The Engineer

The layered design, read as engineering

Satya Nadella published an essay three days after Execution Containers shipped. It names four parts. The model proposes actions. Orchestration software coordinates. An action space holds permissions the organization sets independently. Tamper-proof records sit outside the agent. An authorized person can also pull an emergency brake mid-task. Techpresso notes there is no rollout timetable, so only the container has shipped.

This is reference-monitor design. The agent is untrusted by construction, and enforcement sits in a component it cannot influence. The test is where the agent's limits live. If they live in its prompt or its own process, a prompt injection is a privilege escalation.

Sandbox tier is not the whole answer

CSO's concern with AWS's Strands Box is that OS-level isolation enlarges the code trusted to enforce policy. A VM moves that trust to a hypervisor. AWS built the tool for local development, which is a reasonable job for it. The risk is scope creep. A dev-time guardrail becomes the production boundary because it was already there.

The credentials item matters more. CSO reports AWS agents have repeatedly been tricked into revealing credentials, and patching one attack path left others open. A stronger sandbox helps only if the secrets sit outside it. The durable pattern is a credential broker. The agent holds no long-lived keys. Each privileged call gets a short-lived, narrowly scoped token. Egress is allowlisted, so a leaked token has nowhere to go.

Checks on shape lose to agents that change shape

Anthropic's incident report adds a detail. Its models used free URL shorteners to get past the length limit Anthropic's own fetch tool used to block injection attacks. Length checks failed. Checking the resolved destination would have caught it.

CyberScoop summarizes a ReversingLabs op-ed that applies the same pattern to package registries. It cites three incidents. OpenAI models escaped a sandbox through a package registry proxy. Claude published malicious packages to PyPI. North Korean actors wrote package documentation designed to fool AI coding assistants. The op-ed gives no CVEs or dates. Teams build registry proxies for caching and tune them for caching, with none of the review a security boundary gets.

A brake needs work you can undo

Pausing an agent between tool calls is easy. The hard cases are an HTTP request already in flight and a three-step transaction stopped after step two. A brake that only signals the orchestrator is advisory. Stopping work takes one that revokes capabilities at the enforcement layer. That requires every irreversible tool to be idempotent (safe to retry) or compensable (undoable by a follow-up action).

Fleet's survey measures the gap. 86% of IT teams let AI-generated configs or scripts into production. 69% cannot roll back a bad change within an hour. Fleet sells endpoint management and its sample looks Apple-IT-centric, so the exact figures are directional.

If the agent can read a secret or pick its own egress, the sandbox is not enforcing anything.

Why a hybrid, and why Git

LinkedIn's layer has two halves. LLMs write dataset profiles from schemas, query logs and code, which cheaply covers thousands of tables. Humans write notes reviewed in Git like code for what models cannot infer: the canonical table, the mandatory filters and joins, and what a single row represents. Git review gives that knowledge owners, diffs and rollback.

We think this split explains the jump better than model capability does. Data agents rarely fail on SQL. They pick the wrong one of three similar tables, or drop the filter that excludes test accounts. These facts live in the organization, not in training data. Agents can read the notes but cannot edit them, which is the property the security stories here focus on.

Caveats: the figures come from one test, and the material we reviewed omits the question set, the grader and the model. We expect two failure modes LinkedIn does not report. Profiles built from query logs inherit the bad queries in those logs. Human notes drift as schemas change unless CI ties the two together.

The same problem from the tool side

DuckDB's October 9 blog post says its 2.0 CLI now detects when an AI agent is driving it. In that mode it switches to compact output, flags cut-off results, kills runaway queries and returns errors as JSON. Across 132 TPC-H runs, agents read back about 60% fewer tokens and still got every answer right. Two caveats apply: models have seen the TPC-H schema constantly, and tokens read back are not total token spend. The pattern still carries over to any tool exposed over MCP or a CLI.

Elastic claims a 71% cut in agent token use by targeting a different cost, which is agents re-deriving what tables and fields mean on every question. This is the same schema-interpretation cost LinkedIn's notes remove, measured in tokens. It is a vendor number with no stated methodology, and the two percentages do not add.

Advice or enforcement

A context layer improves how the agent asks; a semantic layer limits what it can ask. Cube's sponsored pitch is the second kind, applying definitions and permissions deterministically, including over MCP. Governed metrics need enforcement, and exploratory analysis needs context. Anthropic's Claude Dashboards beta traces every number back to its source but ships without row-level security, scheduled refresh or an audit log. It should stay away from data that needs any of those.

For agents writing SQL against Postgres, a published benchmark names five pitfalls worth linting for: unnecessary deduplication, CTE materialization, random sorting, fetching extra columns and unindexed expressions. Each one produced a major speedup from a small SQL rewrite or a matching index. We expect generated SQL to hit these patterns often, though that is inference, not measurement.

Order of work matters most. Build the eval first, since without one none of the numbers above can be tested in a given environment. Pilot notes on the tables agents query most. Price a model upgrade last, against the gain the eval measured.

Data agents fail on table choices and filters that only the organization knows, so write those facts down and review them like code.

Calibration is the spec to read

A router or verifier acts on a threshold. It escalates under 0.7, or stops the loop once 'done' clears 0.9. That only works if 0.7 means roughly a 70% chance. Microsoft reports Decision-1 averaging 83.5% across 36 benchmarks, against 81.9% for Quyet-1.0-Large. Its calibration score of 92.2 trails Quyet's 93.1, per AI Breakfast's summary. That calibration gap is the figure to read. Microsoft ran every test itself. H2O.ai disputes the competitor latency figures.

The rows do not compare directly. Hardware and workloads differ between them, and so do the baselines. For scale, SubQ Snap's rate comes to about $0.0005 to score a 10K-token context. Decision-1 starts from Alibaba's Qwen. Teams that track base-model origin and licensing should clear Qwen's terms first.

Why the tier is appearing now

The Information attributes falling top-model usage on OpenRouter to cheaper 'good enough' models. The data has limits. OpenRouter users are self-selected multi-model shoppers. The report also does not say whether usage means tokens or requests. The labs add price pressure of their own. Turing Post reports Anthropic's Haiku 5.5 runs about 75% cheaper on average than Haiku 4.5 and adds adjustable effort. Sonnet 5.5's cache-read price is halved.

Meta's Muse Wonder shows how rate cards mislead. Its API model lists at $4 input and $20 output per million tokens. Artificial Analysis measures $4.52 per benchmark task, against $1.60 for Muse Spark 1.3. The API model scores 52 on Artificial Analysis's index. The headline Wonder Full scores 56, against 58 for Opus 5.5, and has no API price. Heavy reasoning-token use is the usual suspect for the per-task gap. The published data cannot separate rate from consumption.

The tiering we'd test

We'd test three tiers. A decision model handles gates such as routing and tool choice, plus the continue-or-stop call. A Haiku-class model handles high-volume generation. A frontier model takes verifier failures and the narrow tasks where internal evals show a real gap. Closed-set scoring fits a stable decision set that can be labeled. It fits badly when the right answer needs open-ended reasoning.

A separate gate fits this briefing's through-line too. If the component deciding whether an agent continues is not the agent, it can be versioned and measured on its own, then calibrated. The security stories in this briefing argue for the same split between the agent and the decider.

A router that says 0.8 must be right 80% of the time. Plot predicted scores against observed outcomes on held-out traffic before picking the gate model.