Blog
What we learned with our hands in it
Practical writing on AI agents, automation and getting your business found in AI search: how these systems are built, where they help, and where they go wrong. Written by the engineers who ship them, for the people deciding what to build.
31 articles · page 1 of 4
AI governanceAn Audit Trail for AI Agents That Holds Up: Append-Only Logs, Hash Chains and What Regulators Ask For
An AI agent audit trail records every proposal, policy decision, approval and action in an append-only, hash-chained log that shows any edit or deletion.
30 Oct 202610 min
AI agentsHow to Stop Runaway AI Agent Costs: Token Budgets and Rate Limits with an AI Gateway
Route every model call through an AI gateway that gives each agent its own key, budget, rate limit and model allow-list, and reserves the worst-case cost first.
30 Oct 202610 min
SecurityAn AI Agent Deleted a Production Database in 9 Seconds. Here's the Architecture That Makes It Impossible
An AI agent deletes production data when it holds a credential that allows it. Scoped tokens, a policy gate, bound approvals and off-site backups stop it.
30 Oct 202610 min
AI agentsAI Agent Observability with OpenTelemetry and Langfuse: Trace Every Tool Call and Decision
Trace AI agents with OpenTelemetry GenAI spans (invoke_agent, chat, execute_tool), add policy and approval fields, and send them to Langfuse, Phoenix or Datadog.
30 Oct 20269 min
AI governanceAn AI Governance Framework for a Mid-Size Company: What You Need Before Your First AI Agent
A mid-size company needs a one-page AI governance framework per agent: owner, authority map, risk tier, approvals, logs, tests, a kill switch and a review date.
30 Oct 202611 min
SecurityAI Finds Vulnerabilities Faster Than Teams Patch: A 2026 Security Checklist for Teams Shipping AI
AI now finds and exploits flaws faster than most teams patch. A checklist from October 2026: same-day patching, SBOMs, fail-closed scans and keys you can rotate.
30 Oct 202611 min
AI agentsCedar vs Open Policy Agent vs OpenFGA: Choosing a Policy Engine for AI Agent Authorization
Cedar suits per-call agent rules, OPA suits teams already on Rego, OpenFGA suits who-owns-what questions. We ran one refund-agent rule set in all three.
30 Oct 202612 min
AI governanceEU AI Act Articles 12 and 14 for AI Agents: Logging and Human Oversight in Practice
Article 12 makes high-risk AI log events automatically; Article 14 requires people who can understand, override and stop it. Both apply from 2 December 2027.
30 Oct 202611 min
SecurityAfter the Railway and OpenCode Leaks: Keeping API Keys and Secrets Away From AI Agents
Secrets in env vars and files are within reach of every process and agent. Give agents short-lived, scoped tokens via a broker, and rotate without redeploying.
30 Oct 202611 min
Tell us which process is costing you.
Thirty minutes, no preparation, no deck. You describe what keeps going wrong and we tell you whether AI is the answer — including when it is not.
Prefer email? contact@devs-core.com