AI agent architecture
An agent using tools needs an execution system around its model. This selection brings together my public work on permissions, recovery, protocols and observability: components that make it possible to inspect what happened when a task changes state or fails.
Which decision are you making?
Before enabling a write
Define which identity authorizes the action, which resource it may change and which budget it consumes. Agent Tool Capabilities implements permissions and revocation; Agent Policy State Machine explores authorization transitions.
When a response is lost
Preserve the operation’s identity and check its effects before retrying. Agent Replay Runtime supports studying recovery after real process crashes and cases that must stop.
When integrating tools
Separate the protocol contract from application permissions. MCP Contract Harness checks message exchange; the sandbox and tracing projects examine isolation and execution evidence.
Projects and evidence
Each project page provides code, environment details, published results and limitations. The experiments describe those configurations; they do not establish results in client systems.
Agent Replay Runtime
Durable tool execution with event replay, idempotency keys and recovery after real process crashes. Includes effect traces and cases that stop instead of retrying automatically.
Agent Tool Capabilities
Tool authorization by argument, resource, expiry and atomic call and byte budgets, with verifiable denial and revocation records.
Agent Policy State Machine
An executable authorization state machine with finite TLA+ safety checks, compensation and replay of the actual TLC transition graph.
Agent Sandbox Boundaries
An ephemeral Wasmtime runner that makes CPU, wall-time, guest-memory, filesystem and network capability limits observable.
MCP Contract Harness
Read-only MCP server and independent clients for checking stdio negotiation, pagination, errors and cancellation, with actual wire messages and reproducible reports.
Agent Trace Observability
OpenTelemetry instrumentation for an owned local agent pipeline with bounded, allowlisted exports and tested exclusion of sensitive payloads.
Architecture and methodology reading
Agents that write to production: authorization, idempotency, and reconciliation
An execution design for tools with real effects: identity outside the prompt, immutable actions, concurrency control, and recovery when a timeout leaves the result uncertain.
Recursive agents: external context, budgets, and evidence that survives delegation
From Recursive Language Models to Recursive Agent Harnesses: designing delegation over large corpora with evidence contracts, global limits, and an evaluation that justifies the complexity.