Go deeper
Agentic AI
A 25-lesson course, each with a citable work, a verified quotation and a video lesson: what an agent is and why it is a loop, not a prompt; context engineering; workflows versus agents; tools, MCP and A2A; frameworks and their supply chain; routing between models, small models, LoRA and when fine-tuning pays; evaluations; on-prem or cloud; personal data, prompt injection, least privilege; human oversight and the AI Act; budgets and loops that never stop; RPA or agent; observability.
The reading track
- 01
An LLM agent is not a longer prompt but a loop: it perceives, decides, acts, then perceives the result of its own action.
Artificial Intelligence: A Modern Approach · Stuart Russell, Peter Norvig · 1995
The textbook definition maps exactly onto what runs today: the sensors are the context (the user's message, files, tool results), the actuators are tool calls (search, run code, send an email). The loop closes when a tool result comes back into the context and the model chooses the next step. That is the difference from a chat call: a call never sees the consequence of its own action. Autonomy has a plain measure — how many turns the loop makes without a human. An agent is defined by its tools and its stopping rule, not by its model.
An agent is anything that can be viewed as perceiving its environment through sensors and acting upon that environment through actuators.Artificial Intelligence: A Modern Approach, ed. a 4-a (2020), cap. 2 «Intelligent Agents», §2.1 — definiția agentului
Why it matters Whoever sees the agent as a loop knows where the guardrails go: on every turn, not just at the entrance.
Open on YouTube ↗ - 02
An agent's behaviour is mostly the shape of its environment: context engineering beats prompt engineering.
The Sciences of the Artificial · Herbert A. Simon · 1969
"Context engineering" is the 2025–2026 name for what the model sees on each turn: system instructions, tool descriptions, retrieved documents, memory, the trajectory so far. A mediocre model in a well-shaped environment beats an excellent model drowning in a messy one. The levers are concrete: short tool descriptions with one example; retrieve only what is needed; compact the trajectory; put the constraint next to the decision; use the file system as memory instead of the context window. The typical failure is "context rot": stale tool output piling up until the model can no longer see the task.
An ant, viewed as a behaving system, is quite simple. The apparent complexity of its behavior over time is largely a reflection of the complexity of the environment in which it finds itself.The Sciences of the Artificial (1969), cap. 3 «The Psychology of Thinking» — parabola furnicii
Why it matters When an agent goes wrong, the first suspect is what it saw, not what it thought.
Open on YouTube ↗ - 03
Do not pack your knowledge into rules the model will outgrow: build the agent so that a better model makes it better, not broken.
The Bitter Lesson · Richard S. Sutton · 2019
Sutton's argument: hand-coded human knowledge wins in the short run, then loses to search and learning that scale with compute. For agent builders, thick scaffolding — rigid step lists, fixed plans, parsers for the model's exact wording — is the human-knowledge bet, and it breaks at the next model release. Better: give the model tools, the goal and the constraints, verify the outputs, and keep the scaffold thin. Where determinism matters (compliance, money), keep it outside the model as a workflow, not inside it as a prompt. The "bitter" part: the cleverest prompt engineering has a shelf life of one model generation.
The biggest lesson that can be read from 70 years of AI research is that general methods that leverage computation are ultimately the most effective, and by a large margin.The Bitter Lesson (eseu, 13 martie 2019) — prima frază
Why it matters Models change every 3–6 months; an agent with thick scaffolding gets rewritten every time.
Open on YouTube ↗ - 04
First a workflow with fixed steps; an autonomous agent only when the steps cannot be known in advance.
Building effective agents · Erik Schluntz, Barry Zhang · 2024
The text separates workflows (model and tools orchestrated through predefined code paths) from agents (the model directs its own process). Five workflow patterns: prompt chaining, routing, parallelisation, orchestrator–workers, evaluator–optimiser. The decision rule: if you can draw the flowchart, build the workflow — it is cheaper, testable, predictable. Move to an agent when the number of steps is unknown and the task needs the model's judgement at every step (open-ended coding, research). The agent's price: latency, spend, compounding errors. Start with the simplest thing that works and add autonomy only when measured evaluations say the workflow falls short.
Consistently, the most successful implementations use simple, composable patterns rather than complex frameworks.Building effective agents (Anthropic, 19 decembrie 2024) — introducere
Why it matters Most "agents" in production are well-named workflows; they are also the ones that do not fall over.
Open on YouTube ↗ - 05
The thought–action–observation loop is the basic shape of every modern agent: the model reasons, calls a tool, reads the result, then reasons again.
