Archive
19 posts published
Why AI Agents Fail in Production: State Drift, Not Prompt Drift
A practical state-convergence playbook for project-scoped agent systems
Security and UX Are Not Opposites. Badly Designed Security Is.
Security improvements that stick are the ones that reduce cognitive load for normal users while narrowing attack surface
You Will Have a Credential Leak. The Question Is Whether You're Ready.
Credential leak response must be pre-designed. Improvisation guarantees longer exposure windows.
Your Application Code Is Fine. Your Edge Is Not.
Why most production outages in small API platforms happen at the edge layer, not in business logic
Your Deployment Pipeline Is Clever. That's the Problem.
Reliable delivery pipelines optimize for repeatability and recoverability, not cleverness
You Can't Investigate What You Didn't Record
Audit and observability are data models first, dashboards second
MCP Is the New API Layer Nobody Is Designing Correctly
Why MCP servers should be thin, reliable protocol adapters - not application logic hosts
An SDK Is Not a Wrapper. It's a Promise.
SDK quality is contract fidelity plus ergonomic defaults - not HTTP calls with types
Your API Has No Contract. It Has Vibes.
Why contract discipline is the fastest path to scalable integrations and lower support overhead
pgvector Is Not a Shortcut. It's a Database Engineering Problem.
What it actually takes to run Postgres with pgvector reliably in production
You Are Storing the Same File Dozens of Times and Don't Know It
Content-addressable deduplication and integrity checks for API platforms using object storage
You Don't Need Distributed Rate Limiting. Yet.
Build simple, visible, enforceable limits before you build complex ones
Your Database Is Not Cleaning Itself
Why lifecycle integrity in stateful systems depends on explicit, observable maintenance jobs
Your Retrieval Is Working. Your Context Isn't.
Search output is not prompt-ready context. Assembly is a first-class subsystem.
Vector Search Is Not a Retrieval Strategy. It's One Piece of One.
Why reliable retrieval needs layered fallback chains, not vector-only optimism
The Cheapest Breach Is the One That Never Happened
How to build data loss prevention into your API's write path before secrets reach your database
Your Retrieval Algorithm Doesn't Matter If Your Schema Is Wrong
Schema quality determines long-term correctness more than any algorithm choice
API Keys Are Not Passwords. Stop Designing Them Like They Are.
A production-grade model for key format, storage, scope, and rotation
You Don't Have an Authentication Problem. You Have an Authorization Problem.
Why multi-tenant systems fail at authorization boundaries, and how to fix it