Preprocess before the agent ever sees it. That's the part I'm taking from Sentry's setup. For me it's not one screening step and one AI step. It's a pipeline: several stages of processing, and agents sit in some of those stages, not as the whole system.

Agents as a folder of code is the part I like. Prompts in Markdown, tools in TypeScript, all in Git. That's an agent we own and can reason about. Versioning the agent like product code is what I'll try first.

Soooo, last week was a big security week. Here's the short list I'm working through: Move CI and agents to OIDC where vendors support it. Secrets already live in Doppler, so I'm sweeping for any stray .env files that crept back in. Give each agent its own scoped, short-lived token. Keep audit logs append-only, outside the agent's reach. Always learning, so happy to hear what's on yours.

Okay, this is the workflow I want to try next. Have the agent draw the statechart for a flow. Then check it against a spec with something like TLA+. Models are already pretty good at finding edge cases. What I like is ending up with a spec we own and can actually reason about, not just green tests.

Blocking agents outright feels like a sledgehammer. Fair as a first move, but people will just find workarounds. The better path is giving agents their own door. Their own credential, scoped to one job, short-lived. Every action logged somewhere the agent can't edit. Read-only first, and a human approves money moving.

This is why we treat agents like a new hire with prod access: scoped credentials, monitoring, and changes that go through the same review as everyone else's. In a regulated business, "the agent did it" isn't an answer you can give an auditor.