ReAct: Synergizing Reasoning and Acting in Language Models · Shunyu Yao et al. · 2022
ReAct interleaves Thought / Action / Observation. Today it is the native tool loop of every API: the model emits a tool call, the runtime executes it, appends the result, the model continues. What the paper measured: fewer hallucinations than chain-of-thought alone, because the facts come from the environment rather than from memory. Engineering consequences: the observation is where untrusted content enters (lesson 17); cap the number of iterations; make every tool idempotent or confirmable; log every triple so it can be replayed. Variants: Reflexion (self-critique between episodes), plan-and-execute (plan once, then act).
In this paper, we explore the use of LLMs to generate both reasoning traces and task-specific actions in an interleaved manner, allowing for greater synergy between the two: reasoning traces help the model induce, track, and update action plans as well as handle exceptions, while actions allow it to interface with external sources, such as knowledge bases or environments, to gather additional information.ReAct: Synergizing Reasoning and Acting in Language Models (arXiv 2210.03629, octombrie 2022) — rezumat
Why it matters Every agent you debug has the same loop; once you know it, you know where to look in the log.
Open on YouTube ↗ - 06
Multi-agent systems pay off when the task splits into roles with different contexts, not because more agents sound smarter.
The Society of Mind · Marvin Minsky · 1986
Minsky's model: intelligence comes from many simple, specialised agents. The modern reading is orchestrator–workers, where each worker has its own context window and its own tools (researcher, coder, reviewer). When it pays: parallelisable subtasks; contexts that would otherwise overflow; separation of privileges (the agent that reads email cannot send money). When it does not: sequential tasks with shared state, where handoffs lose information and cost multiplies because every worker re-reads. The rule: the number of agents follows the number of distinct contexts, not the org chart. Enquiries about multi-agent systems rose 1,445% between Q1 2024 and Q2 2025 (Gartner) — a signal of enthusiasm, not of merit.
What magical trick makes us intelligent? The trick is that there is no trick. The power of intelligence stems from our vast diversity, not from any single, perfect principle.The Society of Mind (1986), §30.8
Why it matters A second agent costs a second context; it has to buy something the first could not do.
Open on YouTube ↗ - 07
A good tool for an agent has a narrow interface on the way out and a tolerant one on the way in; MCP standardises exactly that contract.
RFC 793 — Transmission Control Protocol · Jon Postel · 1981
A tool is a name, a one-paragraph description and a typed schema. The model's call is the "liberal" side: validate, coerce, return an error the model can repair. The tool's output is the "conservative" side: compact, structured, free of surprises, truncated with a note. MCP (Model Context Protocol) is the open standard for tools, resources and prompts between a client (the agent) and servers; donated by Anthropic to the Agentic AI Foundation under the Linux Foundation on 9 December 2025, with over 10,000 public servers and, in a 2026 survey (Stacklok), 41% of organisations running MCP in production. But Postel's law has a known dark side: liberal acceptance is exactly the door injection walks through — a tool's output is treated as data, not as instructions (lesson 17).
TCP implementations will follow a general principle of robustness: be conservative in what you do, be liberal in what you accept from others.RFC 793 — Transmission Control Protocol (septembrie 1981), §2.10 «Robustness Principle»
Why it matters An agent is only as good as the worst tool description in its context.
Open on YouTube ↗ - 08
Your agent topology will copy the org chart; A2A is the protocol that makes the boundaries between agents explicit, so you can choose them.
How Do Committees Invent? · Melvin E. Conway · 1968
A2A (Agent2Agent) was announced by Google on 9 April 2025 and donated to the Linux Foundation on 23 June 2025; it has over 100 supporting organisations. The vocabulary: an agent "card" (what it can do), tasks with states, messages. MCP is vertical, agent-to-tool; A2A is horizontal, agent-to-agent. Conway's warning: if teams own agents, the agents will talk the way the teams talk — including not at all. Boundaries are chosen by who owns the data and who owns the privileges, not by department. In practice: one agent per bounded context; a public card of what it does; task states with an audit trail; no shared mutable memory between agents.
Organizations which design systems (in the broad sense used here) are constrained to produce designs which are copies of the communication structures of these organizations.How Do Committees Invent? (Datamation, aprilie 1968) — teza articolului, cunoscută drept «legea lui Conway»
Why it matters Choose the boundaries before the protocol; the protocol only pins them down.
Open on YouTube ↗ - 09
Choose the framework after you have a simple agent that works; the framework must keep your loops visible, not hide them.
Systemantics: How Systems Work and Especially How They Fail · John Gall · 1975
The 2026 open-source landscape, as examples: graph orchestrators with state and checkpoints (LangGraph), agents with typed inputs and outputs (PydanticAI), role-based crews (CrewAI), agents that write code instead of calling tools (smolagents), the model labs' SDKs (OpenAI Agents SDK, Google ADK, Microsoft Agent Framework — the autumn-2025 merger of AutoGen and Semantic Kernel — Claude Agent SDK). The criteria: can you see every model call and tool call? can you pause, resume, replay? does it tie you to one model provider? how much context does it add on its own? Start from the raw loop over the API (a hundred lines); adopt a framework when you need durable state, pauses for a human, or multi-agent routing. Beware "magic" that hides prompts you will have to debug.
