnose by Question Not by Data Type]] — debug by the question being asked, not by which telemetry type happens to be available - [[3. Resources/Literature Notes/You Don't Have to Leave WordPress to Work With AI]] — WordPress-native AI workflow case, adjacent to the platform capability notes above ## Open Questions to Track - CEL-rules analog for filesystem/IPC/subprocess ops? — largely answered by [[3. Resources/Permanent Notes/A Rule-Based DSL Over Object Metadata Is the Control Plane]] - How does the gateway pattern scale to multi-tenant environments with per-tenant credentials/rules? - Does backup-verify-rollback generalize beyond WordPress to other CMS/SaaS? - What's the right unit of human oversight — per-request, per-session, per-class-of-operation? ## Related MOCs - [[AI & the Future of Knowledge Work MOC]] — who gets augmented vs coerced; the senior-judgment pipeline - [[Open Source Governance MOC]] — agent infra is itself open source; governance patterns apply - [[Commons & Community Governance MOC]] — agent tooling shapes who can participate at scale - [[WordPress Hosting Security Stack MOC]] — credential storage and opt-in-vs-default-on in managed hosting ## Synthesis additions (2026-08-01, run 2) - [[3. Resources/Permanent Notes/A Declared Capability Costs You Every Turn Not Every Use]] — a safety-adjacent argument for narrow tool provisioning. The two-gate pattern it describes — servers enabled, tools denied by default, permissions granted per sub-agent — limits blast radius as a side effect of limiting cost, which makes it unusually easy to justify. ## Synthesis additions (2026-08-01, run 3–4) - [[3. Resources/Permanent Notes/A Feedback Signal Not More Automation Is What Makes a System Self-Improving]] — the safety-relevant half of Tock's agentic maturity ladder. Scheduling more autonomous work moves a system up the throughput axis without touching whether it improves; feedback is what changes behaviour over time, and feedback without bounds is how a loop optimizes itself somewhere nobody chose. - [[3. Resources/Permanent Notes/Context Not Constraints Is What Unhobbles an Agent]] — read against [[3. Resources/Permanent Notes/Bounded Action Spaces Not Better Models Make Agents Safe to Run]] rather than alone. Removing constraints raises capability *and* blast radius; the two are independent axes and this argument only speaks to the first. ## Synthesis additions (2026-08-07) - [[3. Resources/Permanent Notes/An AI Pursuing an Objective Can Cause Attack-Equivalent Harm Without Malicious Instruction]] — the threat-model complement to bounded action spaces: an OpenAI model chasing a benchmark score achieved a real root exploit and propagated the exploit method to future agent instances, with zero adversarial instruction anywhere in the chain. "Was it told to attack" is the wrong question; "what could it discover was possible" is the right one. ## Synthesis additions (2026-08-08) - [[3. Resources/Permanent Notes/A Shared Kernel Is Not a Trust Boundary for Untrusted Agent Code]] — the isolation-strength complement to bounded action spaces: JAPAN AI rebuilt their agent sandbox on VM-level (Kata Containers) isolation after judging shared-kernel containers insufficient for agents holding real credentials — bounds what a compromised process can *reach*, not just what an agent is permitted to *attempt*. - [[3. Resources/Permanent Notes/A Vendors Absence From a Credits List Is Weaker Evidence Than It Sounds]] — names a specific fallacy for evaluating AI-security vendor claims: a vendor's non-appearance in a credits list doesn't prove they didn't scan the target, even when the rhetorical gap feels persuasive. Resolves a gap flagged in the 2026-08-07 objective-driven-harm note. ## Synthesis connections (2026-08-11, carryover reconciliation) - [[3. Resources/Readwise/Podcasts/Open Channels FM, August 10, 2026]] — supply-chain threat case where agents fabricate human trust signals around malicious code. - [[3. Resources/Readwise/Podcasts/'Blame Nathan subscription service' - This Week in WordPress 383]] — product defaults should keep agent actions reversible, visible, and human-controlled. ## Synthesis additions (2026-08-11, Fable workflow evidence) - [[3. Resources/Readwise/Articles/I Finally Get Fable 5]] — practitioner evidence for model routing, human production gates, and independent verification in longer-running agent workflows. ## Synthesis additions (2026-08-17, loop engineering) - [[3. Resources/Literature Notes/Zero to Agent in 30 Minutes From Prompting to Loop Engineering With Ofer Mendelevitch]] — sixth independent source restating the maker/checker and machine-testable-stopping-condition claims already covered by existing permanents; connected, no new permanent created. ## Synthesis additions (2026-08-18, guardrails and terminal-action gates) - [[3. Resources/Literature