A working journal by Eric MacDougall

Notes from inside the work.

On agents, engineering judgment, infrastructure, and the gap between a convincing demo and a system you can trust.

Eric MacDougall Built in public, with sources and the edges left visible.
FIELD NOTE / 001OBSERVE THE OUTCOME
Work, controls and independent evidence meet at the release decision
Faster work needs
better evidence.
FIELD NOTE 01
AGENT ENGINEERING ✳ COMPUTER USE ✳ COMPUTE FABRICS ✳ INDUSTRIAL AI ✳ ENGINEERING TEAMS ✳ MODEL CONTROL

01 / Watch

The films, in one playlist.

33 overview films. Each one has a full written essay behind it.

Field essayParallel AI checks need a release contract before they need more workers
Field essayMemory success has to confirm the requester, address and receipt
Field essayA semantic firewall needs an enforcement architecture
Field essayGive each agent turn its own authority
Field essayDesign the authority boundary between a chatbot, an assistant and an agent
Field essayRecheck current policy authority before protected bytes leave
Field essayRoute AI work by the cost of accepted outcomes
Field essayUnknown is an outcome: designing agent systems around lost replies
Field essayDurable agents need agreement between delivery, ownership and effects
Field essayWe measured local safety models. The hard part was deciding what “works” means.
Field essayBudget agent work before dispatch, then reconcile what actually happened
Field essayTurn engineering standards into agent execution contracts
Field essayExact-effect approvals: bind the request, preserve the meaning, verify the outcome
Field essaySupervising AI agents: queues, steering, interrupts and bounded learning
Field essayAuthorized recall: why a safe retriever can still find nothing
Field essayRead can send: designing browser egress for AI agents
Field essayWhy a streaming security check can be too late
Field essayBuild the tool broker around the authority that survives alternate paths
Field essayWhere JEV earned a decision, and where we replaced it
Issue 14The demo worked. The engineering problem began afterward.
Issue 13The agent timed out after the change went through
Issue 12The agent missed the one fact that mattered
Issue 11The schema is green. The action is wrong.
Issue 10The attention drift bubble
Issue 09What computer-use agents can prove
Issue 08The release gate is the product
Issue 07Hire engineers for the decisions
Issue 06Your agentic workflow depends on other people’s rules
Issue 05AI in industrial control needs physical evidence
Issue 04The GPU number is not the compute product
Issue 03Where model control actually lives
Issue 02Model consensus is not engineering evidence
Issue 01Agents need an independent exam

02 / Latest essays

Long reads, newest first.

Oct 20, 2026Development, delivery and runtime architecture

Build the test harness around cross-system invariants

A test should encode the business or security promise across components, with an oracle independent of the actor and an outer containment boundary.

12 min read · Published Oct 20, 2026
Oct 20, 2026Development, delivery and runtime architecture

Separate probabilistic development from deterministic shipping

Models can propose changes and repairs. A narrow release controller can decide whether exact reviewed and tested artifacts meet a fixed contract, without reasoning its way around it.

11 min read · Published Oct 20, 2026
Oct 20, 2026Distributed execution and policy

Regional cells need one home for mutable authority

Portable containers do not make state ownership, residency and failover portable. Define one authoritative home for mutable state before adding regions.

12 min read · Published Oct 20, 2026
Oct 20, 2026Distributed execution and policy

Agent fleets need explicit ownership transfers before more workers

More workers help only when task ownership, resource admission and shared-state authority remain coherent.

12 min read · Published Oct 20, 2026
▶ FILM
Oct 20, 2026Distributed execution and policy

Parallel AI checks need a release contract before they need more workers

Parallel checks help only when the release condition, ownership of output fields and behavior of late branches are defined in advance.

12 min read · Published Oct 20, 2026
▶ FILM
Oct 20, 2026Assistants, identity and authority

Memory success has to confirm the requester, address and receipt

Memory changes future behavior across turns. Tenant scope, namespace, origin, current permissions and deletion semantics matter as much as retrieval relevance.