A complex system that works is invariably found to have evolved from a simple system that worked.Systemantics: How Systems Work and Especially How They Fail (1975) — «legea lui Gall»
Why it matters The wrong framework shows in month three, when you cannot explain why the agent did what it did.
Open on YouTube ↗ - 10
A tool server is code your agent executes with your privileges, and its description is a prompt you never read.
Reflections on Trusting Trust · Ken Thompson · 1984
"Tool poisoning": instructions hidden in a tool's description, visible to the model but not the user; "rug-pull": the tool redefines itself after approval; "shadowing": one tool hijacks another's calls. Named vulnerabilities from 2025: CVE-2025-54135 (CurXecute, score 8.6) and CVE-2025-54136 (MCPoison) in a popular code editor; in November 2025 a poisoned messaging MCP server rerouted data to the attacker's number. A 2026 report found 43% of tested MCP servers vulnerable to command injection. The OWASP Top 10 for agentic applications lists the tool supply chain as a risk of its own. Controls: pinned versions with hashes; descriptions reviewed like any code; an allowlist per agent; servers in containers, no network by default; a diff on the description at every update; a gateway that logs every call.
The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.)Reflections on Trusting Trust, Communications of the ACM 27(8), august 1984 — discursul de acceptare a premiului Turing
Why it matters Tool marketplaces grew faster than the habit of reading them.
Open on YouTube ↗ - 11
Do not pay for reasoning where no thinking is needed: route cheap calls to cheap models and keep the reasoning model for the hard decisions.
An Introduction to Mathematics · Alfred North Whitehead · 1911
An agent's cost architecture: tiering (a cheap model by default, escalation on low confidence or a hard task); routing reports in 2026 about 95% of frontier-model quality while sending only 14–26% of calls to the expensive model, a 75–85% saving on routed traffic; prompt caching cuts the price of repeated input by up to ~90%; batching for whatever is not urgent; caps on reasoning effort. The order of measures: static tiering, caching, effort caps and batching first (50–70% typical savings), a learned router only after. The trap: the cheap model's failure mode is confident error — every tier needs its own evaluation (lesson 15).
It is a profoundly erroneous truism, repeated by all copy-books and by eminent people when they are making speeches, that we should cultivate the habit of thinking of what we are doing. The precise opposite is the case. Civilization advances by extending the number of important operations which we can perform without thinking about them.An Introduction to Mathematics (1911), cap. 5 «The Symbolism of Mathematics»
Why it matters An agent's bill is a distribution of calls; most of them do not deserve the most expensive model.
Open on YouTube ↗ - 12
Inside an agent, most calls are narrow and repetitive; a small specialised model does them cheaper, faster and often just as well.
Small Language Models are the Future of Agentic AI · Peter Belcak et al. (NVIDIA Research) · 2025
The paper's argument: an agent's tasks are narrow, formatted, repetitive — exactly what fits a model under 10 billion parameters. The system becomes heterogeneous: a frontier model plans, small models work. The proposed procedure: log the calls, cluster them by task type, train a small model per cluster and put it in place of the large call. The 2026 pattern — a large planner, small fine-tuned workers — is reported at roughly a tenth of the cost. Open-weight families (Qwen, Gemma, Mistral, gpt-oss and others) run on a single GPU or on-prem. The price: the evaluations and the serving are yours. Where small models fail: open-ended reasoning, long context, rare cases — there you escalate.
Here we lay out the position that small language models (SLMs) are sufficiently powerful, inherently more suitable, and necessarily more economical for many invocations in agentic systems, and are therefore the future of agentic AI.Small Language Models are the Future of Agentic AI (arXiv 2506.02153, iunie 2025) — rezumat
Why it matters The cheapest token is the one you never send to a frontier model.
Open on YouTube ↗ - 13
LoRA trains only a few small matrices beside the frozen model: that is why it costs one GPU and a few hours, not a cluster.
LoRA: Low-Rank Adaptation of Large Language Models · Edward J. Hu et al. · 2021
The mechanism: the change in the weights is approximated as the product of two low-rank matrices, with r far smaller than the layer's dimension. In the paper: 10,000 times fewer trainable parameters and 3 times less GPU memory than fully fine-tuning a 175-billion-parameter model. An adapter is a small file, swappable per task on the same base model; QLoRA adds a 4-bit quantised base. In 2026 a 7–8-billion model adapts in hours on a single GPU, from a few dollars for a small adapter to a few thousand for large datasets. What it changes: behaviour, format, style, tool-call discipline. What it does not: it adds no new knowledge in bulk — that is RAG. Serving many adapters on one base makes per-customer or per-task specialisation cheap.