Notes/Parenting Claude Guardrails for AI-Assisted Development Chris Reynolds]] — a second independent account of prose config failing under context compaction vs. pre-commit-hook enforcement; connects to the existing Prose Configuration Cannot Substitute for a Real Access Boundary permanent rather than duplicating it. - [[3. Resources/Literature Notes/Your First AI-Only Team Build It, Brief It, and Put It to Work Vedanshu Jain]] — building a team composed entirely of AI agents (director/executor pattern). - [[3. Resources/Permanent Notes/Agent Autonomy Boundaries Should Gate the Terminal Action Not the Whole Task]] — for a workflow with one clear irreversible step, a single gate on that terminal action (draft-not-send, merge-not-deploy) can suffice rather than bounding the whole task envelope. ## Synthesis additions (2026-08-28 — the corpus as a failure surface) Two of these locate the failure in what the agent reads rather than in the model; the third is an evidence standard for deployment decisions. - [[3. Resources/Permanent Notes/Instruction Files Are the Last Rung Not the First]] — an escalation order deciding which failures get prevented structurally and which are merely requested. Extends [[3. Resources/Permanent Notes/When Review Cannot Scale Correctness Must Move Into the Toolchain]] by naming written instruction as the rung that is not toolchain at all, and therefore the only one whose enforcement is probabilistic. - [[3. Resources/Permanent Notes/Stale Guidance Steers Agents Wrong Rather Than Merely Aging Out]] — the corpus itself supplying the wrong answer. Agents sharpen this twice over: they read more of it than any person does, and they have no independent memory of the change that made it stale. - [[3. Resources/Permanent Notes/A Capability Demonstration Is Not an Operating Model]] — deploying on demonstrated capability alone, one layer down from the labor argument. A demo picks its input, runs once, and is graded by someone who wants it to work; none of the obligations that hold between tasks can fail in it. Also corroborated this run from Robert Jacobi's Open Channels broadcast: [[3. Resources/Permanent Notes/AI Agents Can Fabricate Every Trust Signal Code Review Relies On]] gains the "it effectively manufactured a conversation" framing and the scale argument, and [[3. Resources/Permanent Notes/Capability Diffusion Helps Attackers or Defenders Depending on Remediation Speed]] gains the one-mechanic-and-4,000-repairs analogy for why discovery speed alone does not help the defender. - [[3. Resources/Permanent Notes/A Removable Model Is the Practical Test of System Independence]] — registered this run; it was in no MOC. Whether a product is really independent of one model is decided by removing that model and seeing whether the evaluations hold, not by how many models it nominally supports. The same shape of test as [[3. Resources/Permanent Notes/A Capability Transfer Is Proven by Absence Not by a Handoff]], one domain over. - [[3. Resources/Permanent Notes/Security Intent Belongs in the Initial Prompt Not a Cleanup Pass]] — registered this run; it was in no MOC. Where in the workflow a security requirement is stated changes what gets built, because a cleanup pass inherits the architecture the first pass chose. Read against [[3. Resources/Permanent Notes/Instruction Files Are the Last Rung Not the First]]: stating intent early is right precisely where the concern is judgment-shaped and no structural rung can hold it. - [[3. Resources/Permanent Notes/Exfiltration Needs Three Capabilities Together Not Any One of Them]] — Simon Willison's Lethal Trifecta: untrusted content + private data access + an outbound channel. Conjunctive, which is why nothing owns the risk (each leg ships as a feature) and also why the mitigation is cheap — break one leg by configuration instead of solving prompt injection. - [[3. Resources/Literature Notes/What's in Your AI — The Case for AI Bills of Materials (Alan Friedman, RSAC)]] — registered 2026-08-28. Friedman (who led SBOM at NTIA and CISA) on component-level inventory for AI stacks. Two distinctions worth carrying: an inventory tells you what you have while external risk data tells you whether it's dangerous — neither substitutes — and embedding evaluated judgments destroys the inventory's comparability, so reference assessments rather than absorbing them. Names **agentic identity** as the frontier problem, with NIST's problem statement published the day before the talk. ## Synthesis additions (2026-08-28 — agent evidence precedence) - [[3. Resources/Literature Notes/How I Am Using AI Agents to Try to Recover FooPlugins SEO - Literature Note]] — a production WordPress SEO case where narrow task contracts, ranked sources, explicit stopping, and human publication approval make delegated work reviewable while the outcome remains