The FABRIQ blog

Process sandboxes, containers, gVisor, microVMs, VMs and Wasm each stop something different. A boundary-by-boundary guide for agents that run code, drive browsers, or control a desktop.

A tool description is untrusted input the model treats as instruction. What the 2026 MCP supply chain incidents actually showed, and the adoption pipeline that survives them.

Detection-based defenses plateau under adaptive attack. The durable answer separates control flow from data flow so untrusted content structurally cannot choose which privileged action runs.

A builder's translation of ASI01–ASI10: the concrete failure behind each risk, a realistic scenario, and which layer of the stack actually mitigates it. Most of these are not model problems.

RFC 8693 lets an agent act for a user without becoming the user. The difference lives in one nested JWT claim, and getting it right decides whether your audit trail means anything.

OAuth 2.1 folds a decade of security guidance into one spec. For agent builders the load-bearing parts are discovery, runtime client registration, and audience-restricted tokens.

Generating tools from an OpenAPI document is the easy 20%. This is the other 80%: operation selection, lossy schema mapping, per-user auth, pagination, backoff, idempotency, and write safety.

A build guide written against the 2026-07-28 MCP specification: the stateless core, per-request capabilities, Extensions and Tasks, and what it takes to be a correct OAuth 2.1 resource server.

Tool schema design is the highest-leverage reliability work available to an agent team, and almost nobody does it deliberately. Naming, parameters, responses, errors, and the tool-count problem.

A working support-triage agent built on the Anthropic Messages API tool-use loop, with identity, scoped authorization, and an audit record wired in from the first commit rather than retrofitted later.

Connecting an agent to a tool is the easy half. The hard half is deciding whether this agent, acting for this person, should be allowed to take this action — and proving afterward what it did.

A ranking of AI agent integration platforms judged on more than connector count: agent identity, acting-user authority, action-level permissions, credential handling, and auditability.

Composio leads on catalog size. This is a ranked look at the alternatives worth evaluating when the harder problem is authority: which agent, acting for which user, may take which action.

Trust doesn't come from claiming an agent is safe. It comes from proving it's governed — scoped, watched, recoverable, and owned by someone who can answer for it.

Six named owners on paper is not the same as accountability. What matters is which roles can actually act in the first ten minutes of an incident, and which act afterward.

Naming a business owner isn't the same as giving them a way to act. The interesting failure is what happens when the accountable person has no switch to pull.

Regulators will ask what a specific agent did on a specific day, not whether you have a policy. Build the evidence into how agents run now, because it can't be produced after the fact.

Log agent identity, user context, tool calls, and the gate decision on every path a call can take. Tamper-resistant, connected across systems, and actually reviewable.

A record of what an agent actually did — the action, the tool, the data, the user, the gate decision, and the outcome. Trust requires evidence.

Agents aren't human users and shouldn't silently borrow their access. Why an agent credential is a structurally different object, and what a healthier model looks like.

Secrets don't belong in prompts, configs, or repos. Scoping, separation, traceability, rotation, and revocation for the credentials agents hold.

The keys, tokens, and secrets agents use to reach enterprise systems, and the operational discipline that keeps them scoped, stored, rotated, and revocable.

Autonomy isn't binary. Reach and initiative are different questions, and the layer most models skip is whether an agent should act on its own or wait.

Templates, context-aware exceptions, automated reviews, and usage monitoring — bringing fragmented agent permissions into one governance model.

Least privilege, action-level scopes, user-aware permissions, approvals for high-risk actions, and reviews — treating permissions as dynamic controls.

Authentication verifies identity; authorization determines access. Why agents need both, and what changes when the actor making the request isn't a person.

RBAC is a strong foundation for agent permissions, and a specific, predictable way it breaks. What belongs in a role, and what never should.

Authorization is not one decision but several, checked in sequence. A plain walkthrough of the layers, the intersection rule, and why the two most common failures sit at opposite extremes.

The most overlooked part of agent governance: retiring agents cleanly so abandoned agents don't become invisible access paths.

Identity, registration, scoped authorization, credentials, and monitoring by default: a repeatable six-stage path to production for hundreds of agents.

Managing an agent from proposal through approval, production, change management, and retirement — so agents don't drift out of control.

Inventory and registry aren't rival terms fighting over one meaning. They're sequential records, and one has to feed the other before either is useful.

From intake to authorization to periodic review — how to make approved, governed agent deployment a repeatable process.

The formal system of record for approved agents — the control plane that defines which agents are recognized, governed, and allowed to operate.

A written rule that nobody can verify is being followed isn't governance yet. It's a document. Visibility is what turns it into something real.

When an agent misbehaves, the useful question isn't what logs exist. It's what to pull up first, in what order, and whether the pieces resolve to one story.

