AI Enterprise · Kim Like
The agentic systems playbook
Patterns from running autonomous AI agents in production: where the boundary goes, what keeps them reliable, and how their memory stays honest. Each one comes with reference code and an installable skill, published in the open on GitHub.
Governing autonomous agents (the boundary work)
The agent is not the hard part. The boundary is. Governance is the engineering.
- Review-gated autonomy
Let an agent do real work autonomously while guaranteeing nothing reaches the outside world without a recorded human act. A review queue, ONE enqueue chokepoint, a global + per-surface kill-switch…
- The single-enqueue invariant
Funnel every side-effecting write through ONE auditable function, and enforce it with a test/grep so a future contributor cannot add a second path. Makes 'what can this system do to the outside…
- Kill-switches that ship OFF
Design every new capability as inert-by-default and fully reversible: a global master plus per-capability flags, defaulting OFF, where flipping everything OFF reverts to manual with zero data loss…
- Reading guide: how to adopt these patterns in order
A meta-node: the recommended adoption path through the playbook for someone starting an agent system today, so the library is a course, not a pile.
- Capability-gated deploys (one integrator)
When many agents can produce changes, only ONE holds the capability to ship. Everyone else files a typed deploy request; the integrator integrates onto current, refuses any ship that would clobber…
- Sandboxing a tool-enabled subprocess
When your app spawns an agent subprocess on behalf of an external user, lock it down: isolated HOME, plan/read-only permission mode, an explicit disallowed-tools list, no inherited credentials. A…
- Let the model explain, let code decide
In high-stakes domains (finance, tax, compliance) the language model reads everything and explains anything but is structurally unable to render a verdict. Deterministic, named checks own every…
- Provenance-weighted decision routing
Stop high-confidence hallucinations from outranking low-confidence truth: attach source provenance and trust tiers to every claim an agent processes, propagate the chain through reasoning steps, and…
Reliability over demos
A demo proves it can. Production proves it does, again, on the bad input, at 3am.
- The demo-to-production gap
Why agents that pass ten clean demo runs fail silently in week three: the inputs change and the agent does not error, it produces plausible-but-wrong output. The fix: an explicit input-boundary type…
- Auditable or it doesn't ship
Every agent action writes a non-secret audit row: what, when, on which surface, with the external reference id. No trace means a liability with good PR. The audit table schema + the…
- Idempotent, claim-based work queues
Run multiple workers against one queue without double-sending: an atomic claim (compare-and-set to 'sending'), idempotent enqueue (no duplicate pending rows), and lost-race handling that is a silent…
- One-Shot Prompt Assembly
Prevents the retry loop where an agent starts generating output before it has the full context (tests, configs, recent changes), burns tokens correcting itself, and sometimes degrades further on each…
Memory & knowledge for agents
An agent with unbounded, unaged memory drifts. Bounded, recency-disciplined knowledge is what keeps it sharp.
- Bounded, recency-banded memory
Keep an agent's knowledge sharp: domain-scope new claims, dedupe (token-set similarity + containment), cap the active set with compaction, and band by freshness (fresh / aging / outdated) where age…
- The soul/memory split
Separate an immutable voice/values spine (read-only, re-distilled by hand) from an evolving knowledge store the learning loop writes. The loop can never corrupt who the agent is, only what it knows.
- Two-tier learning loop (cheap triage, expensive synthesis)
Spend tokens where they matter: a cheap local model triages a large stream for relevance; only the kept items reach the expensive synthesis tier, bounded by a per-run cap. The cost bound is…
Persona & content systems
When an agent writes in your voice, the spec is the product and the guardrails must be deterministic.
- Deterministic content guardrails
Stop relying on the model to follow style rules. Add a deterministic post-generation gate (e.g. forbidden characters/phrases) with exactly one regeneration retry, then refuse. The model is creative…
- Persona-as-spec (the spec is the product)
Treat the agent's behavior spec as the deliverable: prompts re-read the spec on every call, so editing the spec changes behavior with no deploy. The spec, not the code, is where the product lives.
- Operator-in-the-loop review UI
The interface that makes review-gating humane: one card per draft, edit-in-place, approve/request-changes/archive, and a manual-publish attestation that records a human act without performing one…
Running work as a system (orchestration)
Throughput was always the goal, not headcount. The constraint moved to how good the system is.
- The dispatch-envelope contract
Hand work between agents (or contexts) through a typed envelope: the child gets exactly the inputs it needs and the parent never inherits the child's working context. Keeps a multi-agent system…
- Knowledge-graph routing
Route work to the right program/agent/model-tier with a small knowledge graph: nodes carry keywords/paths/status, and an orientation step injects only the relevant slice at session start instead of…
- Model-tier routing
Pick the cheapest sufficient model per task class: trivial mechanical work to a small model, bulk drafting to one tier, judgment to the top tier. A simple routing table beats always-use-the-best.
Owned-infrastructure economics
Owning the stack is a cost-and-control argument made with numbers, not nostalgia.
- Build vs buy for agentic infrastructure
An honest decision framework for self-hosting vs SaaS in an agent stack: what to own (queues, local models, your data plane), what to rent, and the failure modes you take on with each. Numbers where…
- Snapshot-based deploys for a fleet
Ship many sites/services together safely: build in an isolated workspace, deploy atomically from an immutable snapshot, guard against rollback/clobber, and prune old snapshots automatically. The…
Field notes (essays + building-in-the-open)
Short, honest takes and a real changelog of what changed and why.
- Field note: the honest middle on agent hype
Short recurring essays that correct both the overclaim and the dismissal, from a practitioner running this daily. Credibility content, not code.
- Building in the open: the changelog
A public 'what changed in how I run agents this week, and why' log. Sparing, specific, real reasoning. The lightest, most frequent content unit; it keeps the profile alive between big deliverables.
Showcase (case studies)
Proof, not bragging: real public builds, what they do for users, and the method, with backlinks.
- Danmarks Kaffekort (thirdwave.dk) case study
A curated interactive map of Denmarks best specialty coffee bars as a content-growth feature. Shows why a hand-curated, quality-filtered, city-organized map beats a generic embed for both visitors…