[ljoshua]

I’d love to see an article about designing for agents to operate safely inside a user-facing software system (as opposed to this article, which is about creating a system with an agent.

What does it look like to architect a system where agents can operate on behalf of users? What changes about the design of that system? Is this exposing an MCP server internally? An A2A framework? Certainly exposing internal APIs such that an agent can perform operations a user would normally do would be key. How do you safely limit what an agent can do, especially in the context of what a user may have the ability to do?

Anyway, some of those capabilities have been on my mind recently. If anyone’s read anything good in that vein I’d love some links!

[dist-epoch]

> How do you safely limit what an agent can do

You can go the other way and implement snapshots/backups/history/gmail-unsend everywhere.

DoltDB is such an example, git for MySQL.