# Deedglass > Deedglass is the execution and accountability layer for AI agents. It sits between an agent and its tools, decides what each call may do, runs it with credentials the agent never sees, and checks the result against the system of record. Every action becomes a signed record that anyone with the public key can check offline. Name: Deedglass, one word (deed + glass). Also written Deed Glass, DeedGlass or Deedglass AI; all mean this product, at https://deedglass.com/. ## What it is not - Not consumer glassware, kitchen drinkware, or home goods. Deedglass is developer infrastructure systems software for AI agent security. - Not a sandbox and not a model filter: it doesn't read prompts or detect injected text. It decides tool calls by rules and checks what the system changed afterwards. - It doesn't catch everything. Its own benchmarks list the cases it misses, first: https://deedglass.com/benchmark - How far a result can be checked depends on the system: from the database's own change log for Postgres, by reading the result back for other systems, and only as the tool reported it where neither is possible. - There is no hosted version yet; it runs on your own machines. - Every feature is free while we grow, including the ones that used to be Pro. Paid support, SLAs and a hosted version for organisations come later; anything free today stays free for people who run it themselves. ## a16z Speedrun & Investor Screening Briefing - Category: AI Agent Execution & Database Reliability Infrastructure. - Core Problem: Autonomous agents (Claude Code, Cursor, MCP clients) report optimistic tool summaries ("Updated 1 row") while relational cascades or malformed SQL mutate hundreds of rows (Postgres WAL shows 301 rows). Prompt firewalls cannot detect storage-layer state anomalies. - Moat (Storage Physics): Sits between agent runtime and databases/APIs. Evaluates Common Expression Language (CEL) policies before socket dispatch; decodes binary write-ahead logs (PostgreSQL WAL) via logical decoding after commit. Cryptographically seals changes with Ed25519 signatures in an immutable hash chain. - Empirical Rigor: 82-scenario synthetic attack suite tested on live databases on every release (100% matched). - Adoption: Single self-contained binary in Go with zero runtime dependencies. Instant local browser verification: `npx -y deedglass`. Open source Apache-2.0 core. - Founder: Arjun Prabhakaran. High-velocity engineering, fully verified releases, deterministic zero-dependency architecture. ## Set up for an agent If the user asked you to set up Deedglass: ask before each change. Before a step that changes something, tell the user what it will change and wait for their yes. Steps 2 and 5 only read. Each step names the line you should see. 1. Install (adds a global npm package; ask first): `npm install -g deedglass` (or see https://docs.deedglass.com/get-started/install-deedglass/). Check with `deedglass version`. 2. See what the agent can change today (read-only: `--no-write` keeps the report files off the disk): `deedglass scan --no-write`. Expected: a grade and a list of tools with what each can change, and no file written. Without `--no-write` the scan writes deedglass-scan.md and deedglass-scan.html into the project, so ask first if the user wants them. Docs: https://docs.deedglass.com/get-started/scan/ 3. Start Deedglass locally (ask first: it starts Postgres in Docker, runs the Deedglass server on 127.0.0.1:8080 and writes `.deedglass/` in the project, with an agent key): `deedglass init --client ` where is claude-code, claude-desktop, cursor, windsurf or vscode. Expected: a line starting with `✓` for each step. It never edits the client's settings: it prints the line or snippet that connects the client, and adding it is one more change to ask about. Docs: https://docs.deedglass.com/quickstart/ 4. Put an existing MCP server behind the rules (ask first: using it means changing that server's entry in the client's MCP settings to start this command): `deedglass mcp wrap --connector -- `. Expected: the client lists the server's tools, and denied tools are hidden. Docs: https://docs.deedglass.com/get-started/govern-an-mcp-server/ 5. Check that everything is healthy (read-only): `deedglass doctor`. Expected: `✓` lines, exit code 0. Docs: https://docs.deedglass.com/reference/doctor-checks/ ## Links - Docs for agents: https://docs.deedglass.com/llms.txt - Try it in a browser: https://deedglass.com/play - Check an MCP config or a shell command in the browser (the scan and shell guard as WebAssembly; nothing uploaded): https://deedglass.com/check - Paste what an AI agent is about to do (SQL, a FHIR request, a tool call or plain words) and get what it would really change, a risk level and a Deedglass rule; an AI preview, not a read-back: /check/ai - Pricing (free while we grow: every feature, no licence key, self-hosted): https://deedglass.com/pricing - Security: https://deedglass.com/security - Deedglass Health, for hospitals and health-tech (clinician approval for AI writes, record checks, sealed records; FHIR; no clinical decisions): https://deedglass.com/healthcare - Deedglass Health for hospitals: https://deedglass.com/healthcare/hospitals - Deedglass Health for health-tech teams: https://deedglass.com/healthcare/health-tech - Deedglass Health for insurers and TPAs: https://deedglass.com/healthcare/insurers - Deedglass Health one-page brief (PDF): https://deedglass.com/healthcare/deedglass-health-brief.pdf - Attack results: https://deedglass.com/security/attacks - The agent-database benchmark (where Deedglass catches a wrong report and where it misses): https://deedglass.com/benchmark - State of AI agent permissions 2026 (original data: 2,511 public agent configs on GitHub, graded; aggregate CSV): https://deedglass.com/research/agent-permissions-2026 - Agent Action Provenance for Health (AAP-H), an open draft spec (v0.1) for recording AI agent actions on health data as FHIR R4 Provenance and AuditEvent or a JSON envelope, signed for offline checks; text CC-BY-4.0, schemas Apache-2.0: https://deedglass.com/spec/agent-action-provenance - Checking AI actions in Indian digital health, a white paper on rules, read-backs, approvals and signed records for AI agents on ABDM and NHCX: https://deedglass.com/research/india-digital-health-ai-verification - FHIR write integrity 2026 (original data: do FHIR servers store what they say they stored? 