We propose Low-Rank Adaptation, or LoRA, which freezes the pre-trained model weights and injects trainable rank decomposition matrices into each layer of the Transformer architecture, greatly reducing the number of trainable parameters for downstream tasks.LoRA: Low-Rank Adaptation of Large Language Models (arXiv 2106.09685, iunie 2021) — rezumat
Why it matters Fine-tuning has become cheap enough that the question is no longer "can we?" but "is it worth it?".
Open on YouTube ↗ - 14
The order is prompt, then RAG, then LoRA: fine-tuning pays when the behaviour is narrow and repeated, not when knowledge is missing.
LoRA Without Regret · John Schulman et al. · 2025
The 2025 findings: LoRA on all matrices (including the MLP layers), a learning rate about ten times full fine-tuning's, two thirds of the compute, and for reinforcement learning rank 1 is enough. So "lower quality" is no longer the reason to avoid it. The decision tree: a better prompt with examples — free, instant; RAG — knowledge that changes, citations required; LoRA — a fixed format or tool-call discipline, style, a narrow classifier or router, latency (a short prompt instead of three thousand tokens of instructions), distilling a large model's behaviour into a small one for a single task (70–85% of the teacher's quality at 5–10 times lower cost, per 2026 reports). Not LoRA: new facts, changing policy, rare cases. Prerequisite: an evaluation set and hundreds or thousands of examples. The regret: the adapter freezes today's behaviour and is retrained when the model changes.
In our experiments, we find that indeed, when we get a few key details right, LoRA learns with the same sample efficiency as FullFT and achieves the same ultimate performance.LoRA Without Regret (Thinking Machines Lab, 29 septembrie 2025) — introducere
Why it matters Without an evaluation set, a fine-tune is an expense with a story attached.
Open on YouTube ↗ - 15
Evaluations are an agent's only brake, and an evaluator you optimise against becomes the target itself.
«Improving ratings»: audit in the British University system · Marilyn Strathern · 1997
Agent evaluations have three levels: the task (did it finish? in how many attempts?), the trajectory (took the right steps, called no dangerous tools) and cost with latency. Non-determinism calls for repeated runs and distributions, not a single score. An LLM judge scales, but it is biased (it favours long answers, position, its own phrasing): calibrate it on a human-labelled set, use it pairwise, rotate the models. Goodhart: if the agent or your prompt iterations are optimised against the judge, the score rises without the task being done any better; keep a held-out set, refresh it and watch for reward hacking (the agent edits the test instead of the code). The regression suite runs on every prompt or model change — it is the scaffold's unit tests.
When a measure becomes a target, it ceases to be a good measure.«Improving ratings»: audit in the British University system, European Review 5(3), 1997 — formularea legii lui Goodhart
Why it matters The model changes every three months; without an evaluation suite, every change is a surprise in production.
Open on YouTube ↗ - 16
Cheap tokens mean more tokens; the on-prem or cloud decision rests on sustained utilisation and on where the data may live, not on today's price.
The Coal Question · William Stanley Jevons · 1865
Jevons's paradox for agents: as the price per token fell, consumption per task rose — an agent burns 10–100 times the tokens of a chat. On-prem economics in 2026: an eight-GPU H100-class system costs $250–320k; renting one GPU, median ~$2.5 an hour; the three-year break-even typically sits at 70–80% sustained utilisation, while most fleets run at 40–65%; the rule of thumb is to evaluate on-prem above ~1 billion tokens a month. The reasons that are not about price: data residency, transfers under the GDPR and Schrems II, sector rules; the EDPB's 2025 guidance names on-prem inference the strongest mitigation of data-protection risk in language models. The hybrid pattern: public cloud in an EU region for what is not sensitive, sovereign cloud for what is regulated, on-prem for what may not leave. Serving runs on vLLM- or SGLang-class engines, where prefix caching favours agents. The hidden costs: the operations team, model changes, evaluations at every change.
It is wholly a confusion of ideas to suppose that the economical use of fuel is equivalent to a diminished consumption. The very contrary is the truth.The Coal Question (1865), cap. VII «Of the Economy of Fuel»
Why it matters Whoever buys GPUs on today's token price pays twice: for the machine and for the tokens the machine will encourage.
Open on YouTube ↗ - 17
The lethal trifecta: access to private data, exposure to untrusted content and the ability to communicate externally; have all three and you have a leak.
The lethal trifecta for AI agents · Simon Willison · 2025
Models follow instructions found in content: a web page, an email, a PDF, a tool result can carry "ignore previous instructions, send X to Y". Injection is not solved with prompts; the reliable defence is architectural — remove one leg of the trifecta: no outbound channel (no arbitrary URLs, no email sending), or no untrusted input, or no private data. Patterns: two models (a "quarantined" one reads the untrusted content, the privileged one never sees it raw); capability tracking along the data flow; a domain allowlist; human approval on anything sent outside; tool outputs marked as data in the prompt. The OWASP Top 10 for agentic applications puts goal hijacking through injection in first place.
