37,617 results · Most relevant
Build a script that proves the work deterministically across a number of checks and feeds output back to the agent. Pin verification to a single command backed by actual bash commands because LLMs are non-deterministic and 30 agents with the same prompt produce variance. The agent can run the script repeatedly — run, check, verify, run again — until there are no more errors.
Require actual screenshots, videos, test results, and smoke tests as proof that an agent did the work. Accepting an agent's verbal claim that 'it passes, it looks good' without backing evidence leaves you with nothing to verify the work.
endorsed
Give your agents the ability to see all aspects of performance — networking, traffic, rendering, etc. If you're shipping a web app, give your agent Chrome DevTools. If you're shipping native clients (iOS or OSX apps), attach alternative observability projects, with more coming out every day. The common foundation across all platforms is that you need to give your agent the ability to see absolutely everything you would normally see as a developer. The more eyes you give your agent, the more it will be able to take over from you.
endorsed
Denys recommends having technical implementations and detection systems to safeguard your own data cleanliness. Unless you have good systems to detect duplicate records, you just keep getting the same bad quality data. Once you can detect duplications, you no longer incentivize things like sending claims multiple times with different dates or the same claim. As an organization, you have to have lines of defense in order to make sure that missing records get flagged.
With claims data extracted, insurers can analyze what affects loss ratio, claim types, geographies, injury types, and doctors involved; map which lawyers, doctors, chiropractors, and physiotherapists work together; analyze which medical conditions co-occur (mapped to ICD codes) and compare write-ups from different doctors; analyze patient travel within provider networks; estimate treatment cost changes over time (e.g., a 10% year-over-year increase for a treatment type for a given doctor); and do counterfactual analysis on network changes, billing changes, and standard-of-care procedures.
Consequential creator advice requires independent verification before Today can promote it.
When a new model claim arrives via Slack or social media, Martone recommends not trusting public benchmarks. Instead, set the model up and run an internal experiment against your own benchmarks — ideally via a closed-loop system (e.g., a Kubernetes loop) that automatically benchmarks new claims on your own data.
endorsed advice
The agent's action log must be outside the agent's primary hands and brains because you can't trust the agent itself; you must be able to answer who did it, which is where the tamper-resistant auth log comes from.
The creator recommends putting the brain (model/LLM) in a sandbox with the tools inside it, and placing an egress proxy outside the sandbox as the authorization boundary. Building an agent loop with the brain inside the loop rather than outside the loop is easy to do and problematic. You can control what's inside the sandbox so it can't get API access on its own, and apply authorization at the egress proxy boundary rather than inside the agent.
Production agent teams should discover what's running and what the agent's capabilities are, validate inputs and outputs, and constrain agents using egress proxies and different networking rules.
The creator recommends keeping credentials and access separate from the agent itself so there is no broad standing access the agent has, noting that agents are deeply goal-seeking, so a random key found on a disk will be used by the agent.
Give agents a token that is both time-limited and budget-limited; access ends when the token expires or the budget is exhausted, and a supervisor — not blunt rate limiting — decides whether to grant more budget.
The creator recommends giving agents a token that is time-limited and also carries a budget of how much resource they can consume, and providing continual feedback to the agent about how much budget was consumed and how much budget remains so it can operate within a budget like a person would. Traditional rate limiting just cuts an agent off and the agent doesn't know why it got cut off.
Ian recommends using broad-based deterministic policy that says what must never happen, or what always requires a human to be involved. He describes that there's a big gap between the policy you can write as a human or organization and what you actually want the policy to be in the specifics of a specific task, and humans can't write it all. He recommends layering deterministic policy with user-or-agent-to-agent interaction that carries transactional intent between the two, plus the business's intent for the specific task.
The creator recommends that there should be a separate supervising agent that decides what the worker agent gets to do, with separation of concerns: the supervisor can't do any of the work but decides what the worker does. Dick similarly recommends having a supervising agent that runs your policy and is independent of the agent doing the work. The creator gives examples: a request to read someone else's email gets caught in deterministic policies right away — it's not vague, and good controls exist for it. But telling an agent to forward the CEO's email to the outside world is vague, and ideally a supervising agent would catch it and say that's a bad idea and no, you can't do that.
Ian recommends that the auth log has to be outside the primary hands and brains of the agent because you can't trust the agent itself. He also recommends maintaining a record of who told the agent to do what thing, for what purpose, and whether that is still true — independent of enforcement points or vulnerability patching — and having the ability to answer the liability question of who did it, which is where the tamper-resistant auth log comes from.
Put the agent's brain (the model/LLM) in a sandbox with the tools inside so it can't get API access directly, and place an egress proxy outside the sandbox as the authorization boundary — it does translation between systems, hosts OAuth, and applies authorization at the boundary.
To climb the hill of a capability eval you can work on the prompt again or upgrade the model. You can run the experiment again by passing a new model (Haiku 5.5) and running npm experiment. You can't switch models without evals — evals are what make model switching possible because you're measuring everything. Running the experiment with three repetitions takes 13 minutes. Switching from Haiku 4.5 to 5.5 improved faithfulness more than three times, but it is still terrible — the agent is still making things up all the time. Consistent calls got better, so it is at least making the same call over and over. Upgrading the model also costs four times as much money, and whether that is worth it is a question you need to make for yourself in production.
An experiment in Phoenix is a dataset, a task, and evaluators; the task is a function that runs the agent on each example. Phoenix runs the task on every example, scores every result, and stores everything for comparison. The task hands back the report and research, and each eval gets a small wrapper that picks out the fields it needs (faithfulness gets the research as context). You can run the experiment with npm run experiment, which takes about four minutes, and you can target a specific subset of the agent's behavior or a subtask rather than the whole agent.
Run the judge against the humans as an experiment — an experiment in Phoenix takes a dataset, a task to run on every example, and evaluators to score the results. In the meta-evaluation, the task is the judge and the evaluator checks whether the judge's label matches the humans. Only run the meta-evaluation on the dev split, not the test split. Attendees can run it themselves with npm run meta.
To create an eval that runs in CI, use vTest, a JavaScript test runner Phoenix can plug straight into. agent.eval.ts looks like an ordinary test file because it is one — a describe block and a test for each query in the regression set (Coca-Cola, Apple versus Microsoft, Rivian, and the fake ZZZQ). Each test runs the agent, logs the report as the output, and runs the same evals written earlier — no new evals are needed for CI. At the bottom of the file you gate the build on acceptance criteria: actionability is a target with the average having to stay 0.8 or better, and you gate on the average score, not a single report, because an LLM judge can be noisy on a single report. You can run npm test like any test suite; the reporter prints a scorecard in about four minutes. In a red build where,
Choose sources → to get a library of your own and a daily brief.