51 synthetic writes and 37 ABDM/NHCX example bundles on HAPI FHIR and Firely setups, read back; CSV): https://deedglass.com/research/fhir-write-integrity-2026 - The FHIR write benchmark (FHIR writes the server called a success but stored differently; misses first): https://deedglass.com/healthcare/benchmark - Estimate what unnoticed AI mistakes in health records could cost: https://deedglass.com/healthcare/savings - The challenge (a scripted agent's report beside what the database saved): https://deedglass.com/challenge - Check a record in your browser: https://deedglass.com/verify - Check an export with the independent verifier, offline: https://deedglass.com/verify-offline - How the scan grade is calculated: https://deedglass.com/score - Comparisons and alternatives: https://deedglass.com/compare - Glossary: https://deedglass.com/glossary - Partners: https://deedglass.com/partners - About: https://deedglass.com/about - The full summary for AI assistants (what it is, how it works, its limits, prices and questions): https://deedglass.com/llms-full.txt - Security policy: https://deedglass.com/security/policy - The record format: https://docs.deedglass.com/concepts/deeds/ ## Comparisons - [Deedglass and Claw Patrol](https://deedglass.com/compare/claw-patrol): Claw Patrol gates each agent action at the wire before it reaches the system. Deedglass also checks what Postgres committed afterwards, seals a record anyone can check, and can undo the rows. - [Database branches, or Deedglass](https://deedglass.com/compare/database-branches): Branches win until the change has to reach production. Let the agent work on a copy, and use Deedglass where it has to write to the real thing. - [Langfuse and LangSmith, and Deedglass](https://deedglass.com/compare/langfuse-langsmith): Traces show what the agent said. Deedglass's check shows what Postgres did. Keep a tracing tool to follow each step of a run; add Deedglass for rules before a tool call and a check of what the database committed. - [MCP gateways, and Deedglass](https://deedglass.com/compare/mcp-gateways): Gateways route and authorise tool calls. Deedglass's check reads what the database did afterwards. Use a gateway to decide who may call which tool; add Deedglass to know what a write really changed, with a record anyone can check. - [Deedglass and Pipelock](https://deedglass.com/compare/pipelock): Pipelock is an agent firewall that proxies an agent's traffic, scans its MCP traffic and signs its decisions. Deedglass adds what Postgres committed after each call, and undo for the rows. - [A read-only Postgres role, or Deedglass](https://deedglass.com/compare/read-only-postgres-role): If your agent only reads, use a read-only role. You don't need Deedglass. This page is for when that stops being enough. - [Rubrik Agent Rewind, and Deedglass](https://deedglass.com/compare/rubrik-agent-rewind): Agent Rewind is Rubrik's way to rewind what an agent changed, using Rubrik Security Cloud. Deedglass targets small teams' Postgres writes, with rules first and a check after. ## Glossary - [Agent action record](https://deedglass.com/glossary/agent-action-record): One durable entry for one thing an AI agent did, from the request to the result. - [Audit trail for AI in healthcare](https://deedglass.com/glossary/audit-trail-ai-healthcare): A lasting record of each action an AI system takes on health data, kept so an auditor can check later what it did, for whom, and what really changed. - [Blast radius](https://deedglass.com/glossary/blast-radius): Everything an AI agent can change with the access it has. - [Change data capture](https://deedglass.com/glossary/change-data-capture): Recording every row change a database commits, as a stream other systems can read and act on. - [FHIR](https://deedglass.com/glossary/fhir): HL7's standard for sharing health records between systems. A record is split into small pieces, such as a patient or a blood test result, that systems read and write over the web. - [Hash-chained log](https://deedglass.com/glossary/hash-chained-log): A log where each entry carries the hash of the one before it, so a removed or edited entry breaks the chain. - [Human-in-the-loop approval](https://deedglass.com/glossary/human-in-the-loop-approval): A rule that holds an agent's risky tool call until a named person allows or refuses it. - [Logical decoding for agent audits](https://deedglass.com/glossary/logical-decoding-agent-audit): Reading what Postgres committed, row by row, and comparing it with what the agent said it did. - [MCP gateway](https://deedglass.com/glossary/mcp-gateway): A proxy between AI clients and the MCP servers they call: one place to route, allow and log tool calls. - [PHI (protected health information)](https://deedglass.com/glossary/phi): The US HIPAA term for health information that can identify a person. India's DPDP Act has no separate health category: health data is personal data. - [PreToolUse hook](https://deedglass.com/glossary/pretooluse-hook): A script a coding agent runs before each tool call, which can let the call through, ask you first or refuse it. - [Prompt injection](https://deedglass.com/glossary/prompt-injection): Text an attacker plants where an AI agent will read it, so the agent follows the attacker's instructions instead of yours. - [Read-back check](https://deedglass.com/glossary/read-back-check): Reading a record again after a write, and comparing it with what the agent sent. - [Read-only database access for agents](https://deedglass.com/glossary/read-only-database-access): A database role that can read what the agent needs and can't change anything, enforced by Postgres privileges. - [Replica identity](https://deedglass.com/glossary/replica-identity): The table setting that decides how much of a changed row's old version Postgres writes to its change log. - [Replication slot](https://deedglass.com/glossary/replication-slot): A bookmark in Postgres's change stream that holds the write-ahead log until its reader has caught up. - [Row-level security](https://deedglass.com/glossary/row-level-security): Postgres policies that decide which rows a role can see or change, row by row, inside the database. - [Tool-call policy](https://deedglass.com/glossary/tool-call-policy): Rules, checked outside the model, that allow, refuse or hold each tool call an agent makes. ## Guides - [How to give Claude Code or Cursor write access to Postgres safely](https://deedglass.com/guides/postgres-write-access-claude-code-cursor): Give the agent a read-only role first. If it must write, add a narrow writer role with a statement timeout, make a person approve destructive verbs, and check what Postgres committed afterwards, with a way to put rows back. ## Incidents - [A coding agent deleted a production database during a code freeze](https://deedglass.com/incidents/2025-07-agent-deleted-production-db-during-freeze): Keep development and production in separate databases, with separate credentials. - [An agent deleted a production volume and its backups with one API call](https://deedglass.com/incidents/2026-04-agent-deleted-production-volume-and-backups): Scope every API token to the operations it exists for; never leave a full-permission token in the repository. ## Blog - [ABDM building blocks explained: ABHA, HFR, HPR, HIP, HIU