Blog — all articles
Every opsagent article on agent security, MCP, governance, observability, evals, orchestration, and oversight — newest first.
Agentic engineering: the discipline that takes an agent from prototype to production
What agentic engineering is, how it differs from prompt engineering and orchestration, and how opsagent's seven pillars fit together as one engineering process for building agents you can trust in production.
Read →Indirect prompt injection: detecting and defending against it in your agent pipeline
How to detect and contain indirect prompt injection in a production agent pipeline — content isolation, provenance, output filtering and the layered defenses that shrink the blast radius.
Read →Red teaming AI agents: building a red-team program in your organization
How to stand up an agent red-team program as a repeatable process — scope, cadence, roles, and how organizational red teaming of autonomous agents differs from a one-off pentest.
Read →Memory poisoning: defending an agent's memory in production
How to defend a production agent's long-term memory and retrieval store against poisoning — validation, provenance, segmentation and expiry that stop false data biasing future decisions.
Read →The OWASP Top 10 for Agentic Applications: mitigating each risk in production
A production playbook for the OWASP Top 10 for Agentic Applications: how to meet and mitigate each of the ten risks with concrete controls, guardrails and governance.
Read →Tool poisoning: when an agent's tools turn against it
How tampered tool descriptions and crafted tool outputs steer autonomous agents into harmful actions — and the validation, isolation and provenance controls that stop it.
Read →AI Act Article 50: transparency in agent operations
How to meet EU AI Act Article 50 transparency duties in day-to-day agent operations by 2 August 2026 — AI disclosure, content labeling and deepfake marking, wired into your runtime.
Read →The EU AI Act timeline for autonomous agents
When each EU AI Act obligation actually bites — and what teams shipping autonomous AI agents must have ready for the Article 50 transparency deadline on 2 August 2026.
Read →Excessive agency: the most damaging agent risk
Why over-broad permissions turn a small agent mistake into a major incident — and how least privilege, scoped tools and approval gates contain the blast radius.
Read →EU AI Act vs GDPR: two regimes your agents must satisfy
Why GDPR compliance does not cover the EU AI Act, where the two overlap, and what an autonomous agent has to satisfy under each.
Read →Writing a company AI policy that actually governs agents
A practical template for an internal AI policy — the sections that matter, how to cover autonomous agents and Shadow AI, and how to keep it from becoming shelfware.
Read →ISO 42001 for agents: an AI management system, step by step
What ISO/IEC 42001 requires, how it complements the EU AI Act, and a practical path to an AI management system that actually governs autonomous agents.
Read →MCP security: secure configuration, identity and gateway authorization
How to run the Model Context Protocol safely in production: an MCP gateway, authorization and scoping, and non-human identity controls that keep agent tooling under control.
Read →Agent observability: seeing what your AI actually does
Tracing, metrics and cost control for autonomous agents — the five things to measure and how OpenTelemetry became the de facto standard for agent observability.
Read →MCP gateways and runtime authorization for agents
Why agents need an authorization decision at the moment of each action — and how an MCP gateway centralizes policy, approvals and audit for tool access.
Read →Non-human identity: governing the agents that act for you
Agents authenticate as machine identities, not people. Here is why non-human identity is now a core control — and how to inventory, scope and rotate it.
Read →The OWASP MCP Top 10: securing the protocol agents run on
A practical walkthrough of the OWASP MCP Top 10 — the security risks specific to Model Context Protocol servers — and the controls that address each.
Read →Zero-trust for AI agents: implementing never-trust, always-verify in production
How to operationalize zero-trust for autonomous agents and the tools and agents they call — identity, policy enforcement and segmentation that make continuous verification real in production.
Read →Agent cost control: FinOps for autonomous AI
Why cost is a first-class signal for agents, what actually drives the bill, and how token tracking, loop detection and budgets keep an autonomous system affordable.
Read →Evaluating AI agents: from evals to reliable production
How to evaluate autonomous agents you can trust — LLM-as-a-judge done right, the metrics that matter, and the CI/CD quality gates that keep agents from regressing.
Read →The production metrics that tell you an agent is working
Six metrics — completion, accuracy, hallucination, latency, cost and satisfaction — that turn an agent from a black box into a system you can actually run.
Read →Tracing AI agents with OpenTelemetry
How to instrument autonomous agents with OpenTelemetry's GenAI conventions so every reasoning step, tool call and cost is captured in one portable trace.
Read →Agent benchmarks: what τ-bench and friends do and don't tell you
How to read agent benchmarks like τ-bench, MCP-Bench and AgentBench — what they measure, where they mislead, and why your own evals still matter most.
Read →Agent memory architecture: short-term, long-term, episodic
How autonomous agents remember — the three kinds of memory, when to use each, and why governing the memory layer is both a capability and a security decision.
Read →Agent orchestration: LangGraph vs CrewAI vs AutoGen and beyond
A vendor-neutral comparison of the main agent frameworks — LangGraph, CrewAI, AutoGen, OpenAI Agents SDK and Google ADK — and how to choose between single-agent and multi-agent designs.
Read →Regression testing for AI agents: stop fixing one thing and breaking three
Why a golden dataset and CI gates are the only reliable defense against silent agent regressions when models, prompts and tools change underneath you.
Read →LLM-as-a-judge: calibrate it before you trust it
How to make an LLM judge reliable — aligning it to human labels, killing position and verbosity bias, and knowing when a judge is measuring quality versus its own preferences.
Read →Agent guardrails: the automated limits around autonomy
Input, output and behavioral guardrails form the safety layer that lets an agent act fast without acting dangerously. Here is what each does and how they fit together.
Read →Kill switches and circuit breakers for AI agents
Every autonomous agent needs a reliable way to stop. How to design kill switches and circuit breakers that actually halt an agent that loops, overspends or drifts.
Read →Context engineering: giving an agent what it needs, not everything
Why what you put in the context window decides an agent's quality, cost and safety — and the discipline of assembling the right context at each step.
Read →Graduated deployment: raising agent autonomy without incidents
A five-stage path — dry-run, read-only, simulation, staging, production — for giving an AI agent more autonomy only after evidence says it is safe.
Read →Human oversight and agent autonomy: HITL, HOTL, HOOTL
The spectrum of human oversight for AI agents — from human-in-the-loop to human-out-of-the-loop — plus guardrails, kill switches and a graduated path to raising autonomy safely.
Read →Shadow AI: the agents and tools running without your oversight
Why unsanctioned AI use is the most common governance gap — and how to bring Shadow AI into the light without driving it further underground.
Read →Single-agent or multi-agent? A decision guide
When to split a task across multiple AI agents and when one is enough — the real costs of multi-agent systems and a simple test for whether you actually need one.
Read →