[agents]

2026-10-12[writing]

Give an agent a trip to book: the airline up to $500, the hotel up to $600, $1,000 in all, nobody else. I checked whether 42 agent payment products and standards (Visa, Mastercard, Stripe, Coinbase, AWS, AP2 and more) can hold it to that. Three can: MetaMask's Delegation Framework, Rhinestone Smart Sessions and Crossmint's signer scopes. The surprise was the part that sounds easiest: who the agent is allowed to pay.

2026-09-08[writing]

I tried to file one agent tool call as an order record under the EU trading rules. Of the eighteen fields that apply, six map to something standard and four have no source at all. Those rules have been binding since 2018, and in February the regulator pointed them at GenAI.

2026-08-27[writing]

I tried to write down the formula for revocation latency and it kept being wrong in instructive ways. The corrections come from validator source code: a five-minute grace on expired tokens in .NET, streams that outlive their token by design, and a 12-hour JWKS refresh on the one lever that actually works. With runnable experiments.

2026-08-19[writing]

Only two fields are Required on the OpenTelemetry span that records an agent taking an action. Not who authorized it, not what it was allowed to do, not what it sent. Here's the gap, field by field, and what to do about it.

2026-08-09[writing]

When a tool call dies mid-flight, neither MCP nor A2A can tell you whether it executed, and no retry can prove it is the same request. RPC solved this in 1984. Three changes close the gap.

2026-07-28[writing]

A2A moves tasks without prices, x402 moves money unconditionally, AP2 authorizes without verifying. PACT adds the missing object: the Verifiable Task Contract.

2026-07-23[writing]

A field guide to the protocols wiring the agentic web: MCP for tools, A2A for agent-to-agent work, Skills for know-how, and the three-way fight over payments.

2026-07-23[writing]

Four questions a bearer token cannot answer: agent identity, authorization flows, delegation chains, and accountability, each mapped to its standard.

2026-02-17[writing]

WebMCP as the missing protocol layer for agents that browse and act on the web.

2025-10-09[writing]

The same four terms, this time from the architecture and protocol side.

2025-10-07[writing]

Four overloaded terms untangled for decision makers: AI agents, agentic AI, MCP-based AI, and A2A.

2025-09-29[writing]

OpenAPI-described services are becoming agent tools; what AI-first means for API teams.

2025-09-23[writing]

Turning continuous patient monitoring into safe, timely action with agentic AI.