- All
- Riteangle 17
- Decision systems 10
- Agent architecture 8
- Operations 8
- Context engineering 6
- Guardrails 6
- Data platform 5
- Agent evals 4
- Agentic architecture 3
- Advertising 2
- Marketing 2
Guardrails — 6 posts
Application-layer regex against managed guardrails: choosing by who has to sign the rule off
A safety rule written in your own code can be read, reviewed and approved by a domain expert, and protects exactly the one route you remembered to wire it into. The same rule bought as managed infrastructure is opaque, catches paraphrase you never enumerated, and applies to every path including ones written six months from now by someone who never read your docs. Having built both, the split I would defend is to write the rules you must be able to defend, and buy the rules you must not be able to forget.
6 min read
An LLM auditor and a deterministic one in the same pipeline, and the check only one of them can run
A pipeline produces a table of numbers and a written analysis, and somebody senior makes decisions from the summary — so something has to check that the prose actually describes the data. I built that check twice by accident, weeks apart: once as a model call, once as plain Python. The arithmetic version is obviously right for four of the five checks, and reimplementing it silently deleted the fifth, which was the only one a model can do.
8 min read
A deterministic keyword gate ahead of the LLM, and the clinician sign-off a classifier can never get
Some questions a patient asks are urgent in a way the patient does not know, and getting one wrong means telling someone to wait until morning. A model would detect those better than a keyword list by every ordinary measure — it handles paraphrase, typos and mid-sentence language switching. It is used anyway, because a list of phrases cannot be argued out of its judgement by the message it is reading, cannot fail open during an outage, and can be read line by line and signed off by a clinician.
7 min read
Deterministic overrides after generation, and the incident behind each one that a prompt could not prevent
A prompt is an instruction, not a constraint, and a model told ten times not to do something will still do it on the turn where the sentence felt right. Worse, a refusal is a property of one model call and does not survive being wrapped in an orchestrator. So the rules that actually have to hold live in code that runs on the output — five checks, each written after something went wrong in production.
9 min read
A 48-hour hand-off that expires without deleting, and the single clock the cron and the agent both read
An agent finishes its work and hands the result to a person, which leaves a third party waiting on someone who may simply be busy. A deadline is necessary to protect them; a deadline that deletes punishes the wrong person for a scheduling accident. The resolution is that expiring and deleting are different operations, and the timeout should do the smallest thing that frees whoever is waiting.
9 min read
A fail-closed regex and a fail-open model judge on every message, and the single corrective retry between them
An agent writing on someone's behalf produces text a real person reads and attributes to a real person, and nobody can read all of it before it goes. Sampling misses exactly the rare failures worth catching. A small model grades every outbound message against an enumerated rubric at roughly a sixth of the generator's budget, which is what makes total coverage affordable — and the uncomfortable part is that nothing has ever checked whether the grader is right.
12 min read