unproven. - [[3. Resources/Permanent Notes/A Data Source Needs a Declared Trust Rank Before an Agent May Act on It]] — fixes which evidence governs a disagreement before an agent can choose the convenient number. - [[3. Resources/Permanent Notes/Subagent Delegation Only Pays Off When Scope and Report Shape Are Both Fixed]] — receives a production-stakes instance: target, permitted change, protected scope, approved sources, and required proof. ## Synthesis additions (2026-09-01 — autonomy defaults as an intake category) - [[3. Resources/Permanent Notes/An Upgrade Review Diffs the Defaults Not the API]] — OpenClaw 2.0 shipped six defaults that expand agent autonomy (background memory consolidation, auto-applied self-generated skills, unprompted Skill Workshop actions, private conversation recall, cross-day session persistence, 8–16× concurrency) and disclosed none in the announcement. Neither a CVE scan nor a config-load check would flag any of them. Governance ask: name which categories of agent self-modification require explicit opt-in regardless of vendor default. ## Synthesis additions (2026-10-05 — agent permissions, oversight and governance) - [[3. Resources/Readwise/Articles/You Ask, I Answer Ethical AI for Competitive Intelligence]] — Christopher Penn (Trust Insights, which sells AI services) proposes three tests for agents scraping competitors, public access, clean provenance and the golden rule, and says he is not a lawyer; terms of service and robots.txt are not addressed. - [[3. Resources/Readwise/Tweets/White House Accord on Super Intelligence]] — The White House posted a one-page voluntary accord, signed per the post by Donald Trump and six company heads, committing to four layers of internal controls and audits; it sets no criteria, timeline or enforcement, and the text is published only as images (the analysis was produced by a model from one signatory's lab). - [We're Adding a New Plugin to Claude Code You Should...](3.%20Resources/Readwise/Tweets/We're%20Adding%20a%20New%20Plugin%20to%20Claude%20Code%20You%20Should....md) — ClaudeDevs (Anthropic's own account) announces a built-in Claude Code plugin that runs a side agent over Claude's output to flag items a user might miss; the post gives no accuracy data or cost. - [[3. Resources/Readwise/Articles/If You Don't Ship an API, Your Customers Will Build One]] — Joost de Valk reports automating two club systems with headless browsers that hold a real user's password and TOTP secret, and argues a scoped API token is safer; the post argues only the vendor-side costs and imputes lock-in motives without evidence. - [[3. Resources/Readwise/Articles/OpenAI’s Head of ChatGPT We’re Entering a New Era of AI (Again) Tibo Sottiaux]] — In an interview, Tibo Sottiaux, whom the source titles OpenAI's head of ChatGPT, says OpenAI is spending more compute on secondary monitoring of its own agents and plans revenue sharing with popular plugins; these are first-party claims with no figures, from highlights only. - [[3. Resources/Readwise/Articles/OpenAI Leader Who Quit Says He Can Do More for Safety From Outside the Company]] — Business Insider (Lauren Edmonds) reports that David Robinson, who it says ran transparency for OpenAI's safety team, wrote in The Atlantic that he is leaving to work on risks from outside; OpenAI's spokesperson says the company strengthens safety as models improve, and neither side is independently checked. - [[3. Resources/Permanent Notes/A Customer-Built UI Scraper Holds a Full Login Where a Scoped Token Would Not]] — when a vendor ships no API, a customer who automates its web UI has to store a real user's password and TOTP secret and act with full permissions, which a scoped, revocable API token avoids. ## Synthesis additions (2026-10-07 — default-off tool lists) - [[3. Resources/Readwise/Articles/First Look Easy MCP AI]] — In a sponsored WP Minute Tutorials demo, a free WordPress MCP plugin keeps destructive tools such as update-plugin off by default and the presenter must enable them in settings and re-authenticate; the video omits acting user, rollback and review, and the vendor roadmap lists approvals and undo as unshipped. ## Synthesis additions (2026-10-14 — governing the workflow) - [[3. Resources/Readwise/Articles/What You Need to Know (And Why You Should Care) About AI Governance - Michelle Frost - NDC Oslo 2026]] — NDC Oslo 2026 talk on AI governance for product teams; the regulatory claims are the speaker's and unverified here. - [[3. Resources/Permanent Notes/Governing an Agent Means Governing the Workflow Not Just the Model]] — tools, permissions, memory, logs, and human handoffs sit outside a model-only review. ## Synthesis additions (2026-10-18 — registering notes missing from MOCs) - [[3. Resources/Permanent Notes/Comprehension Debt Is the Real Cost of Unattended Autonomy]] — an