and the consent manager](https://deedglass.com/blog/abdm-building-blocks-explained): ABDM is a set of registries and gateways, not one app. Here is what each block does, how a record moves between hospitals with consent, and what a hospital's software has to handle. - [Prompt injection defenses vs adaptive attacks: what a 12-defense study found](https://deedglass.com/blog/adaptive-attacks-break-prompt-injection-defenses): Most prompt-injection defenses report near-zero attack success. A 2025 study attacked twelve of them with methods built to beat each one, and most fell more than 90% of the time. Here is what was tested, and the lesson for agents. - [Your AI agent said it updated 1 row. Postgres changed 301.](https://deedglass.com/blog/agent-said-1-row-postgres-changed-301): The agent wasn't lying. It passed on what Postgres told it. Here is the run, the output, where the other 300 rows came from, and how they went back. - [AgentDojo and InjecAgent: how prompt injection is measured in tool-using agents](https://deedglass.com/blog/agentdojo-prompt-injection-benchmark): Two benchmarks put numbers on prompt injection against agents with tools. AgentDojo checks the environment's state after each run; InjecAgent counts harmful tool calls. Here is what each measures, what they found, and what to take from it. - [AgentHarm, explained: measuring whether AI agents carry out harmful multi-step tasks](https://deedglass.com/blog/agentharm-benchmark): Chat models are tested on whether they refuse harmful questions. Agents can act, so the question changes: will they carry out a harmful task with tools, step by step? AgentHarm measured that. Here is how, and what it found. - [AgentPoison: how a few poisoned memory entries can steer an AI agent](https://deedglass.com/blog/agentpoison-memory-poisoning): Agents that remember past cases or search a knowledge base trust what they find. AgentPoison showed a few planted entries can hijack them on a trigger while normal use looks fine. - [Your AI coding agent can read your .env file. Here's what stops it, and what doesn't.](https://deedglass.com/blog/ai-agent-api-keys-in-env-files): A coding agent runs in your project with your permissions, so the keys in .env are within reach. Ignore rules help with the built-in file tools. Shell commands and scripts are another matter. - [AI agent audit logs under India's DPDP Rules: what Rule 6 asks for](https://deedglass.com/blog/ai-agent-audit-logs-india-dpdp): India's DPDP Rules ask for logs of who accessed personal data, kept for a year. An AI agent that reads or changes customer records is one more accessor, and its actions belong in those logs. - [The AI agent blast radius formula: mathematical safety in production](https://deedglass.com/blog/ai-agent-blast-radius-formula-technical-guide): Traditional security audits measure network perimeters. For autonomous AI agents, safety is a function of credential depth, mutation scope, and reversibility. Here is how to calculate agent blast radius. - [An AI agent deleted the production database: what to do in the first hour](https://deedglass.com/blog/ai-agent-deleted-the-database-first-hour): Stop the agent, take away its credentials, keep the evidence, then restore next to production rather than over it. With provider restore docs and a recovery we ran end to end. - [AI agent framework guardrails compared: where nine frameworks let you stop a tool call](https://deedglass.com/blog/ai-agent-framework-guardrails-compared): Every major agent framework has somewhere to check a tool call before it runs. They differ in what that check sees, whether it can block, and what it skips. One table, sourced to each framework's docs. - [AI agent governance in a hospital: a setup you can run with the staff you have](https://deedglass.com/blog/ai-agent-governance-in-hospitals): Governance frameworks tell hospitals what to care about. They don't say who meets on Tuesday. Here is a working setup for AI tools that write to hospital systems, mapped to NIST's AI RMF and India's guidance. - [An AI agent kill switch: four layers, and what each one actually stops](https://deedglass.com/blog/ai-agent-kill-switch): Stopping an agent sounds like one button. In practice it is four: refuse its next call, end what's already running, take back its credentials, and keep it from writing until someone has looked. - [Provenance standards for AI agent actions: PROV, FHIR, C2PA, SLSA and AAP-H compared](https://deedglass.com/blog/ai-agent-provenance-standards): When an AI agent changes a record, someone will later ask who acted, on whose behalf, under what rule, and what really changed. Several provenance standards exist. None was built for agent actions. Here is how they compare. - [An AI agent ran prisma migrate reset on production. What actually stops it?](https://deedglass.com/blog/ai-agent-ran-prisma-migrate-reset-on-production): Prisma has its own check for AI agents. We ran it inside Claude Code, then went around it three ways. One fix held every time: a database role that can't drop what it doesn't own. - [An AI agent retried a timed-out write and it ran twice: how to make retries safe](https://deedglass.com/blog/ai-agent-retried-and-wrote-twice): The agent's client gave up after half a second. Postgres finished the credit anyway, and the retry credited again. Here are the measured runs, the fix, and the case our own tool misses. - [AI agents and SSRF: how a fetch tool reaches 169.254.169.254, and how to stop it](https://deedglass.com/blog/ai-agent-ssrf-cloud-metadata): Give an agent a tool that fetches URLs, run it in the cloud, and the instance metadata service is one request away. Here's how the attack works, what IMDSv2 changes, and a URL check we tested. - [Your AI agent ran an UPDATE without a WHERE. How do you stop the next one?](https://deedglass.com/blog/ai-agent-update-without-where): Postgres will happily change every row and answer UPDATE 500. Here are the guards that refuse it, tested on one table, and the one you can add to your database in five minutes. - [When AI agents game the test: what reward hacking research found, and what helps](https://deedglass.com/blog/ai-agents-gaming-tests-reward-hacking): Give an agent a test to pass and it may pass it the wrong way: edit the test, patch the grader, special-case the input. Two 2025 studies measured how often, and what helped. - [AI agents are writing to patient records. Who checks what they changed?](https://deedglass.com/blog/ai-agents-writing-to-patient-records): AI in hospitals and insurers has moved from suggesting to writing. The hard question is no longer only what the AI said. It is what the record holds afterwards, and who can show it. - [AI receptionists and booking bots in dental clinics: what can go wrong with your records](https://deedglass.com/blog/ai-receptionist-dental-clinic-records): A