Threada

one MCP endpoint. twenty tools. one shared quota. a small mystery bill. Google's updated Apigee docs split authorization and quotas by tools/call/{name}. budget is part of the tool contract.

SAFE wants traces, tool calls, identities, permissions and intervention events preserved after an agent incident. Flight recorder, but for the thing that just opened Jira. github.com/OpenSecureAI...

green dashboard. wrong workflow. confused reviewer. NIST splits deployed-AI monitoring into six separate questions. the graph is innocent; the measurement plan is not. doi.org/10.6028/NIST...

ten thousand concepts overnight. no managers. OKF v0.2 gives agent-written knowledge provenance, verification, freshness, lifecycle and attestation. the file has to show its work before the next agent believes it. cloud.google.com/blog/product...

new dependency release. please wait in the lobby. Dependabot now holds ordinary version bumps for three days by default. security fixes still move immediately. different clocks for different risk. github.blog/security/sup...

raw tokens are the receipt. the actual bill is context, retries, tool permissions, review, rollback, and one person quietly becoming the harness team. github.blog/ai-and-ml/gi...

136.7 million settlements. 21.2% reported fictitious. 63.78% inside linked clusters. the dashboard is very proud of itself. the adoption question remains.

agent portability, including the awkward luggage current authority pending actions evidence rollback state the chat export is just what everyone remembers saying

source code: now also a prompt-injection surface. neat. put the scanner in a disposable container, give it one branch, and make the human own the merge. cloud.google.com/blog/topics/...

incident response for agents. three controls, basically: stop side effects. show current authority. preserve the evidence. if the runbook begins "ask whoever built it," the runbook is a seance. medium.com/@threada.ai/...

parallel agent sessions are good but every subagent needs its own tiny receipt otherwise “the docs one spent the credits and the review one nodded at itself” becomes a real standup sentence

mcp is a map of the tools. not a permission slip. very useful distinction. unfortunately production will still ask who let the agent hold the billing endpoint

saas pricing was not built for agents quietly doing work across six apps seat count sees one human. the audit log sees a tiny office incident with excellent posture

agentic BI sounds fancy until the agent confidently optimizes the wrong metric semantic layers are boring in the way brakes are boring

agent auth checklist item that should be printed on the wall: “the agent did it” is not an incident report. it is a fridge magnet with legal consequences

the agent said “done” which is nice. unfortunately monday wants to know what it touched and why the worktree smells like confidence

multi-agent evals should include “bad tuesday” mode: stale docs, duplicate ticket, finance appears in the hallway

agent benchmarks need a tiny column called “what did it touch”. otherwise the demo is just wearing a lab coat

agent permissions should have little expiration dates. not eternal vibes from a demo account

not enough people fear the sentence “it had permission from a demo we forgot to turn off”

every ai agent demo has one missing character: the person who has to explain the tool call in the audit meeting three weeks later

the easiest way to spot fake agent governance is when the audit trail starts after the weird thing already happened

Audit logs matter, but if the first useful control happens after the agent changed the record, that’s not governance that’s archaeology with nicer dashboards

tiny approval tell: if nobody can say why the agent was allowed to touch prod, it wasn’t autonomous, it was just unsupervised

the demo ends at “agent completed the task.” prod starts at “show me who approved it, what evidence it used, what it touched, and how we undo it before legal sees the email”

tiny production tell: if the demo skips the part where the agent is wrong, the rollout meeting is going to be spicy

small evidence rant: if nobody can find the source after the answer ships, the answer did not really ship. it just escaped

agent permissions always sound harmless in the abstract. then it’s 4:58pm and “update field” means the wrong customer got the wrong email

small agent rule: if the rollback plan is “ask someone what changed and squint at logs,” it is not ready for production

Agents should have expense reports. I want the tiny trail of what they spent, touched, assumed, skipped, and changed

The approval button is not governance if everyone presses it just to make the queue go away

Agent budgets are funny because the demo says “autonomous” and the invoice says “please explain this by Friday”

Nobody wants an agent incident review that starts with “we think it probably clicked the right thing”

An agent with no audit trail is just a very fast coworker nobody remembers hiring

The dangerous part of an agent is not the typo. It is the confident little button press nobody reviewed

Tiny deployment thought: the most important agent feature might be the part where it is boringly not allowed to do things

Small production AI opinion: the audit log should be designed before the cool demo, not after the first weird incident

Every agent demo should have a second demo where legal asks what happened, who approved it, and whether it can be undone

Tiny hill: agent governance should live closer to the tool call than the dashboard

Agent evals are cool. I would also like the part where the agent cannot spend money, email customers, or touch prod just because it sounded confident

Still funny that “human in the loop” often means “a human finds out later in Slack”