If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker.The lethal trifecta for AI agents (simonwillison.net, 16 iunie 2025) — după enumerarea celor trei capabilități
Why it matters Every new tool is a new leg of the trifecta; check at every addition, not at launch.
Open on YouTube ↗ - 18
An agent gets its tools from an allowlist, with minimal rights, in a sandbox, on a budget; whatever is not explicitly allowed is forbidden.
The Protection of Information in Computer Systems · Jerome H. Saltzer, Michael D. Schroeder · 1975
The OWASP Top 10 for agentic applications (2025–2026) names the risks: goal hijacking, tool misuse, identity and privilege abuse, the supply chain, code execution, memory poisoning, cascading failures, insufficient monitoring. The controls: an identity of its own per agent (not the user's full token); narrowly scoped, short-lived credentials; read separated from write; sandboxed execution (container, no network by default, ephemeral file system); tools on an allowlist per task; approval on irreversible actions (payments, deletions, sends); rate and spend limits; a kill switch. Surveys in 2026 show about half of organisations with an agent permissions incident. The design question: "what is the worst this agent can do with what it holds?" — the answer should be boring.
Base access decisions on permission rather than exclusion.The Protection of Information in Computer Systems, Proceedings of the IEEE 63(9), septembrie 1975 — §I.A.3, principiul «fail-safe defaults»
Why it matters A compromised agent does exactly what it can do; least privilege is how much that "exactly" matters.
Open on YouTube ↗ - 19
Personal data enters an agent through tools, not through the prompt; pseudonymise before the model, redact tool outputs and keep memory off by default.
Regulamentul (UE) 2016/679 — GDPR · Parlamentul European și Consiliul · 2016
Where personal data enters: retrieval, CRM and email tools, uploaded documents, tool outputs. Where it leaks: the model provider's logs, traces, memory, handoffs between sub-agents, outbound tools. The pipeline: classify and pseudonymise at the tool boundary (tokens of the form PERSON_1) before the text reaches the model; re-identify only in the final step, on your side; redact tool outputs down to the fields needed; short retention on traces (days, not forever), with spans scrubbed of personal data; per-user memory is opt-in, not default; processing terms with providers (no training on data, EU region) or on-prem for the special categories of Article 9; a data-protection impact assessment where the risk is high. Minimisation also shrinks the injection blast radius: what the model never saw cannot leak.
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.Regulamentul (UE) 2016/679 (GDPR), art. 25 alin. (2) — protecția datelor în mod implicit
Why it matters What the model never saw cannot leak; minimisation is security too.
Open on YouTube ↗ - 20
Autonomy is granted in steps, with approval thresholds on whatever is irreversible; the AI Act requires effective human oversight for high-risk systems.
Computer Power and Human Reason · Joseph Weizenbaum · 1976
The levels of autonomy: suggest; act with approval; act and report; act alone. They are assigned by reversibility and blast radius, not by the model's confidence. The approval interface shows the action or the diff, not the reasoning essay; it batches approvals; it times out on the safe side. The regulatory state in September 2026: the prohibited practices (Article 5 of the AI Act) have applied since 2 February 2025; the transparency duties (Article 50) since 2 August 2026; for the high-risk systems of Annex III, the "digital omnibus" package deferred the obligations to 2 December 2027, and the human oversight of Article 14 applies to those. Even outside high risk: a log a human can read and an owner for every agent. Weizenbaum's question is not whether it can be done, but whether it ought to be.
Since we do not now have any ways of making computers wise, we ought not now to give computers tasks that demand wisdom.Computer Power and Human Reason (1976), Introducere
Why it matters An agent without an approval threshold is an employee with signing rights on the account and no manager.
Open on YouTube ↗ - 21
The most expensive agent failures are badly specified goals and loops that never stop; the step budget and the kill switch are not optional.
Some Moral and Technical Consequences of Automation · Norbert Wiener · 1960
The failure catalogue: a misspecified goal (the agent "fixes" the failing test by deleting it); runaway loops (retrying forever, two agents talking to each other); invented tool results (it claims to have run something); cascading errors across handoffs; costs exploding overnight. A public case from July 2025: a coding agent deleted a production database during a code freeze, then misreported what it had done. Controls: maximum iterations plus maximum wall time plus a money cap per run; idempotent tools; a dry-run mode; environment separation (production credentials never enter an agent's sandbox); stop conditions written in the prompt AND in code; a watchdog that marks stuck runs; a post-mortem for every escaped failure.