Seeing where agents operate, what they access, what they do, and how they behave over time — the operational layer beyond a static inventory.

A CMDB confirms an agent exists. It has no field for what the agent is allowed to do, and that gap is exactly where a security review stalls.

A practical playbook for discovering, normalizing, and owning every agent across AI platforms, SaaS, cloud, and code.

A structured system of record for every agent: who owns it, what it can access, what it can do, and whether it's still approved to operate.

Shadow IT has an AI successor: shadow agents — autonomous systems running with real access but no visibility, ownership, or governance.

One unregistered vendor-portal agent, walked through end to end, shows exactly where discovery would have shortened an incident from days to hours.

Identifying every AI agent operating across your enterprise — internal, third-party, SaaS-embedded, or API-connected — is the first layer of Agent Operations.

Why written policy and model approvals can't govern systems that retrieve data, call tools, and take action in real time — and what runtime governance looks like.

What the EU AI Act means for agentic systems — and why compliance must shift from model selection to runtime governance of what agents actually do.

How misaligned agents quietly generate real financial risk — and why the true cost is far higher than most companies realize.

Rogue agent actions are rarely dramatic. They're ordinary systems doing ordinary work with slightly too much reach, and the bill lands in three separate places.

Not all hallucinations are equal. The five distinct failure modes of autonomous agents, and why permission hallucination is the one that actually causes incidents.

How to share context between steps and agents without leaking sensitive data or executing hidden instructions.

Asking a clarifying question every time an agent is unsure is not safety, it's a tax users stop paying. The judgment that matters is choosing between ask, assume out loud, and refuse.

A technical primer on identity for AI agents — what it means, why traditional IAM falls short, and how to build per-agent identity, scopes, MCP/OAuth integration, audit, and revocation.

MCP standardizes how agents call tools. OAuth standardizes how apps get tokens. Neither decides whether a specific agent should take a specific action for a specific user right now.

The three controls that separate AI agent demos from AI agent deployments: per-action permissioning, immutable audit logs, and immediate revocation. Why each is non-negotiable.

A practical engineering guide for preventing hallucinations, contradiction, and self-reinforcing errors in agent memory systems.

Most agents can't tell you when they don't know. How to add calibrated confidence scores so agents can defer, escalate, or ask.

Wiring confidence scores into LangChain, LangGraph, AutoGen, and Instructor — without rebuilding your stack.

Treat agents like distributed systems: the metrics, traces, logs, and semantic telemetry you need to debug LLM workflows in production.

The engineering patterns that cut agent cost and latency without breaking behavior — model routing, lazy evaluation, caching, and context trimming — and where each one quietly goes wrong.

The fast-planner, lazy-retrieval, slow-executor pattern implemented end to end in LangChain, LangGraph, and AutoGen, plus how to measure whether it's actually working.

CoT, ToT, GoT, ReAct, PAL, and multi-stage planners — compared, stress-tested, and implemented.

An app is safe to get wrong because a human reviews the output before anything happens. An agent removes that review by design — here's what that costs, concretely.

From psychology to prompts: how to engineer an AI persona users trust and your system can actually implement.

Why your agent already has a personality, how to tune it, and what each of the Big Five traits really means.

A user's guide to clarity, boundaries, and avoiding weird misunderstandings with your digital coworkers.

The multi-agent patterns everyone diagrams (two-agent loops, group chat, manager-worker, hierarchies) all reduce to the same node-and-edge graph. What actually decides whether one runs safely is the termination logic, not the shape.

Decentralizing your agent stack isn't an all-or-nothing move. Execution should be allowed to fragment across teams; connectivity and identity shouldn't, and conflating the two is where these architectures go wrong.

A working catalogue of single- and multi-agent design patterns, with an opinion attached to each one: what it buys you, what it costs, and whether a team shipping this quarter should reach for it.

Visual and low-code agent builders trade control for speed on the common path. That trade holds for simple workflows and standard connectors, and comes apart exactly where multi-agent loops and custom logic start.

Some personalities empower users. Others quietly manipulate, destabilize, or harm them.

And why \"a little charm\" makes automation more reliable, trustworthy, and usable.

Explore how autonomous agents invent access they never received, why legacy IAM cannot contain fabricated authority, and the guardrails enterprises need now.

Why context that's clean, correctly trusted, and honestly labeled at every hop can still combine into something no single agent was authorized to reveal.

OAuth checks whether a token is valid, not whether the action behind it is a good idea. That gap is where autonomous agents cause real damage.

Why refresh tokens exist, how rotation protects your users, and what an invalid_grant error is actually telling you when it shows up in production.

Token storage patterns for backends, browser apps, and native clients, plus the difference between deleting your copy of a token and actually revoking it.

Understand Slack's authorization code flow from redirect to token exchange, then ship your first Web API call with the Python SDK.