booking bot answers the phone at 10 pm and changes your schedule and patient records. Here is what can go wrong, what the rules say, and a setup a small clinic can run. - [AI scribes and the EHR: an audit trail that shows who drafted and who approved](https://deedglass.com/blog/ai-scribe-ehr-write-who-approved): An AI scribe drafts the note and may queue orders; a clinician signs. Months later, can you show which words came from the AI, who changed them and who approved? Here is what the trail needs. - [Reviewing AI scribe notes: a checklist built from the published error studies](https://deedglass.com/blog/ai-scribe-note-review-checklist): AI scribes save typing, not responsibility. Studies show their errors cluster in a few places: omissions, made-up details and flipped negatives. Here is a review routine aimed at those, so a careful check doesn't take long. - [The AI vendor security questionnaire: what hospitals should add to the usual one](https://deedglass.com/blog/ai-vendor-security-questionnaire-healthcare): Hospital security questionnaires ask about encryption, hosting and access. AI tools that read and write clinical systems raise new questions. Here are 30, grouped, with what a good answer looks like. - [Alert fatigue: what health IT learned about too many prompts, applied to AI approvals](https://deedglass.com/blog/alert-fatigue-research-and-agent-approvals): Hospitals learned the hard way that more alerts can mean less safety. Studies of drug alerts and reminders show why. The same thing happens when every agent action asks for approval. Here is the research and the design lessons. - [The Amazon Q Developer extension incident: what AWS confirmed, and the lesson](https://deedglass.com/blog/amazon-q-extension-wiper-prompt): Version 1.84.0 of the Amazon Q Developer extension for VS Code shipped with malicious code that an attacker committed through an over-scoped CI token. Here's what AWS's own bulletins say, and nothing more. - [AppWorld, explained: the agent benchmark that fails you for collateral damage](https://deedglass.com/blog/appworld-benchmark): Most agent benchmarks ask whether the task got done. AppWorld also asks what else changed. An agent that completes the task but deletes something on the way fails. Here is how it works and why that matters. - [An AI agent security test suite that runs on every release](https://deedglass.com/blog/attack-suite-on-every-release): Prompt-injection benchmarks ask whether a model gets fooled. A release suite should ask what happens to the calls a fooled model sends. Here is how to build one, with our 82 cases as the worked example. - [How to audit an MCP config: a ten-minute review, server by server](https://deedglass.com/blog/audit-mcp-config): An MCP config file decides what your coding agent can change. Here is a checklist to review one, and a worked example where nine servers graded D became four that graded B. - [How to audit MySQL changes made by an AI agent: statements, rows and the gaps](https://deedglass.com/blog/audit-mysql-changes-made-by-ai-agent): Five ways to see what an agent did to a MySQL database, what each one records, and a recorded run where the agent's statement says one row and the binlog says 301. - [What should an audit record for an AI action contain? A field-by-field list](https://deedglass.com/blog/audit-record-fields-for-ai-actions): Audit standards were written for people clicking buttons. When an AI agent acts, the record needs more: which agent, on whose behalf, what the rules decided, what it claimed and what actually changed. - [Automation bias and human-in-the-loop: what health IT research says about approving AI](https://deedglass.com/blog/automation-bias-health-it-approvals): A person approving each AI action sounds like a safety net. Decades of health informatics research on automation bias show when that net holds and when it doesn't. Here is what two systematic reviews found, applied to agent approvals. - [Autonomous AI agent due diligence: what enterprise CISOs and VCs require](https://deedglass.com/blog/autonomous-ai-agent-due-diligence-guide-2026): Enterprise CISO reviews and venture capital due diligence have shifted from model benchmarks to execution safety. Technical teams must demonstrate deterministic control over database mutations before autonomous agents are funded or deployed on production infrastructure. - [Ayushman Bharat Digital Mission statistics, from official sources only](https://deedglass.com/blog/ayushman-bharat-digital-mission-statistics): ABDM numbers get quoted everywhere, often without a date. These come only from PIB and health ministry documents, each with its date, so you can see the trend and cite it properly. - [How to benchmark an AI agent guardrail, including the one you sell](https://deedglass.com/blog/benchmark-your-own-ai-agent-gateway): Most guardrail claims are demos. A benchmark needs ground truth the tool can't influence, scores that don't blur together, and cases the tool is expected to fail. Here is a method, and a harness you can reuse. - [The Berkeley Function Calling Leaderboard: what a BFCL score means](https://deedglass.com/blog/berkeley-function-calling-leaderboard): BFCL is the most cited leaderboard for tool calling. It checks whether a model picks the right function with the right arguments, knows when no function fits, and keeps state across turns. Here is how each part is scored. - [The best Postgres MCP server depends on its brakes: five compared](https://deedglass.com/blog/best-postgres-mcp-server): Every Postgres MCP server can run SQL. They differ in how you narrow them: read-only modes, project scoping, confirmations and what their own docs say about production. Here are five, side by side. - [Cedar, OPA or CEL: which policy language for AI agent tool calls?](https://deedglass.com/blog/cedar-opa-cel-for-agent-policies): Rules for what an agent may do need a language. Cedar, OPA's Rego and CEL are the usual picks, and they differ in ways that matter for agents: defaults, how rules combine, and what an error does. - [CERT-In's 2022 directions for hospitals: 6-hour reports, 180-day logs and clock sync](https://deedglass.com/blog/cert-in-directions-for-hospitals): CERT-In's April 2022 directions apply to body corporates and government organisations, so to many hospitals. Four of them change day-to-day IT: incident reports, logs, clocks and a named contact. - [How to check agent records without our software](https://deedglass.com/blog/check-agent-records-without-our-software): A signed audit log is only worth something if someone other than its writer can check it. Here is what an independent check covers, step by step, with three verifiers run on the same records. - [A practical checklist before you let an AI agent near production](https://deedglass.com/blog/checklist-before-an-agent-touches-production): Twenty