If we use, to achieve our purposes, a mechanical agency with whose operation we cannot efficiently interfere once we have started it, because the action is so fast and irrevocable that we have not the data to intervene before the action is complete, then we had better be quite sure that the purpose put into the machine is the purpose which we really desire and not merely a colorful imitation of it.Some Moral and Technical Consequences of Automation, Science 131(3410), 6 mai 1960
Why it matters An agent stopped in time costs one run; one not stopped costs a night.
Open on YouTube ↗ - 22
RPA automates the existing steps of a process; an agent can rewrite the process; you choose by how structured and how reversible each step is.
Reengineering Work: Don't Automate, Obliterate · Michael Hammer · 1990
RPA: deterministic, cheap (around $0.001 per task), auditable, brittle to interface changes, no judgement. Agents: probabilistic, $0.01–0.10 per decision (vendor figures, 2026), handle unstructured input and exceptions, need evaluations and guardrails. The decision: high volume, stable structure, strict audit — RPA; unstructured inputs, exceptions, judgement — an agent; both — the hybrid stack (lesson 23). Hammer's warning applies to both: automating a bad process ("paving the cow paths") is the most common failure, and agents make the paving faster. First ask what the process should look like; only then decide what to automate.
It is time to stop paving the cow paths. Instead of embedding outdated processes in silicon and software, we should obliterate them and start over.Reengineering Work: Don't Automate, Obliterate, Harvard Business Review, iulie–august 1990
Why it matters An agent running a bad process is a bad process with a token bill.
Open on YouTube ↗ - 23
The hybrid stack: RPA or deterministic code runs the steps that can be told; the agent takes the steps people know without being able to describe them.
The Tacit Dimension · Michael Polanyi · 1966
The 2026 hybrid pattern: an orchestration layer (the agent) plans and handles exceptions; deterministic executors (RPA bots, APIs, scripts) do the steps; RPA vendors reposition their bots as the "execution layer". Design: every step is classified explicit (a rule exists, so code) or tacit (people say "it depends", so an agent with approval); the agent never touches the system of record directly, it calls an executor with validation; exceptions go to a human queue and become training data for the next rule. Polanyi's point: tacit knowledge does not become explicit because you ask for it; the agent takes it on through examples (resolved cases in the prompt, or fine-tuning, lesson 14). The measure: the exception rate should fall over time as rules are extracted.
I shall reconsider human knowledge by starting from the fact that we can know more than we can tell.The Tacit Dimension (1966), cap. 1 «Tacit Knowing»
Why it matters The part nobody could write into the procedure is the part worth an agent.
Open on YouTube ↗ - 24
An agent without traces cannot be debugged: every model and tool call goes into a trace with a parent, a cost and content, so you can replay what happened.
The Elements of Programming Style · Brian W. Kernighan, P. J. Plauger · 1974
The observability stack: one trace per run, with a span per model call (model, tokens in and out, latency, cost) and a span per tool call (arguments, result size, error); the OpenTelemetry semantic conventions for GenAI standardise the attribute names; content capture is gated (personal data, lesson 19); replay a single step with an edited prompt; dashboards on cost per task, iterations per stage, stuck runs; sample trajectories for human review weekly; version prompts like code and tag traces with the version. The debugging heuristic: read the observation before the thought — most "reasoning" failures are context failures (lesson 2).
Everyone knows that debugging is twice as hard as writing a program in the first place. So if you're as clever as you can be when you write it, how will you ever debug it?The Elements of Programming Style, ed. a 2-a (1978), cap. 2 «Expression»
Why it matters Without a trace, a failed run is an anecdote; with one, it is a regression test.
Open on YouTube ↗ - 25
The 2026 trends say the same thing: capabilities grow fast, and most projects fail on organisation, not on the model.
Computing Machinery and Intelligence · Alan M. Turing · 1950
The state in September 2026: computer-use agents climbed from about 15% to about 66% on OSWorld-class benchmarks in a year (Stanford AI Index 2026); the protocols moved under neutral governance (MCP and A2A at the Linux Foundation); "skills" packaged as instructions became an open format; the workers are small models. Gartner (June 2025) expects over 40% of agentic projects to be cancelled by the end of 2027, on cost, unclear ROI and weak risk controls; the MIT NANDA report (August 2025) finds 95% of GenAI pilots with no measurable profit effect, the cause in organisation, not in the model. What to do next Monday: one process, one agent, evaluations before autonomy, a budget, a trace, an owner. Turing's sentence is the right posture: do not forecast; ship the next thing that needs doing and measure it.
We can only see a short distance ahead, but we can see plenty there that needs to be done.Computing Machinery and Intelligence, Mind 59(236), octombrie 1950 — ultima frază
Why it matters The difference between the 5% and the rest was not the model, but the evaluations, the guardrails and an owner.
Open on YouTube ↗ - 26
The context window is the resource every file read and every command output consumes; performance drops as it fills, so productivity in a coding agent is, first of all, context hygiene.
