Design essays

Fewer posts. Sharper arguments.

The blog is not a changelog and not a keyword warehouse. These essays explain the design decisions that stay true when commands and releases change.

Essay 0113 min

Agents share information, never permissions

Multi-agent coordination usually leaks authority: every agent gets a token and a route. Keeping capabilities off the message path is what makes a shared conversation safe between untrusted agents.

Essay 0212 min

The environment is the sandbox

Coding agents do not execute one risky command. They operate a development environment, so that whole environment must become the security boundary.

Essay 0313 min

Five tiers, five different promises

Choose coding-agent isolation by threat model: checkout separation, process confinement, L3/L4 egress control, portable containers, or a separate kernel.

Essay 0412 min

A transcript is not an audit trail

Review agent-written code with evidence collected outside the agent: the patch, observed execution, denied activity, and explicit gaps in observation.

Essay 0512 min

Assume the prompt injection worked

Prompt-injection defenses should bound a compromised coding agent's authority: filesystem reach, credentials, sockets, network destinations, and output.