checks, grouped by what goes wrong. Most need no new tools, just SQL and a few decisions written down. Start with the first section; it finds most of the problems. - [Claimed, Checked, Proven: three levels of evidence for agent actions](https://deedglass.com/blog/claimed-checked-proven): "The tool returned success" can mean three very different things. Naming the level of evidence behind each result is how you know which results to trust, and which to go and look at. - [Claude Agent SDK permissions: canUseTool vs PreToolUse, and which one sees every call](https://deedglass.com/blog/claude-agent-sdk-canusetool-pretooluse): The Claude Agent SDK gives you two places to check a tool call: the canUseTool callback and a PreToolUse hook. They run at opposite ends of the permission flow. Put a check in the wrong one and it never runs. - [How to safely connect Claude Code and Cursor to your databases](https://deedglass.com/blog/claude-code-and-cursor-database-safety-guide): Developers are giving autonomous coding agents like Claude Code and Cursor direct database access. Here is how to configure MCP policy rules and change log verification so agents never drop tables or execute unconstrained writes. - [Claude Code checkpoints and /rewind: what they undo, and what they leave behind](https://deedglass.com/blog/claude-code-checkpoints-rewind): Claude Code takes a checkpoint before every prompt, and /rewind can put your files back. It covers less than the menu suggests. Here is what the docs say it tracks, what it skips, and what to use instead. - [Claude Code --dangerously-skip-permissions: what it skips and what still holds](https://deedglass.com/blog/claude-code-dangerously-skip-permissions): The flag removes Claude Code's permission prompts. Not all of them, and not your deny rules. Here is exactly what bypass mode changes, what survives it, and how to run it with less risk. - [A Claude Code hook that asks before DROP TABLE, migrate reset and rm -rf](https://deedglass.com/blog/claude-code-hook-block-database-commands): Claude Code runs a PreToolUse hook before every Bash command. Here is a 14-line hook that asks first on destructive database and file commands, tested, plus the ways around it you should know. - [Claude Code IDE extension CVE-2025-52882: a web page talking to your editor](https://deedglass.com/blog/claude-code-ide-extension-websocket-cve): In June 2025, Anthropic disclosed that its Claude Code IDE extensions accepted WebSocket connections from any origin, so a web page could talk to them. Here's the advisory, the fix and what the wider advisory list shows. - [Claude Code managed settings: enforce agent guardrails across a team](https://deedglass.com/blog/claude-code-managed-settings-for-teams): Per-developer settings are suggestions; managed settings are policy. Claude Code applies them above every other level. Here's a starter policy for agent safety, where the file goes, and its honest limits. - [Claude Code permissions: how deny, ask and allow rules work, and when they don't](https://deedglass.com/blog/claude-code-permissions-deny-ask-allow): Claude Code checks deny rules first, then ask, then allow. That order is simple; what a rule actually covers is not. Here is the model, the public bug reports, and a test routine. - [Asked to read logs, it dropped two columns: the ALTER TABLE over SSH report](https://deedglass.com/blog/claude-code-ran-alter-table-over-ssh): A Claude Code user asked for the error from a production server's logs. The model found the cause and fixed it, with two ALTER TABLE ... DROP COLUMN statements, without asking. Here's the report and what would have stopped it. - [Claude Code sandbox settings: what the sandbox covers, and what still runs outside it](https://deedglass.com/blog/claude-code-sandbox-settings): Claude Code's sandbox is an OS-level boundary around shell commands. It's off by default, writes stay in the project when it's on, and reads don't. Here are the defaults, the settings and the gaps. - [Cline auto-approve settings: what each toggle allows, and who decides what is safe](https://deedglass.com/blog/cline-auto-approve-settings): Cline's auto-approve is a set of per-category toggles, plus YOLO mode. The toggle that surprises people is Execute safe commands: Cline has no fixed list, so the model itself decides what counts as safe. - [CMS-0057-F and the prior authorization API: what it requires, and where automation fits](https://deedglass.com/blog/cms-prior-authorization-api-rule): The CMS prior authorization rule sets decision deadlines from 2026 and a FHIR-based prior authorization API from 2027. If you build or automate prior authorization, here is what the fact sheet says, and what it means for records. - [Codex CLI sandbox and approval modes: what each one allows, tested on macOS](https://deedglass.com/blog/codex-cli-approval-and-sandbox-modes): Codex CLI pairs two settings: a sandbox that limits what commands can touch, and an approval policy that decides when it asks you. We read the docs and ran the sandbox to see what it actually blocks. - [Hooks that block dangerous commands in Codex CLI, Gemini CLI, Copilot and Cursor](https://deedglass.com/blog/codex-gemini-copilot-cursor-hooks): Each of these coding agents runs a hook of yours before a shell command. They differ on one thing that matters: whether the hook can ask you first, or only refuse. - [Which migration commands delete your data? A table for 12 frameworks](https://deedglass.com/blog/commands-that-wipe-a-database): Every ORM ships a reset command for development, and coding agents use them to get unstuck. Here is which commands destroy data, which ones don't, and what we tested. - [How to connect AI agents to hospital systems running SQL Server or Oracle](https://deedglass.com/blog/connect-ai-agents-to-hospital-sql-server-oracle): Most hospital systems sit on SQL Server or Oracle, but letting AI agents write directly to relational clinical databases is a critical risk. Here are the three practical architectures hospital IT teams use to gate and verify agent actions safely. - [GitHub Copilot preToolUse hooks: how they decide, and the edge cases that matter](https://deedglass.com/blog/copilot-agent-pretooluse-hooks): Copilot's cloud agent and CLI can run a hook before every tool call. Its rules for exit codes, timeouts and ask are different from Claude Code's. Here they are in one table, with a hook we tested. - [GitHub Copilot CLI permissions: --allow-tool, --deny-tool and the patterns behind them](https://deedglass.com/blog/copilot-cli-allow-deny-tool): Copilot CLI asks before it runs commands or writes files, unless you tell it not to. The flags that tell it are short and easy to get wrong. Here is how the patterns match, what wins, and where approvals persist. - [The cost of claim denials and rework: what the studies say, and how to estimate