Security
Permissions, identity, secrets and tool actions someone can account for.
2026
A deadline has to live outside the code it limits
A handler that never yields defeats timers inside the isolate, so the deadline for agent-generated JavaScript has to be a process kill from outside it.
Agent systemsPlatformsSecurity
Agent memory that remembers the current answer
Building a multi-tenant memory service where identity bounds access, later facts supersede earlier ones, and tests grade the final answer rather than retrieval.
SelectedMemoryEvaluationSecurity
Authentication is only the first part of deciding who may use an app
What an application still has to decide after Google or GitHub has verified someone: who is admitted, how fast a removal takes effect, what an invite may do, and what happens when an app changes hands.
SecurityVerification
What a component compiler owns when the server can’t run JavaScript
Compiling JSX-shaped templates to plain Rust, and dividing scoping, type checks, escaping and navigation among the compiler, rustc and the runtime.
PlatformsInterfacesSecurity
Copying code on purpose when applications can’t share a crate
When an application may link only one crate, shared code has to be copied. A canonical source tree, declared mounts, file hashes and a drift check keep the deployed copies aligned.
PlatformsVerificationSecurityPerformance
Counting the ways an internal note can reach a customer
A helpdesk enforces note privacy through one caller-specific projection across counts, previews, search and exports, and narrows what customer-bound drafts can use.
SecurityInterfaces
Keeping the real workspace beside the conversation
Giving a browser workspace stable panel identity, separate lifetimes for layout and shell, and the agent’s real files and terminal instead of a plausible substitute.
InterfacesAgent systemsSecurity
Making a search index prove itself at query time
A search engine that treats every posting as a lead, publishes updates by stage-then-flip, and checks each candidate against one served version before its ACL runs.
PlatformsVerificationSecurity
One sign-in screen, three owners of identity
How hosted authentication, a sign-in broker and application-local accounts each vouch for a different fact, with signed browser handoffs and each one's limits.
SecurityPlatforms
Taking Raft out of our configuration service
Replacing a home-grown Raft cluster with Valkey: which jobs moved to the store, which rules stayed in the service, and how atomic scripts keep the two together.
PlatformsSecurity
Testing the promises an API actually makes
How to test what a multi-service JSON-RPC API promises: coverage from its advertised methods, hostile payloads, concurrent writes and literal replay checks.
SelectedInterfacesSecurityVerification
Two ways a tool description goes stale
Why a discovered tool definition is not permission to call it: re-checking catalog, policy and capability at call time, and deriving every format from one source.
SelectedAgent systemsSecurityInterfacesEvaluation
Voice shouldn’t have its own idea of the task
Building voice as one more client of existing thread operations, with guards for steering races, ambiguous references and a spoken “yes” that names nothing.
InterfacesAgent systemsSecurity
Waiting for an async host by running the program again
How a synchronous QuickJS guest in WebAssembly waits for async Rust: abort on each host call, answer it, then replay the program with the answers preloaded.
Agent systemsPlatformsSecurity
What a permission model looks like from inside Notes
A browser-based desktop makes cloud boundaries visible in ordinary actions: a note that survives a reload but does not reach another browser, shared rooms, guest accounts, a lock screen the server enforces, and writes refused when another site sends them.
SecurityWebSessionsMulti tenancy
What a plugin upgrade is allowed to destroy
Plugin packages, plugin data and sandbox caches have different lifetimes. How an installer applies digests, atomic renames and restore rules to each one.
PlatformsSecurityVerification
What a tool-call approval actually approves
Binding a human yes to one tool call, with exact inputs, policy revision, thread and turn, spending it once across replicas, and asking where the last check sits.
SelectedAgent systemsSecurity
What an agent may find, read and publish
How a read-only context library keeps discovery, search, observation and publishing apart, with a capped catalog of untrusted text and access rechecked for each observer. This is a contract rather than a deployed service.
Agent systemsSecurityContextArchitecture
What an agent runtime has to write down before it says yes
What a durable agent runtime must store before acknowledging a turn, how it recovers a crash mid tool call, and what at-least-once still leaves to the tool.
Agent systemsPlatformsSecurity
What an evidence vault can prove without a notary
What content hashes, separated review and a chained audit log establish inside one application, and where blob deletion and the signing key's holder limit them.
SecurityVerification
What has to commit together when a payment arrives twice
In a reference shop with hedged requests and retried webhooks: what must land in one write, and why durable intent, rediscovery and receiver idempotency are separate.
PlatformsSecurity
What should travel when you share an agent
A blueprint shares an agent's code and the connections it needs, but never its history, credentials or schedules, and the recipient wires in their own grants.
Agent systemsSecurityOpen source
What survives when you replace the client
Replacing a browser client on a shared TypeScript package and adding a native Rust client on the protocol alone: what each reused, and where scrolling and login cut across.
InterfacesAgent systemsSecurity
Where an agent’s URL actually connects
Following an agent's URL past the allowlist: resolving every address, pinning the connection, vetting each redirect, and why each browser backend differs.
Agent systemsSecurityPlatforms
Whose request is this? Delegated identity between services
Keeping the calling service separate from the user behind it: absent, invalid and verified identity, binding claims to the resource, and what replay memory needs.
SelectedSecurityInterfaces