Blog
What we learned with our hands in it
Practical writing on AI agents, automation and getting your business found in AI search: how these systems are built, where they help, and where they go wrong. Written by the engineers who ship them, for the people deciding what to build.
31 articles · page 2 of 4
AI agentsHow to Add Human Approval to an AI Agent with LangGraph interrupt() and Temporal
Pause a LangGraph agent with interrupt(), bind the approval to a hash of the exact action, and use Temporal for approval waits that survive restarts.
30 Oct 202610 min
SecurityYour AI Agent Has Your Admin Token: Least-Privilege Access with OAuth Token Exchange and Entra Agent ID
Give each AI agent its own identity and short-lived, single-API tokens. When it acts for a person, use OAuth token exchange so it never exceeds their rights
30 Oct 202610 min
SecurityLLM Guardrails Compared for 2026: Bedrock Guardrails vs Azure Prompt Shields vs NeMo vs Guardrails AI
Bedrock Guardrails and Azure Content Safety are managed text checks; NeMo and Guardrails AI run in your code. What each catches, and what none of them do.
30 Oct 202611 min
SecurityMCP Security in 2026: The STDIO Flaw, 200,000 Exposed Servers, and a Checklist Before You Connect One
MCP is safe only if no untrusted party can write a server config. What the April 2026 STDIO disclosure means, and eight checks before you connect a server.
30 Oct 202611 min
AI governanceOWASP Top 10 for Agentic Applications (2026), Explained With a Fix for Each Risk
The OWASP Top 10 for Agentic Applications lists ten risks, ASI01 to ASI10, for AI agents that plan and act. Each one in plain words, with a fix you can build.
30 Oct 202610 min
SecurityPrompt Injection in AI Agents: Real Attacks, and Why Filters Alone Won't Stop Them
Prompt injection hijacks an AI agent through text it reads. Real attacks, why filters only reduce the risk, and the structural fixes that limit the damage.
30 Oct 202611 min
SecurityHow to Red-Team an AI Agent Before Launch with Promptfoo, PyRIT and garak
Red-team an AI agent by attacking its tools, not just its words: Promptfoo for app tests in CI, PyRIT for multi-turn attacks, garak for broad model probes.
30 Oct 202610 min
AI governanceShadow AI Agents: How to Find the Agents Your Company Doesn't Know It Runs
Shadow AI agents are automations that call AI models with real access but no owner on record. Find them in egress logs, OAuth grants, repos, laptops and spend.
30 Oct 202610 min
AI governanceSingapore's Model AI Governance Framework for Agentic AI: A Practical Checklist for Deploying Agents
Singapore's agentic AI framework is voluntary and asks four things: bound the risk, keep humans accountable, test and monitor, inform users. The checklist.
30 Oct 202611 min
Tell us which process is costing you.
Thirty minutes, no preparation, no deck. You describe what keeps going wrong and we tell you whether AI is the answer — including when it is not.
Prefer email? contact@devs-core.com