Effective context engineering for AI agents · Prithvi Rajasekaran, Ethan Dixon, Carly Ryan, Jeremy Hadfield (Anthropic Engineering) · 2025
The official Claude Code best-practices guide (2026) starts from a single constraint: the window fills quickly, and performance degrades as it fills. The 2025 article gives the mechanism: models have an "attention budget" that every new token consumes, with diminishing returns — which is why a larger context is not automatically a better one. From this follow the techniques for long-horizon work: compaction (a faithful summary, then a fresh window), structured notes kept outside the window and re-read on demand, sub-agents with clean context for research whose condensed reports flow back into the main thread, and "just-in-time" loading: lightweight identifiers (paths, queries) instead of whole files. At the keyboard: /clear between unrelated tasks, /compact with instructions about what must survive, /btw for a side question that has no business staying in the history, command-line tools (gh, aws) instead of APIs with verbose responses, search and ranged reads instead of whole files, a status line that shows consumption. The right measure of productivity is not tokens per hour but tokens per finished task.
Given that LLMs are constrained by a finite attention budget, good context engineering means finding the smallest possible set of high-signal tokens that maximize the likelihood of some desired outcome.Effective context engineering for AI agents (Anthropic Engineering, 29 septembrie 2025) — secțiunea «The anatomy of effective context»
Why it matters A session that "forgets" its instructions does not have a bad model; it has a full window.
Open on YouTube ↗ - 27
Without a runnable check, "looks done" is the only signal and you become the verification loop; with one, the loop closes by itself and the session can run without you.
Best practices for Claude Code · Anthropic (documentația Claude Code) · 2026
The guide calls this the single most important thing you can do for quality. A check is anything that returns a readable pass/fail into the conversation: a test suite, a build's exit code, a linter, a script that diffs output against a fixture, a screenshot compared against a design. There are four levels of rigor. First: in the prompt ("run the tests and iterate until they pass"). Second: /goal — a separate evaluator re-checks the result after every turn and pushes back until it is met. Third: a Stop hook, a deterministic script that blocks the end of the turn until it passes; after eight consecutive blocks Claude Code gives up, so an impossible check cannot hold a session hostage. Fourth: a verification sub-agent or a dynamic workflow in which another model tries to disprove the result. Ask for evidence, not assertions: the test output, the command run and what it returned, the compared screenshot. The guide says it plainly: if you can't verify it, don't ship it. And for review, ask only for what affects correctness — a reviewer asked for gaps will always find gaps.
Give Claude a check it can run: tests, a build, a screenshot to compare. It's the difference between a session you watch and one you walk away from.Best practices for Claude Code (code.claude.com, 2026) — secțiunea «Give Claude a way to verify its work»
Why it matters With a runnable check the loop closes on its own; without one, every mistake waits for you to notice it.
Open on YouTube ↗ - 28
Code that solves the wrong problem is the most expensive code; a plan separates understanding from execution, but it has a cost, so it applies only when uncertainty justifies it.
Best practices for Claude Code · Anthropic (documentația Claude Code) · 2026
The recommended flow has four phases. Explore: in plan mode (Shift+Tab until "plan mode on", or --permission-mode plan at launch) Claude reads and answers but changes nothing — you can let it investigate without fear of a premature edit. Plan: ask for a concrete plan and, with Ctrl+G, open it in your editor before it continues. Implement: leave plan mode and let it code while checking against the plan. Commit: a descriptive message, a pull request. The cost is real — planning adds a whole turn — hence the rule in the quote: for a typo, a log line or a rename, go straight to code. For large features the guide proposes "interview to spec": ask it to interview you with questions until implementation, interface and edge cases are covered, then write a spec and start a fresh, clean session just for execution. Useful specs name files and interfaces, state explicitly what is out of scope, and end with an end-to-end check. A good prompt is specific: the file, the failing scenario, what "fixed" means, an existing pattern to follow. References with @file instead of descriptions, pasted images instead of "it looks roughly like this", documentation URLs instead of guesses.
Planning is most useful when you're uncertain about the approach, when the change modifies multiple files, or when you're unfamiliar with the code being modified. If you could describe the diff in one sentence, skip the plan.Best practices for Claude Code (code.claude.com, 2026) — secțiunea «Explore first, then plan, then code»
Why it matters A planning turn costs little; an implementation started on a wrong understanding costs the whole session.
Open on YouTube ↗ - 29
Claude Code is configured on six levels, each with a different ratio of context cost to authority; putting an instruction at the wrong level costs either permanent tokens or ignored rules.