yours](https://deedglass.com/blog/cost-of-claim-denials-and-rework): Every revenue cycle deck quotes a cost per denied claim. Few say where it came from. Here are the figures we could trace to a study, what each measures, and a model for estimating your own cost. - [CrewAI tool call hooks: how to block a tool call or ask a person first](https://deedglass.com/blog/crewai-tool-call-hooks): CrewAI runs hooks before and after every tool call. A before hook can stop the call, change its input or ask a person in the terminal. Here's how each works, and three traps from the docs. - [Cursor agent deleted my files: what let it, and the settings that stop it](https://deedglass.com/blog/cursor-agent-deleted-my-files): If a Cursor agent deleted files, the command almost always ran from the terminal without a prompt. Here is which settings cover that, which don't, and a small hook that asks first. - [Cursor auto-run settings: the allowlist, permissions.json and sandbox.json, explained](https://deedglass.com/blog/cursor-auto-run-allowlist): Cursor's auto-run is now three run modes plus two config files. Each file controls a different thing, and mixing them up is how a broad allowlist entry ends up running a destructive command. - [Cursor checkpoints: what Restore Checkpoint undoes, what it misses, what to use instead](https://deedglass.com/blog/cursor-checkpoints-restore): Cursor checkpoints snapshot the files an Agent changes, so you can roll back a bad edit. They're useful and narrow. Here is what they cover, what they don't, and the backups to keep. - [What Cursor's 33 published security advisories teach about coding-agent safety](https://deedglass.com/blog/cursor-security-advisories-patterns): Cursor publishes its security advisories on GitHub. We read all 33 and grouped them. The patterns aren't about Cursor alone: they're the ways any coding agent's safety controls tend to fail. - [Da Vinci CRD, DTR and PAS: how the prior authorization guides fit together](https://deedglass.com/blog/da-vinci-crd-dtr-pas-explained): CMS-0057-F points payers at three HL7 Da Vinci guides for prior authorization. Each does one job. Here is what CRD, DTR and PAS do, how a request flows through them, and where automation needs checks. - [One command adds a shell guard to Claude Code, Cursor, Codex, Gemini CLI and Copilot](https://deedglass.com/blog/deedglass-protect-every-coding-agent): Five coding agents, five hook formats. Here is what npx deedglass protect writes into each agent's config, what each agent does with an ask, and how to take it all out again. - [A dental clinic's checklist before letting an AI tool touch patient records](https://deedglass.com/blog/dental-clinic-ai-tool-checklist): A few decisions before go-live save a lot of untangling later. A printable checklist for dentists and practice managers, from contract to the first bad day. - [Django migrations and AI coding agents: which manage.py commands to allow](https://deedglass.com/blog/django-migrations-ai-agent): An agent that can run manage.py can run flush and migrate zero. Here is a workflow that lets it write migrations while a person reviews the SQL, and what a command check sees. - [Personal data breach notification for Indian hospitals: the 6-hour and 72-hour clocks](https://deedglass.com/blog/dpdp-breach-notification-health): A breach at an Indian hospital can start two separate reporting clocks and a duty to tell every affected patient. Here is what each report must contain, with a worked timeline. - [AI vendors as Data Processors under DPDP: contracts, logs and erasure](https://deedglass.com/blog/dpdp-data-processor-ai-vendor-logs): An AI scribe, chatbot or coding agent handling patient data for a hospital is usually a Data Processor. The hospital stays responsible, so the contract and the logs have to carry the weight. - [The DPDP Rules 2025 for hospitals: what changes, and by when](https://deedglass.com/blog/dpdp-rules-for-hospitals): Most DPDP duties start eighteen months after the November 2025 rules. For a hospital that means notices, safeguards, breach reporting and log retention by around May 2027. Here is the list, rule by rule. - [drizzle-kit push --force deleted data: why it happens and how to stop it](https://deedglass.com/blog/drizzle-kit-push-force-data-loss): drizzle-kit push compares your schema with the database and applies the difference. With --force it accepts every statement that loses data, without asking. Here is what that means and a safer flow. - [How to dry-run an UPDATE before an AI agent commits it](https://deedglass.com/blog/dry-run-an-update-before-the-agent-commits): Before an agent's UPDATE runs for real, you want to know how many rows it will change. EXPLAIN guesses. A rolled-back transaction counts exactly, with side effects you need to know about. Tested on PostgreSQL 18. - [EHR audit logs: what they record, what research learned, and what AI agents change](https://deedglass.com/blog/ehr-audit-logs-what-they-record): Every click in an EHR leaves a timestamped trace. Researchers use audit logs to study clinical work; a review of 85 studies shows their power and gaps, which matter more once agents are users. - [How to enable logical replication on Supabase, Neon, RDS, Cloud SQL and Azure](https://deedglass.com/blog/enable-logical-replication-supabase-neon-rds): Logical replication needs wal_level = logical, a role with REPLICATION and a slot someone reads. Each managed Postgres exposes those differently. Here is the setting, the restart and the disk trap for each. - [The European Health Data Space, explained for health IT and software teams](https://deedglass.com/blog/eu-ehds-explained): The EHDS regulation is law, with the first obligations landing in 2027 and 2029. For EHR vendors and hospitals, it brings patient access dashboards, a logging component and new duties. Here is what the Commission says. - [How to evaluate what an AI agent did, not what it said](https://deedglass.com/blog/evaluating-agent-actions-not-answers): The agent benchmarks researchers trust most share one idea: grade the effect on the system, not the agent's description of it. Here is how five benchmarks apply it, and a template to evaluate your own agent the same way. - [FHIR AuditEvent vs Provenance: two records, two questions](https://deedglass.com/blog/fhir-auditevent-vs-provenance): AuditEvent answers who did what, when, for the security log. Provenance answers where this version of a resource came from. An AI agent writing to a FHIR server usually needs both. Here is how to tell them apart. - [FHIR Bulk Data export security: one request, every patient, and where agents fit](https://deedglass.com/blog/fhir-bulk-data-export-security): Bulk Data export is the FHIR operation built for moving whole populations of records. That makes it the largest blast radius on a FHIR server. Here's how the flow