12 min read · Published Oct 20, 2026
▶ FILM
Oct 19, 2026Economics, workflow design and recovery

Design agent supervision around delivery, intervention and bounded learning

Use deterministic event observation, bounded independent model judgment and a constrained intervention controller; spend review effort where it changes accepted outcomes.

13 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Economics, workflow design and recovery

Budget agent work before dispatch, then reconcile what actually happened

A token counter after completion cannot enforce a hard pre-dispatch exposure bound across parallel work and ambiguous provider outcomes.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Economics, workflow design and recovery

Route AI work by the cost of accepted outcomes

Choose among routes that preserve privacy, authorization, tool semantics and required quality, then optimize expected accepted-work cost under quota and latency constraints.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Development, delivery and runtime architecture

Turn engineering standards into agent execution contracts

Agents need explicit constraints at admission, implementation, review and release, connected to the product decision that justified them.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Distributed execution and policy

Recheck current policy authority before protected bytes leave

An immutable signed policy revision is an evidence artifact. Current authorization can change while model inference or transformations are running.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Distributed execution and policy

Unknown is an outcome: designing agent systems around lost replies

A timeout does not determine whether an external action happened. Retrying safely requires a durable operation identity and a reconciliation path.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Distributed execution and policy

Durable agents need agreement between delivery, ownership and effects

A workflow is more than a queue. State changes, durable delivery, worker ownership and publication authority must agree across retries and crashes.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Semantic firewalls, retrieval and evaluation

Where JEV earned a decision—and where we replaced it

Evaluate decision systems per class and effect: dynamically constrain candidates, use JEV where measured, and replace or escalate it when deterministic scenarios or stronger models own the uncertainty better.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Semantic firewalls, retrieval and evaluation

Authorized recall: the retrieval budget has to belong to the caller

A retrieval system must preserve authorized recall, freshness and evidence coverage while keeping token and latency costs bounded.

12 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Semantic firewalls, retrieval and evaluation

A browser is an outbound capability: how I separate destination, data and authority

Read-looking operations can send information outward through URLs, redirects, images, unfurls and fetched resources.

12 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Semantic firewalls, retrieval and evaluation

Fourteen cuts through a streaming security boundary

A whole-response security decision cannot protect bytes already delivered. Define the protected unit and release boundary before choosing streaming UX.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Semantic firewalls, retrieval and evaluation

We measured local safety models. The hard part was deciding what “works” means.

Secret detection, exact redaction and content classification are different jobs. A cheap classifier that finds everything can still be unsuitable because it blocks ordinary traffic or cannot identify spans.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Semantic firewalls, retrieval and evaluation

A semantic firewall needs an enforcement architecture

Semantic detection supplies a risk signal. The durable protection comes from the places that control reads, actions, disclosure and rendering even when the detector misses an attack.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Assistants, identity and authority

Build the tool broker around the authority that survives alternate paths

A model proposes a typed action; an independently authorized executor controls credentials, object access and effectful routes.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Assistants, identity and authority

Make human approval survive changes in payload and context

A human approval becomes useful execution authority only when it commits to the action’s identity, payload and current effect context.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Assistants, identity and authority

Give each agent turn its own authority

Keep the stable bot/service identity separate from the human authority delegated for one turn. Recompute authorization as the conversation and its audience change.

11 min read · Published Oct 19, 2026
▶ FILM
Oct 19, 2026Assistants, identity and authority

Design the authority boundary between a chatbot, an assistant and an agent

Capability growth changes the system’s trust model. Public explanation, authenticated account help and autonomous action deserve distinct data paths, identities and acceptance criteria.

12 min read · Published Oct 19, 2026
Sep 28, 2026Harnesses and protocols · Issue 16

Name the layer before you merge the stack

MCP is tools and data. UHP draft is the product-to-harness job contract. Execution substrate is where the agent runs. Name the layer before you merge the stack.

14 min read · Published Sep 28, 2026
Sep 28, 2026Harnesses and effect boundaries · Issue 15

Your hook ran. Did the forbidden action stay blocked?