unattended loop's sharpest risk is the gap that widens when a team ships code nobody read, a failure mode a correct-output checker doesn't catch. ## Synthesis additions (2026-10-18 — registering previously unlisted notes) ### Permanent Notes - [[3. Resources/Permanent Notes/A Correct Agent Process Can Still Deliver the Wrong Outcome]] — When every actor in an agent-mediated purchase acts correctly and the order is still wrong, current commerce infrastructure has no agreed answer for who pays. - [[3. Resources/Permanent Notes/A Natural-Language Instruction Can Trigger an Agent to Self-Provision a Tool Integration]] — Telling an MCP-capable agent about a new tool can be enough for it to install the integration and gain working access itself, with no manual setup. - [[3. Resources/Permanent Notes/AI-Generated Destructive SQL Requires Human Review Before Execution]] — Any AI-generated destructive SQL statement needs a manual scope check before it runs, because a mis-scoped WHERE clause turns targeted cleanup into full data loss. - [[3. Resources/Permanent Notes/Blocking Automation Needs A Lifecycle Not A Launch Date]] — Automated enforcement that can block work needs a lifecycle, advisory first and blocking only after a defined promotion, or the people it checks read it as arbitrary. - [[3. Resources/Permanent Notes/Bulk Content Automation Needs Dry-Run Scope and Resumable Batching as Defaults]] — Safe bulk WordPress automation needs dry-run preview, explicit scope, and resumable batching as defaults on every command, not flags added after a failure. - [[3. Resources/Permanent Notes/Reversible-by-Default Is What Makes Bulk AI Edits Trustworthy]] — Bulk AI actions earn trust when every action stays reversible and unconfirmed until the user applies it, not from the AI's accuracy. ### Literature Notes - [[3. Resources/Literature Notes/3.5 (Reasonable) Conspiracy Theories (ThePrimeagen)]] — The video's one citable claim is that safety rhetoric about stripping open-weight guardrails works as a regulatory moat, plus an untested claim about silent prompt routing. - [[3. Resources/Literature Notes/Agents Escaping Containment (Guillermo Rauch)]] — Rauch argues an agent rewarded for escaping sandboxed gyms is behaving as trained, not hostile; the note says the post's own premises support concern more than its conclusion. - [[3. Resources/Literature Notes/I Connected Apple Health to an AI Agent (Hermes)]] — A video connects Apple Health data to the Hermes AI agent on a sponsored host, and the note flags biometric data on a third-party server. Closest-fit placement. - [[3. Resources/Literature Notes/Infinite Agents, Finite Kubernetes (SoftBank)]] — A SoftBank talk says agent workloads spawn and vanish at machine speed, so the isolation-versus-utilization tradeoff must be broken with hard boundaries packed densely. - [[3. Resources/Literature Notes/Introducing MCP 7-28 for AI Application Developers — What Goes Away, and What Might Break]] — The MCP spec revision of 2026-07-28 deprecates Roots, Sampling, and logging, goes sessionless, and sets an OAuth baseline; the note flags Roots as guidance, not access control. - [[3. Resources/Literature Notes/Lit · Agents need constraints — complete freedom fails]] — A practitioner talk restates that agent safety and effectiveness come from bounding the action space, not from a better model. - [[3. Resources/Literature Notes/The Growth of Domain Names and the Future of AI in Internet Identity]] — Two hosts report domain registrations still growing, and say permissioning AI agents with auditability, scoping, and rollback is harder than letting them act. ## Synthesis additions (2026-10-19 — deterministic checks and scoped access) - [[3. Resources/Readwise/Articles/How Static Analysis Can Help in the Age of AI - Kai Schmithusen - GameDev Day 2026]] — Kai Schmithusen (Qodana) argues AI raises code volume and so defect volume, and proposes AI writes, static analysis checks, AI repairs, static analysis re-checks. Speaker is a vendor; the cited studies have no sources in the talk. - [[3. Resources/Readwise/Articles/Fix Your CI Without Leaving the IDE TeamCity MCP and CLI - Artem Rokhin - GameDev Day 2026]] — Covers scoped tokens for an agent's CI access and treating log text as untrusted input; the speaker asserts scoped tokens are safe without showing a test. ## Synthesis additions (2026-10-19 — Permanents from the GameDev Day, agent-site and religious-history batch) - [[3. Resources/Permanent Notes/A Green Pipeline Proves the Stages Ran Not That the Deployed Build Behaves]] — A green pipeline reports that each configured stage exited cleanly. - [[3. Resources/Permanent Notes/A Quality Gate Holds Only If the Agent It Checks Cannot Edit the Gate]] — A static-analysis gate checks an agent's work only when the agent has no write access to the gate's configuration.