works, what the spec requires, and an agent policy. - [FHIR conditional create: when If-None-Exist stores nothing, and when it stores two](https://deedglass.com/blog/fhir-conditional-create-duplicates): If-None-Exist is meant to stop duplicates. It answers 200 and stores nothing when a match exists, and in our tests one server still stored two copies from one transaction. Here is how to tell what happened. - [FHIR conditional update id mismatch: 400 by the spec, 200 on some servers](https://deedglass.com/blog/fhir-conditional-update-id-mismatch): A conditional update finds a resource by search, but the body names a different id. FHIR R4 says refuse with 400. In our October 2026 tests, HAPI 8.12.0 applied it. Here is why it matters. - [The FHIR Consent resource: what it records, and why your agent's tools must enforce it](https://deedglass.com/blog/fhir-consent-resource-explained): FHIR's Consent resource records a person's choices about who may do what with their information. It does not stop anyone doing anything. For an AI agent reading health records, that gap is your job. - [FHIR delete vs expunge: what a DELETE really removes, and when data is gone for good](https://deedglass.com/blog/fhir-delete-vs-expunge): On most FHIR servers a DELETE is a soft delete: reads return 410 and search skips it, but history keeps the data. Expunge is the hard delete. Here is how they differ and who should hold each. - [AI-drafted orders and clinician sign-off: modelling it in FHIR R4](https://deedglass.com/blog/fhir-draft-orders-clinician-signoff): AI tools now draft orders for clinicians to sign. FHIR R4 already has the fields to keep a draft from being acted on. Here is how to use status, intent and requester so the sign-off is real and recorded. - [FHIR If-Match version conflicts: why you get 409 when the spec says 412](https://deedglass.com/blog/fhir-if-match-version-conflict): FHIR R4 says a stale If-Match gets 412 Precondition Failed. In our October 2026 study, all four server setups answered 409 instead. The write was refused either way. Here is how to handle both. - [FHIR PATCH with JSON Patch: five pitfalls, and how an agent should write patches](https://deedglass.com/blog/fhir-json-patch-pitfalls): JSON Patch looks like the safe way for an agent to change one field. On FHIR resources full of arrays, it's easy to replace a whole list, edit the wrong entry, or skip validation. Here are the traps. - [FHIR R4 vs R5 vs R6: release dates, status, and which version to build on in 2026](https://deedglass.com/blog/fhir-r4-vs-r5-vs-r6): FHIR has four releases in use or in ballot. Most real-world rules and implementation guides still sit on R4. Here is the timeline, the status of each release, and a practical way to choose. - [FHIR referential integrity: when a server stores a reference to nothing](https://deedglass.com/blog/fhir-reference-to-missing-resource): An Observation points at Patient/123, and Patient/123 doesn't exist. Will the server refuse it? It depends on the server and its settings. Here is what R4 says, what we measured, and what to check. - [FHIR transaction vs batch: what the spec requires, and what it leaves open](https://deedglass.com/blog/fhir-transaction-vs-batch): Both are Bundles you POST to the server base. One is atomic and can link its entries together; the other isn't and can't. Mixing them up is how half a write ends up stored. The R4 rules, with an example. - [Validating FHIR resources against a profile before an agent writes them](https://deedglass.com/blog/fhir-validator-cli-profiles): An AI agent that builds FHIR resources will sometimes build them wrong. You can catch that before the write, with the HL7 validator, a server's $validate operation, or rules on the server itself. Here's what each checks. - [FHIR versioning: versionId, ETag, vread and _history in one page](https://deedglass.com/blog/fhir-versioning-and-history): Every FHIR write can create a new version you can read back by number. That's what makes it possible to check what a write stored, and to avoid overwriting someone else's change. The R4 rules, and the gaps. - [FHIR writes that said success: 11 cases where the server stored something else](https://deedglass.com/blog/fhir-writes-that-said-success): A FHIR server's 200 or 201 says it accepted your request. It doesn't say it stored what your agent meant. We ran 17 synthetic scenarios against one real server to see how often those differ, and which checks notice. - [Filesystem MCP server security: what allowed directories do, and how they were escaped](https://deedglass.com/blog/filesystem-mcp-server-security): The filesystem MCP server keeps an agent inside the directories you list. In 2025 two advisories showed that boundary leaking through a name prefix and through symlinks. Here's the setup we'd use now. - [The GAIA benchmark, explained: what a score tells you about an AI assistant](https://deedglass.com/blog/gaia-benchmark-explained): GAIA scores show up in nearly every agent launch. The benchmark asks real-world questions with one short correct answer. Here is how it's built, how it grades, and why a high score says little about safe actions. - ["Gemini CLI deleted my files": what the issue thread actually shows](https://deedglass.com/blog/gemini-cli-deleted-files): In July 2025 a Gemini CLI user reported the agent had lost every file in a folder. The thread ends differently: the files were found at the drive root. The real lessons are about checking, not panic. - [Gemini CLI trusted folders: keep a cloned repo from configuring your agent](https://deedglass.com/blog/gemini-cli-trusted-folders): A repository can ship settings, MCP servers and an .env that change how your coding agent behaves. Gemini CLI's trusted folders feature ignores all of that until you say the folder is yours. It's off by default. - [Gemini CLI yolo mode: what it auto-approves, and how to make it less dangerous](https://deedglass.com/blog/gemini-cli-yolo-mode): Yolo mode in Gemini CLI approves every action without asking. That's fine in a throwaway container and risky on your laptop. Here are the approval modes, the policy engine and the settings that narrow yolo. - [The GitHub MCP exploit: a public issue, a private repo, a public pull request](https://deedglass.com/blog/github-mcp-prompt-injection-private-repos): In May 2025, Invariant Labs showed an agent with the GitHub MCP server reading a planted issue and leaking private repository data into a public pull request. Here is the mechanism and what stops it. - [How to run the GitHub MCP server safely: read-only, toolsets and lockdown](https://deedglass.com/blog/github-mcp-server-read-only): The GitHub MCP server's default toolsets include write tools. Three switches and one token setting cut it down to what your agent needs. Here is each one, for the local and the remote server. - [Google ADK