deixic
Log in

Blog

Notes from the night shift

Running agents in production: cost, approvals, identity, and what breaks.

RSS
Audit & compliance

NIST AI RMF and ISO/IEC 42001 for the agent runtime

The EU AI Act is a law with a date. US security reviews cite NIST AI RMF; certification programs cite ISO/IEC 42001. What each one asks for, and which runtime records answer it.

· Audit & compliance · 5 min

Engineering

Keeping a software factory alive

581 merged PRs in a week, 18,421 CI runs in a day, 52% of commits bot-authored or sync-titled. What replaces per-diff human review as the control at that ratio.

· Engineering · 5 min

Approvals & policy

Controls that hold when the agent stops agreeing

An instruction lives inside the agent's context and competes with everything else there. A gate lives outside it, at a boundary the agent cannot cross without a decision it doesn't control.

· Approvals & policy · 4 min

Cost

Agent spend, before the invoice

Agent spend accrues in thousands of small calls attributed to keys, not agents, until the invoice adds it all up for the first time. A usable floor reports it daily, by agent, with the gaps shown as gaps.

· Cost · 3 min

Operations

Discovery lag: how long before you find out what your agents did?

Agents act at machine speed; teams find out at meeting speed. Naming the gap, measuring it, and the one mechanism that makes it negative.

· Operations · 5 min

Earlier posts

  1. We rewrote the kernel in Rust — with agents writing most of the PRsEngineering · 3 min
  2. What Rust gives this control plane that Go did notEngineering · 4 min
  3. An operating model the runtime can enforceOperations · 3 min
  4. What an agent audit row should carryAudit & compliance · 9 min
  5. Why service-account permissions don't fit agentsIdentity & access · 8 min
  6. Five things that keep breaking when AI agents move into productionOperations · 8 min
  7. Policy at action time: what the gate evaluatesApprovals & policy · 10 min
  8. Sub-agent identity: inherit and narrowIdentity & access · 8 min
  9. The lethal trifecta: where it actually livesIdentity & access · 7 min
  10. Stopping a running agentOperations · 8 min
  11. Introducing DeixicCompany · 1 min
  12. What the EU AI Act means for the agent runtime: an Article-by-article readAudit & compliance · 9 min
  13. Designing approvals operators actually readApprovals & policy · 9 min
  14. Finding the agents nobody deployedOperations · 8 min
  15. Replay: reconstructing an agent action from the audit logAudit & compliance · 9 min