How to prove an agent control protected the consequential target across tools, shells, delegation and service credentials.

15 min read · Published Sep 28, 2026
▶ FILM
Sep 25, 2026Engineering ownership · Issue 14

The demo worked. The engineering problem began afterward.

Why a convincing agent-built demo is the beginning of product ownership and engineering evidence.

14 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Agentic operations · Issue 13

The agent timed out after the change went through

How to recover an agentic operation when the reply is lost after the effect begins.

15 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Agent context architecture · Issue 12

The agent missed the one fact that mattered

A field guide to specialist memory, source-linked context packets and intervention timing when retrieval misses a consequential condition.

12 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Decision-model architecture · Issue 11

The schema is green. The action is wrong.

What token masks can guarantee, what typed confidence cannot prove, and where evidence, service authority and readback finish the job.

10 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Organizational attention · Issue 10

The attention drift bubble

AI can generate every plan, summary and task while a decisive condition quietly disappears. Measure attention debt and preserve source-linked decisions across every handoff.

13 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Computer use · Issue 09

What computer-use agents can prove

A field guide to browser, desktop, and app agents: speed, blind spots, and outcome-level testing.

13 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Software delivery · Issue 08

The release gate is the product

Agent-written code can pass every test for a shortened requirement. A release needs the source product decision, exact artifact, independent evidence and a bounded customer readback.

12 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Engineering teams · Issue 07

Hire engineers for the decisions

Architecture, attention, communication, focus, and fundamentals when agents write more of the code.

13 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Operational risk · Issue 06

Your agentic workflow depends on other people’s rules

A provider refusal or changed policy can become a silent business decision unless the workflow preserves unfinished work, evidence and an authorized fallback.

12 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Industrial AI · Issue 05

AI in industrial control needs physical evidence

Where AI helps PLC engineering, and where simulation, safety review, and plant reality retain authority.

12 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Compute infrastructure · Issue 04

The GPU number is not the compute product

Neocloud placement, fabric topology, sharing, queue policy, utilization, and the real cost of a completed run.

10 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Model systems · Issue 03

Where model control actually lives

What a typed decision can actually control: full-path Jev versus small-model economics, provider-owned loops, scoped tools, context and engineering ownership.

13 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Engineering judgment · Issue 02

Model consensus is not engineering evidence

What model debate can reveal, what polished probing cannot supply, and how real experiments turn a design into an engineering decision.

14 min read · Published Sep 25, 2026
▶ FILM
Sep 25, 2026Agent engineering · Issue 01

Agents need an independent exam

The practical controls that let a fast coding agent produce work you can actually sign off.

11 min read · Published Sep 25, 2026
All essays and issues ↗

02 / What I keep returning to

Questions worth
staying with.

01
{ }

Agents & control

Hooks, worktrees, role memory, and where instructions need to become enforceable systems.

02
✓

Testing what happened

Browser and desktop agents, independent oracles, fault injection, and evidence you can sign off.

03
⌘

Compute in reality

Open-weight deployment, neocloud fabrics, queue policy, topology, and completed-run economics.

04
↗

People & decisions

Engineering hiring, SDLC design, industrial AI, and what stays with humans as execution accelerates.

03 / Short explainers

Sixty seconds, one idea.

04 / Latest posts

What I posted this week.

Oct 20, 2026

Post-GPU is usually three different ideas sharing one headline, and all three are really about moving data. Where is your team's infrastructure planning on that curve? #EricFieldNotes

Open on X ↗
▶ VIDEO
LinkedInOct 20, 2026

A company evaluating local AI should compare delivered work, not model ownership in isolation. A smaller local model, a hosted frontier API and a dedicated cluster have different privacy, latency, operating and quality profiles. Define the …

Open on LinkedIn ↗
LinkedInOct 20, 2026

It is easy to buy more agent seats. It is harder to create the owner time needed to decide what those agents should build and whether their work is acceptable. Picture ten parallel patches blocked on one unresolved tenant policy. A model c…

