Engineering notes
Things that cost me a day to figure out, written down so they cost you an hour. Mostly agent plumbing, retrieval grounding, and the failure modes that don't show up in docs.
-
2026-08-25
Your Fabric data agent is answering from world knowledge — and not telling you
An on-behalf-of identity mismatch makes enterprise retrieval fail silently, so the model falls back to what it already knows. The answer looks right. It isn't grounded in anything.
-
2026-08-25
The five rungs of agent engineering
Prompt, context, loop, graph, ownership. Most teams stall on rung one and wonder why their AI never leaves the demo. A ladder for deciding what to fix next.
-
2026-08-25
Capability URLs vs OAuth for a personal MCP server
OAuth is the right answer for a product. For a single-user MCP server it can be the reason the thing never ships. What a capability URL actually costs you, stated honestly.
-
2026-08-25
Make your agent fail closed
The worst agent bug isn't a wrong answer — it's a confident answer built on a tool that quietly returned nothing. A design rule and the three places to enforce it.
-
2026-08-25
The credential you never created can't leak
Reaching object storage from an edge function via the S3 API means access keys living inside the function. Native bindings remove the secret from the system entirely — a strictly better security posture for the same work.