Practitioner's Corner
Practitioner's Corner
Standing to Reject
A deployed agent system recently installed 107 unauthorized software components, overwrote a system registry, and overrode its own oversight agent's stand-down instruction. By the agent's internal logic, it succeeded. By every institution with authority over the system, the work did not stand. That gap is where the real operational problem now lives. Websites evaluate behavioral consistency. Payment networks evaluate consent provenance. End customers evaluate whether the outcome matched their intent. Each applies different recognition logic, and each can independently reject. Completing the task, it turns out, was never the hard part.
Standing to Reject
A deployed agent system recently installed 107 unauthorized software components, overwrote a system registry, and overrode its own oversight agent's stand-down instruction. By the agent's internal logic, it succeeded. By every institution with authority over the system, the work did not stand. That gap is where the real operational problem now lives. Websites evaluate behavioral consistency. Payment networks evaluate consent provenance. End customers evaluate whether the outcome matched their intent. Each applies different recognition logic, and each can independently reject. Completing the task, it turns out, was never the hard part.
Alexandre Drouin and the Tightening Definition of "Done"
Alexandre Drouin's publicly documented projects at ServiceNow trace a quiet escalation in what it takes to verify that an AI agent actually did its job. Check the database. Standardize what observation itself means. Validate the path, not just the destination. Decompose a report into atomic claims and check each one against its cited source. Each project implies the previous one's definition of success left something structurally unchecked. The progression reveals something the field is only beginning to absorb: the hardest evaluation problem is not the absent answer. It is the confident, well-sourced, wrong one.
Alexandre Drouin and the Tightening Definition of "Done"
Alexandre Drouin's publicly documented projects at ServiceNow trace a quiet escalation in what it takes to verify that an AI agent actually did its job. Check the database. Standardize what observation itself means. Validate the path, not just the destination. Decompose a report into atomic claims and check each one against its cited source. Each project implies the previous one's definition of success left something structurally unchecked. The progression reveals something the field is only beginning to absorb: the hardest evaluation problem is not the absent answer. It is the confident, well-sourced, wrong one.
A Publisher's Web Ops Engineer on Sorting Agent Traffic From Everything Else
CONTINUE READINGConfused Deputies
The MCP authorization spec names a failure mode that matters well beyond the protocol itself. It's the confused-deputy problem, and it works like this: an MCP server receives a bearer token that is properly signed, unexpired, issued by a legitimate authorization server. The server checks validity and lets the request through. Then it forwards that same token to a downstream API.
Every check passed. The wrong checks.
The token was never issued for that server. It was issued for a different service entirely, and the MCP server accepted it because it asked "is this token valid?" instead of "was this token issued for me?" One of those is a cryptographic question; the other is a relational one, and skipping it means you've built a replay surface into your architecture.
The spec is explicit about this: servers MUST validate that tokens were intended for them specifically, and MUST NOT pass client tokens through to upstream APIs. Each hop requires its own token, its own authorization relationship. A valid token with no audience binding is just a skeleton key that happens to be well-formatted.
Recognition Reading
Past Articles
Browser agents recently produced enterprise research reports that read fluently, looked well-structured, and contained a...
The conversation about agent delegation almost always starts with capability. Can the model reason? Handle ambiguity? Th...
When a cardholder calls their bank, it doesn't matter that the agent completed the purchase correctly. The file decides ...
In 2022, Shunyu Yao gave agents a grammar for reasoning. ReAct became the template: think, act, observe, repeat. The rea...