#agenticops applied

The Agent Can Reason. The System Has to Decide.

Good engineers are refusing to run autonomous agent loops. The standard response is coaching: trust the model, just try it. That response is wrong. The fear is not a mindset problem. It is an accurate risk assessment of missing infrastructure. No gates, no evidence trail, no blast radius limits. Declining to bet your reputation on that is the judgment we hired these people for. We already solved this once. A junior engineer merges on day one not because anyone trusts them, but because CI, review, branch protection, and rollback made the trust question cheap. Then the record accumulates and real trust arrives on its own schedule. The infrastructure manufactured it. Same move with loops. Report-only, then propose-with-gates, then act-with-gates, then unattended. Evidence at every rung. Nobody has to feel brave. Trust isn't a feeling you wait for. It's a deliverable you ship. New post, part 2 of 2. Link in comments.

Loop engineering went from tweet to discipline in seventy-two hours. Steinberger said stop prompting agents. Cherny said his job is writing loops now. Osmani named it, and the name was everywhere. The framing is right. And the discourse keeps stepping over one line: a loop running unattended is also a loop making mistakes unattended. The loop has two halves. One generates, and it's stochastic by design. The other decides, and it has to be deterministic or the loop is just entropy with a scheduler. Fuzzy instruments, hard rules. A model can score the work. The threshold that promotes or blocks is a rule you wrote before the loop ever ran. And every decision should leave a record. The claim, the checks, the scores, the diff, the verdict, and the rule that produced it. Six weeks later, you don't reconstruct from memory. You replay the decision. New post, part 1 of 2. Link in comments.

Yesterday I wrote about agent sprawl being the new shadow IT. Today is the implementation post. I have five agents in my .NET stack. Triage, ranking, summarization, extraction, daily orchestrator. Each one is well-scoped internally. Microsoft Agent Framework handles the agent interiors just fine. But the handoffs between them? Wide open. The triage agent classifies a work item. The ranking agent reads that classification and scores it. Nothing validates the handoff. If triage hallucinates a category the scoring model has never seen, ranking scores it with full confidence. Both agents complete successfully. The failure is invisible. Someone is going to read this and say "that is just integration middleware." And so, yeah, the pattern is old. Contract, validate, route, log. ESBs did this. RPA orchestration did this. The difference is what crosses the boundary. RPA handoffs are deterministic. Schema validation is enough. Agent handoffs are stochastic. The triage agent can return a structurally valid payload with a hallucinated category. Schema passes. Content is wrong. You need domain validation and confidence gating, not just structural checks. That has no RPA equivalent. I built it with an IBoundaryContract interface, a BoundaryGate middleware, PostgreSQL for the crossing log, and a Vue.js dashboard that shows boundary health rates. The extract-to-triage boundary was failing at 14% and I had no idea until the dashboard lit up. The plumbing is familiar. The threat model is not. Full implementation on the blog. Link in comments.

I used to think AI governance meant writing the right policies. Define acceptable use. Assign a committee. Review quarterly. None of that produces a kill switch. The EU AI Act says you need one by August 2026. Article 14 requires a real stop mechanism. Not a process that eventually leads to stopping. An actual control plane that a non-engineer can operate. 60% of organizations cannot do this today. The good news: the four containment rings map directly to the compliance requirements. If you built them for engineering reasons, you're 80% of the way there. If you didn't, you have 135 days.

Generation is cheap. Verification is not. 42% of committed code is AI-generated. 96% of developers don't fully trust it. Only 48% always verify before committing. Werner Vogels named this at re:Invent 2025: verification debt. It compounds the same way technical debt does, except it's invisible until something load-bearing breaks. The fix isn't "verify more." That's telling a drowning person to swim harder. The fix is moving verification from human effort to automated gates that scale with generation. Layer 3 of the AgenticOps model has to keep pace with Layer 2, or the governance model collapses under volume. New post breaks down the three failure stages, the gate thresholds that block promotion, and what humans actually own once the pipeline is in place.

Gartner says 40% of agentic AI projects will be canceled by 2027. The reason is not the models. GPT-5 and Claude will be more capable in 2027 than they are today. The bottleneck is governance. Or more precisely, the absence of it. 73% of organizations are deploying agentic AI right now. Only 7% govern it in real time. That 66-point gap is exactly where the cancellations will come from. There are six specific governance failures that compound into cancellation: no centralized control plane, late governance introduction, missing decision traceability, no policy-as-code enforcement, undefined human-in-the-loop thresholds, and poor tool differentiation. Every one maps to a specific layer and ring in the AgenticOps model. This post walks through the mapping and gives you a diagnostic checklist you can run against your own projects today.

Real talk: most teams build containment rings around individual agents. Good start. But when agents communicate with each other, the channel between them is a trust boundary. Most teams treat it as internal. That is the structural error OWASP called out in ASI07 and ASI08. One compromised agent does not just fail. It passes corrupted outputs to every downstream agent that trusts it. The failure propagates through the system as valid data. The fix is not exotic. Apply the same four containment rings at every agent-to-agent boundary, not just at the system perimeter. Zero-trust between internal agents. Circuit breakers on every channel. Fan-out caps to limit blast radius. Memory isolation with provenance tracking. The interior boundaries between your agents have the same attack surface as the exterior ones. New post on the mechanics and the mitigations.