How to Build Safe AI Agents With Boundaries, Approvals, and Persistent State

·1 views

A structured AI agent system goes far beyond a simple model request-response cycle, requiring an orchestration layer that governs planning, tool use, and task execution. Rather than granting models unrestricted access, developers should define explicit boundaries covering what the agent can see, what tools it can call, and which actions need human approval. An AI agent is best understood as a composite system — model plus orchestrator, state, tools, policies, and verification — with the application retaining full responsibility for authorization. Agent workflows should be organized around persistent session and task objects with clearly defined statuses such as RUNNING, WAITING_APPROVAL, and COMPLETED to keep long-running processes manageable. Explicit state transitions and continuous observation at each step are essential to prevent the agent from losing track of prior actions or executing duplicate operations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Quad9 Offers Free DNS Resolver Focused on Security and Privacy

Quad9 is a nonprofit service providing a free recursive DNS resolver designed to enhance user security and privacy online. The service blocks access to known malicious domains by leveraging threat intelligence from multiple cybersecurity partners. Unlike commercial DNS providers, Quad9 does not collect or sell user data, making privacy a central feature of its offering. Users can configure their devices to use Quad9 as an alternative to default DNS resolvers provided by internet service providers.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Study Finds Multi-Agent AI Orchestration Uses 52% More Tokens With Minimal Gain

Researcher Mohammad Fauzel Sadeghizad conducted 45 controlled experiments across 20 programming tasks to measure the real cost of splitting AI agent workflows into coordinated subsessions versus running them in a single inline session. The orchestrated arm consumed 52% more tokens and took 38% longer on average compared to the inline approach, while success rates fell marginally from 85% to 82%. The key trade-off identified was context size: the coordinator's context stayed below 5,000 tokens even on complex tasks, while inline agents ballooned to 15,000 tokens. The study used pre-registered evaluation rubrics, deterministic task fixtures, and an independent adversarial verification audit to isolate orchestration overhead from model variance. The findings suggest that multi-agent architectures offer context-management benefits but impose measurable performance and cost penalties, making the value of the approach highly dependent on workload specifics.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub's HydraFusion Routes Coding Tasks Across AI Models to Cut Costs Without Losing Quality

GitHub has launched HydraFusion as a research preview within Copilot, a multi-model orchestration system designed to reduce the cost of AI-assisted coding workflows. Rather than sending every task to a single high-end model, HydraFusion breaks workflows into subtasks and routes each to the least expensive model capable of handling its complexity. A lightweight classifier analyzes factors such as code diff size, AST depth, and user intent to assign a complexity tier before any model call is made. A fallback handler detects failed outputs, such as syntax errors or test failures, and automatically retries with a more capable model. GitHub's internal evaluations indicate the system matches the quality of frontier models like Opus 5 while meaningfully lowering total workflow costs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Deleting a Sandbox After Use Is Cleanup, Not Security, Developer Warns

A developer building a disposable container sandbox for an AI agent realized that destroying the container after use does nothing to prevent harm caused while it was running. A misconfigured container can be granted access to sensitive files and unrestricted network access, meaning an agent could exfiltrate SSH keys or other data before the container is ever deleted. The core mistake was conflating cleanup — removing leftover artifacts — with access control, which must be enforced before the container runs. A simple test using Podman demonstrated that a disposable container could read a private SSH key and then delete itself cleanly, leaving no trace despite the exposure. The developer concluded that a sandbox's security model must default to no permissions, granting only the minimum access a task requires, since the live runtime window is where all potential damage occurs.

0 comments Read more at DEV Community