Open on LinkedIn ↗
Oct 20, 2026

If ten agents wait on one tenant-policy answer, the next license is not the highest-value purchase. Give an accountable owner a short decision queue, evidence packets and a response window. Then add lanes only as accepted work grows. #EricF…

Open on X ↗
Oct 20, 2026

I overwrote a running script, and bash ran a command nobody wrote. Never edit a running script in place. #EricFieldNotes

Open on X ↗
▶ VIDEO
LinkedInOct 20, 2026

A rule in a markdown file is useful guidance. It is not the same control as a pre-tool gate, a post-tool readback or a capability limit outside the worker. This film separates those layers. Agent instructions can explain intent. Hooks can …

Open on LinkedIn ↗
LinkedInOct 19, 2026

An agent rollout can make the activity dashboard look fantastic: more runs, more diffs, more test summaries. The business may still wait longer for a correct release. Suppose three agents implement three versions of the same tenant excepti…

Open on LinkedIn ↗
Oct 19, 2026

A team doubles agent runs and PRs; release lead time rises because policy decisions wait on one owner. Count accepted changes, review age, integration rework and reversals by work class. More activity is a hypothesis about productivity, not…

Open on X ↗
Oct 19, 2026

A model's confidence is the model's opinion of itself. It shouldn't be what moves money. In the systems I build, the model proposes and something else decides. #EricFieldNotes

Open on X ↗
LinkedInOct 19, 2026

My AI agent coordination project ended BLOCKED, and I am publishing the scorecard anyway. The question was how coding agents on Claude Code, Codex, Grok Build and Muse can message each other, wake each other, follow instructions and be hel…

Open on LinkedIn ↗
LinkedInOct 19, 2026

Hook support is not one universal property of an agent product. The meaningful question is whether your callback runs inside the exact loop that can cause the effect. A team registers a pre-tool rule for local shell commands and assumes th…

Open on LinkedIn ↗
Oct 19, 2026

A pre-tool hook may see local shell calls while a hosted worker owns another loop. Inventory routes, inject a harmless forbidden action, capture the hook receipt and read the target. Deny at the credential boundary when the callback is out …

Open on X ↗
LinkedInOct 19, 2026

My main agent sessions re-read about half a million tokens on every turn. I measured it across 35 days and 5,835 transcripts. Every request re-reads the whole conversation, and in my long-running sessions the median turn carried roughly 45…

Open on LinkedIn ↗
▶ VIDEO
Oct 19, 2026

“It loads” is not “it serves.” Offload, cold start and queueing can dominate. Keep the placement that meets the whole contract. #EricFieldNotes

Open on X ↗
LinkedInOct 19, 2026

A router may choose a valid tool bundle and still send the worker into a different permission set. The gap between selection and dispatch is a normal time-of-check/time-of-use boundary. In a disposable fixture, give the router a read-only …

Open on LinkedIn ↗
Oct 19, 2026

A router picks a read-only tool bundle. Before dispatch, the same name gains a write route. Fingerprint schema and scope with the choice; change one harmless field in a test. Dispatch must reject stale authority and log any fallback. #EricF…

Open on X ↗
Oct 19, 2026

An agent can implement a change and write its own tests in one run. That is useful speed. It is also one interpretation producing both the work and the evidence. Let the worker write useful tests. Keep the final verdict independent. #EricF…

Open on X ↗
▶ VIDEO
LinkedInOct 19, 2026

Kimi K3's model card lists two point eight trillion total parameters, one hundred four billion active per token and native four-bit weights. Sparse activation changes compute. The full expert set, memory capacity, movement and concurrent se…

Open on LinkedIn ↗

05 / Follow the work

Every channel, one place.

20+years in tech

04 / A little context

I’m interested in what
survives contact with reality.

I have spent more than two decades in technology, from founding and exiting a software development and marketing agency to engineering leadership roles and co-founding FrameBright. This journal is where I work through what that experience is teaching me now.

More about the road here