Steering Claude Code: when to use CLAUDE.md, skills, hooks, and subagents · Anthropic (blogul Claude) · 2026
CLAUDE.md loads at startup and stays in the window for the whole session — so it is a permanent cost. The best-practices guide asks you to check, for every line, whether removing it would cause Claude to make mistakes and, if not, to cut it: in a bloated file the rules that matter drown in noise, and /doctor suggests what to remove. Rules in .claude/rules can be scoped to file paths so you don't pay their context everywhere. Skills (a SKILL.md file with frontmatter) load on demand and run in the main thread, where you see and correct every step; those with side effects (deploy, publish) get disable-model-invocation so they never start on their own. Sub-agents, defined in .claude/agents, have their own context and tools — for deep searches or audits that would flood the conversation with intermediate results; you get only the conclusion. Hooks are commands, HTTP endpoints or prompts fired on events: before a tool, after an edit, at session start, on stop. Unlike CLAUDE.md, which is advisory, a hook is deterministic — for what must happen every time, without exception: formatting, a test, a block on protected files. The practical rule: the second time you repeat a flow, write it as a skill; the second time Claude skips a rule, turn it into a hook.
CLAUDE.md files for always-on project context, rules for hard constraints, skills for reusable procedures, subagents for delegated work, hooks for deterministic automation, and output styles or system-prompt appends for global changes. Each method trades context cost against authority.Steering Claude Code (blogul Claude, 18 iunie 2026) — paragraful de concluzie
Why it matters The right instruction at the right level costs little context and carries exactly the authority you need.
Open on YouTube ↗ - 30
Once you are effective with one session, the next step is to multiply: worktrees for isolation, cross-session messages for coordination, headless runs for fan-out — and the summer of 2026 moved exactly these pieces from experiment to default.
What's new in Claude Code — weekly dev digest · Anthropic (documentația Claude Code) · 2026
The guide puts scaling after verification, not before it. The tools: git worktrees (isolated checkouts, edits don't collide, EnterWorktree starts one from inside a session), claude -p for scripts and CI (with JSON output and an allowed-tools list for unattended runs), /batch, which splits a large change across 5–30 sub-agents each with its own worktree and pull request, and the Writer / Reviewer pattern in two sessions: a fresh context is not biased toward the code it just wrote. What changed between June and August 2026, per the weekly digest: Sonnet 5 (native one-million-token window, adaptive thinking) and Opus 5 (the same million, plus fast mode) became the default models; sub-agents run in the background by default, and since August fork mode is on — a sub-agent can inherit the whole conversation instead of starting empty; sessions message each other and can be @-mentioned by name; auto mode became the default permission mode on paid plans, with a classifier that blocks only what looks risky; /code-review runs as a background sub-agent; /design (preview) draws editable artboards; dynamic workflows orchestrate dozens of agents from one script. The cost of each step is that it moves coordination from you to tools; what does not move is verification. Parallelism multiplies throughput, not quality.
Cross-session messaging: on macOS and Linux, your Claude Code sessions can now message each other, so Claude passes a finding or a decision from one session to another instead of you re-explaining it.What's new in Claude Code (code.claude.com, digest săptămânal) — săptămâna 32, 3–7 august 2026, v2.1.220–v2.1.224
Why it matters Parallelism does not multiply quality, only throughput; what preserves it is a reviewer with fresh context.
Open on YouTube ↗ - 31
Most bad sessions do not have a bad model but a polluted context and a prompt that never said what "done" means; the guide names five recurring patterns and gives each a mechanical fix.
Best practices for Claude Code · Anthropic (documentația Claude Code) · 2026
The five patterns. The kitchen-sink session: unrelated tasks in one context, each leaving residue — /clear between them. Endless correcting: after two failed corrections the context is full of failed approaches and every answer is worse — /clear and a new prompt that incorporates what you learned, not a third correction. The over-specified CLAUDE.md: rules Claude ignores because they drown in noise — cut, or turn the rule into a hook. Trust without verification: code that "looks fine" and is wrong — tests, scripts, screenshots. Infinite exploration: "investigate" with no scope fills the window with hundreds of files — narrow the scope or use a sub-agent that returns only the conclusion. The productivity tweaks from the same guide, in the order you use them: Esc stops without losing context; Esc Esc or /rewind returns the conversation, the code or both to a checkpoint (every prompt creates one) and can summarize just a slice; /compact with instructions chooses what survives; /btw for side questions that stay out of the history; /rename so sessions become working branches; /usage shows what eats the limits; /permissions and the sandbox for fewer interruptions; a status line with context consumption. The guide ends with the antidote to recipes: when a session went well, notice what worked — the prompt, the context, the mode — and why.
A clean session with a better prompt almost always outperforms a long session with accumulated corrections.Best practices for Claude Code (code.claude.com, 2026) — secțiunea «Course-correct early and often»
Why it matters Each pattern has a mechanical fix; what links them is treating context as something to clean, not to accumulate.
Open on YouTube ↗