37,617 results · Most relevant
Mahmoud Abdelwahab recommends that when adding a new feature, you tell the agent to verify that the feature works end to end by actually running infrastructure and testing things end to end, noting agents are very capable of this once asked.
Have sales reps act like SDRs/BDRs who prospect and book discovery calls for the owner to close, rather than closing end-to-end themselves. Tell reps 'you'll make more money if I'm selling than you are. So do this for now', and still give them a commission on the deals they bring in. Having the owner close keeps them closer to the process so they can document it better and feedback loops are faster.
Hormozi recommends adding a VSL before every customer conversation: it primes and frames the conversation, edifies the seller, includes one CTA (e.g., 'text me your headcount / event date') that proves they watched it, and helps scale sales once you stop being the person selling. With a VSL and instant quote, you might be able to change from a two-call close to a one-call close, though two calls are acceptable at certain price points.
Attach conditions to the price lock — no date change, no venue change, and headcount can't change by more than 20% — otherwise the price is void. Confirm these scope boundaries verbally before closing, and if the client breaks the locks, have a different conversation rather than trying to jab them on price.
Hormozi advises pricing services at 5 to 10x internal costs (five being the minimum since estimates can go over), and using a price lock: charge the quoted price as long as the client doesn't change anything; if they change something, readjust and true up at the end.
Meet with your sales team every single day, not weekly, to drive performance. In morning check-ins ask 'what's your plan? How many touch points are you going to do?' and 'walk me through the leads that you're working. What kind of prep have you done for those calls and those reach outs so we can personalize them?' In end-of-day check-ins ask 'how the conversations go, where are we at with pipeline?'
Use a stable deployment surface (like HankWeek/Hankweave) that exposes a consistent, well-tested log and API interface with checkpointing, rollback, and budget enforcement.
The host recommends localizing prices and payment methods in the markets you sell in: present prices in the customer's local currency and support the local payment methods they expect. She cites Stripe data that companies presenting prices in local currency saw almost 18% higher cross-border revenue, and companies supporting at least one local payment method saw a greater than 7% conversion uplift.
Kim Maida recommends using token exchange — an existing standard published in 2020 that extends OAuth 2 — to solve the attribution and over-permission problems.
When you send a prompt, the agent proposes a mission including a goal, maybe allowed actions, and limits — e.g., 'triage incident 2294' means read that ticket, summarize, or escalate, but don't read other tickets or use other services. A low-risk activity like assessing a ticket might be auto-approved under admin policy; if the ticket has been read and the agent then asks to remediate a usage spike, the mission adds permission to scale the service once but not to use other tools or APIs. The mission is presented for the user to review and approve; once approved, the security token service gives the mission an ID sent to the agent. Tool calls include the mission ID and are proxied by the gateway, which uses the ID to ask the STS if the tool call fits the mission; if it fits, the gateway
When sending a prompt to the agent, have it propose a mission that includes a goal, allowed actions, and limits. A goal like 'triage incident 2294' means read that ticket, summarize, or escalate — but don't read other tickets and don't use other services.
Placement is something operators actually control: do not put an untrusted tenant's MIG slice right next to a sensitive model. Know the trade-off: MIG rules out peer-to-peer communication, meaning there is no tensor parallelism on MIG; sharding over NVLink instead limits what leaks to timing alone rather than the layer counts. Watch the GPU itself: make sure the host infrastructure is verifying that no malicious workloads are running on the hardware.
Operators should: shard sensitive models over NVLink instead of using MIG to limit what leaks to timing alone; know the trade-off that MIG rules out peer-to-peer communication (no tensor parallelism on MIG); not place an untrusted tenant's MIG slice right next to a sensitive model; verify host infrastructure checks that no malicious workloads run on the hardware; and verify monitoring solutions watch every kernel launch across every GPU with a full alert pipeline.
You can customize the level of severity of your rules; a rule does not have to be block-worthy, it just needs to be something that is addressed, and that is up to you. The deterministic part is that you can decide, based on the level of severity of the rule, that the branch or PR will be blocked. Configure in the Qodo portal that any action-required or high-severity issue blocks the merge until it is fixed, then Qodo runs again and verifies the fix.
Javier Garza recommends supply chain hardening: secure the critical path, for example running SBOM and AI BOMs very regularly, every time there is a change in the app.
Javier Garza recommends using an AI BOM — an inventory of all components in agentic applications — to quickly identify everything impacted by a zero-day in a specific model, dataset, or MCP tool and fix it.
Javier Garza recommends checking the code of any MCP tool you use — most people never read it, and it's easy to publish an MCP server with malware and wait for people to install it. Because MCP servers are long and hard to read manually, he recommends limiting what you install, only installing from sources you consider good, and using a tool that checks for malware and other issues in the code rather than reading it manually. Installing MCP servers with malicious code can get you into trouble: when an MCP tool asks you to do something and you accept, the MCP runs and may do something malicious, so verify the code before accepting.
Javier Garza recommends creating an agent hook that scans AI-generated code for vulnerabilities and fixes them in a loop until clean: whenever Claude generates code, use a security tool to scan it, re-scan after fixes, and rinse and repeat until the fix the tool generates has no security issues. He also suggests creating a rule or hook for a tool of your choice to secure any code the tool generates, and integrating Snyk security scanning into Claude or other AI coding tools through a system prompt.
Javier Garza says AI agents should never touch production directly, only through monitored CI/CD pipelines with safety measures in place.
Javier Garza recommends always putting a human in the loop for approvals for things like deployment to production or operations like deleting a database or making a user root.
Choose sources → to get a library of your own and a daily brief.