Run Headless AI Agents Overnight: One Task, One Context
A frozen spec substitutes for the memory a disposable agent doesn't have - but only if every task is genuinely independent. The arithmetic for when a flat-rate build loop actually holds.
#permissions
13 posts tagged #permissions.
Review AI-Generated Code by Blast Radius, Not Uniformly
Your daily review-minute budget is fixed, but a missed bug's dollar cost isn't. Spend the same minutes unevenly by blast radius and cut expected losses by roughly half, without reviewing more.
Claude Code Stop Hooks: The Two-Tooth Completion Gate
While you watch an agent work, you are quietly doing two jobs: judging what it may touch, and judging when the work is actually done. Headless mode deletes you from both at once. The gate that inherits the second job fails two separate ways unless it has two teeth.
MCP Server Confirmation Gates: destructiveHint Plus Elicitation
destructiveHint plus elicitation gates a destructive MCP tool for clients that declare elicitation; for the rest, the fallback you write is the whole guarantee.
MCP Elicitation: Have Tools Ask for Missing Parameters
When a required tool parameter is a fact only the human holds, the two familiar responses, fail and guess, each cost one round trip on the wire and guarantee nothing. Under the MCP spec current since 2026-07-28, asking costs exactly two round trips, fixed, whatever the human answers.
MCP Server Security: the Confused Deputy Problem
The GitHub MCP server that leaked private repo names in May 2025 had no malicious code in it. The token's authority was ambient, good for every repo you can see. Scope it to the task and the blast radius drops 12x.
MCP Server Design: Keep API Keys Out of the Context Window
A raw token passthrough hands an injected agent all 34 endpoints of your billing API, five of them destructive. Hold the token server-side and expose three curated verbs instead: one bounded write, capped at $500 a call and logged.
MCP Tool Output Schema: Stop Trusting Agent Prose
A model has one procedure for turning tool bytes into a sentence, so a clean success and a swallowed failure read the same. On 12 refund calls, narration confirms 3 that never happened; a validated output schema confirms zero.
Headless AI Code Review: One Check for Local and CI
Your local review habit and your CI gate are two implementations of one question, and nothing forces them to agree. Write the policy once, pin the context, and both surfaces run literally the same check for about two cents a call. The same 30 weekly pull requests on Anthropic's managed Code Review run $450 to $750.
AI Agent Permissions: Gate Irreversible Actions, Not Diffs
Permission systems that gate on scariness ask about everything and protect nothing. Gate on reversibility instead, and the same 12-call session drops to 3 interrupts without losing the one that counts.
Autonomous AI Coding Agents: Trust Comes From a Small Blast Radius
The blocker to running an agent overnight was never capability - it's trust. Layer a sandbox, an allowlist, and a scoped credential right, and one laptop's worst-case reach falls from 399 addressable things to 63, all recoverable with git checkout.
Prompt Injection Defense: Mark the Channel, Not the Words
The model cannot tell an instruction from data, because both arrive as tokens in one flat stream. The defense that measured best marks which channel a token came from. It never reads the words.
One MCP Server Replaces Every Custom Tool Integration
A team wiring three agent surfaces to three systems by hand pays for nine adapters, 108 hours of year-one work. One MCP server per system, pointed at from each agent, costs 40.5 hours, and the ratio climbs with every agent the team adds.