Thoughts on software architecture, AI/ML systems, production engineering, and building products as a solo founder.
Palantir published this discipline in 2017 and Anthropic files it under debugging rather than auditing. I borrowed the protocol from Atomic Red Team and ran it against all ninety guard hooks in my own harness: 28 of the 31 that can refuse were watched refusing, two cannot fire at all, and two more block correctly while not being armed.
A generated client with a baseUrl nothing ever reads, and no transport anywhere. I wrote the retry and error layer the usual advice asks for, ran it against that boundary and then against a real one, and counted what the switch turned on: three dead branches, one that was wrong in a way nothing local could reveal, and a timeout that cancels nothing. Then six classifiers instead of one, because the first three defects might have been mine.
Deny-by-default is the right posture for agent tool access and the wrong one for a workflow guard. The difference is which error you cannot recover from, and a hook that blocked cat, grep and git diff on the very script it was guarding is what taught me to check.
A null-prompt ablation across 19 agent configurations: 13 survive the noise floor, four say more about the tests than about the prompts, and two stay unresolved because their assertion graded a literal output signature rather than behaviour. Anthropic runs the same kind of ablation on Claude Code and reports the opposite direction. The difference is scope.
An HTTP 200 means the request came back, not that the work happened. A rotated token, an alerting path that went silent for days, and why the same trap gets worse once agents are wired to real tools.
Multi-LLM routing looks clean on a whiteboard. In production the real risk is the cost math that hides its own downside, latency treated as a single number instead of a distribution, and the silent failures that return a clean HTTP 200.
Why AI agents wired to real tools through MCP should default to deny, and how to build the per-operation, audited RBAC that makes fail-close real.
What survived contact with real usage maintaining an MCP server across three clients I never built for: fail-close defaults, replayable observability, and tool descriptions as the real interface.
The pre-mortem is the cheapest way I know to catch the preventable failures before they ship. The 25-minute version I actually run, and when not to bother.