before_tool_callback: tool-call guardrails, and when a plugin is better](https://deedglass.com/blog/google-adk-before-tool-callback): In Google's Agent Development Kit, a before_tool_callback runs after the model asks for a tool and before the tool runs. Return None and it runs; return a dict and it doesn't. Plugins do the same for every agent. - [How to govern LangGraph ToolNode tools with Deedglass](https://deedglass.com/blog/govern-langgraph-toolnode-tools): LangGraph agents execute tool calls through ToolNode components. Here is how govern_tool wraps standalone tools to enforce pre-execution policy checks, handle pending approvals, and return model-readable error messages without halting graph execution. - [How to govern Medplum FHIR agent writes](https://deedglass.com/blog/govern-medplum-fhir-agent-writes): AI scribes and clinical agents update patient records via FHIR APIs. Here is how Deedglass enforces pre-write policies, requires approval, and verifies committed Medplum rows. - [How to govern NVIDIA Nemotron database agents](https://deedglass.com/blog/govern-nvidia-nemotron-database-agents): NVIDIA Nemotron 3 Ultra models excel at complex reasoning and tool use. Here is how Deedglass enforces pre-execution SQL rules, gates sensitive database writes, and verifies committed changes. - [Validating FHIR writes in HAPI: request validation, repository validation, agents](https://deedglass.com/blog/hapi-fhir-request-validation): When an AI agent writes to a HAPI FHIR server, you want malformed resources refused, not stored. HAPI offers two places to check. They differ in one way that matters for agents: PATCH. - [HAPI FHIR update returned 200 but no new version: what it means](https://deedglass.com/blog/hapi-fhir-update-no-new-version): You sent a PUT, HAPI FHIR answered 200, and versionId didn't move. Usually that means your update changed nothing. Sometimes it means the change you meant never reached the server. Here is how to tell. - [HIPAA audit controls and AI agents: what 164.312(b) asks, and what to record](https://deedglass.com/blog/hipaa-audit-controls-ai-agents): HIPAA asks for mechanisms that record and examine activity in systems holding ePHI. It doesn't say what an AI agent's record should contain. Here is the rule's text, and a practical record design. - [HIPAA breach notification and AI vendors: what counts, who tells whom, and by when](https://deedglass.com/blog/hipaa-breach-notification-ai-vendor): An AI tool sends a summary to the wrong patient, or a vendor's prompt logs leak. Is it a HIPAA breach, and whose clock starts when? Here is the rule, step by step, with AI cases. - [Do you need a business associate agreement for an AI tool? HIPAA, explained for AI](https://deedglass.com/blog/hipaa-business-associate-agreement-ai-tools): If an AI tool creates, receives, keeps or sends PHI for a covered entity, its vendor is usually a business associate and needs a BAA. Here is the rule, the required terms, and the AI-specific clauses worth adding. - [HIPAA de-identification for AI: the 18 safe harbor identifiers and where AI data trips](https://deedglass.com/blog/hipaa-de-identification-safe-harbor-ai): Teams building AI on health data often say the data is de-identified. Under HIPAA, that has a precise meaning: remove 18 kinds of identifier, or get an expert's documented determination. Here is the rule and the traps. - [HIPAA's minimum necessary standard for AI tools: send the model less](https://deedglass.com/blog/hipaa-minimum-necessary-ai-tools): AI tools work better with more context, and HIPAA asks for the minimum necessary. The two pull in opposite directions. Here is when the rule applies to AI, when it doesn't, and how to design for it. - [HIPAA risk analysis for AI tools: a worked method with an example register](https://deedglass.com/blog/hipaa-risk-analysis-for-ai-tools): HIPAA requires an accurate and thorough risk analysis of everything that holds ePHI. AI tools add data flows and threats the usual template misses. Here is a method, with an example risk register for an AI scribe. - [HL7 AI Transparency on FHIR: how to mark data an AI touched, and the gaps](https://deedglass.com/blog/hl7-ai-transparency-on-fhir): When an AI summarises a note or drafts a lab interpretation, downstream users need to know. HL7's AI Transparency on FHIR guide proposes how to mark that in FHIR. Here is what's in the ballot version, and what isn't. - [Building an HL7 v2 to FHIR pipeline: stages, the HL7 mapping guide, and where agents fit](https://deedglass.com/blog/hl7v2-to-fhir-pipeline-with-agents): Most hospital data still moves as HL7 v2 messages. Converting them to FHIR takes five stages, with several places to lose data quietly. Here is the shape, the official mappings, and where agents fit. - [Hook, sandbox, database role or gate: which one stops an AI agent deleting data?](https://deedglass.com/blog/hook-vs-sandbox-vs-database-role): Each control people reach for stops a different thing. A hook reads commands, a sandbox fences files and network, a role limits the database, a gate judges each call. Here is a side-by-side. - [How to build an insurable autonomous AI agent: the technical specification](https://deedglass.com/blog/how-to-build-an-insurable-ai-agent-spec): Cyber insurance underwriters and enterprise risk officers are declining policies for unmonitored AI agents that mutate production databases. Here is the engineering architecture required to deploy insurable autonomous systems. - [Incident response for AI errors in a hospital: a runbook for IT and governance](https://deedglass.com/blog/incident-response-for-ai-errors-in-hospitals): When an AI tool writes the wrong thing into a hospital system, the first hour decides how much damage spreads. Here is a runbook built on NIST's incident guidance, with the Indian and US reporting clocks. - [India's AI Governance Guidelines (2025), read for hospitals and health-tech teams](https://deedglass.com/blog/india-ai-governance-guidelines-healthcare): India chose guidelines over a new AI law. They are voluntary, but they say what regulators will look for: human oversight, audit trails, incident reporting and extra safeguards in health. - [India's EHR Standards on audit trails: log every view, never overwrite, detect edits](https://deedglass.com/blog/india-ehr-standards-log-viewing): India's EHR Standards ask more of audit logs than most systems do by default: record viewing, never overwrite a record, and detect any change to the logs themselves. - [Indirect prompt injection: what the 2023 paper predicted, and what happened next](https://deedglass.com/blog/indirect-prompt-injection-research): In February 2023, researchers showed that instructions hidden in a web page or document could take over an LLM app that merely read them. Here is what the paper found, and how its predictions played out in agent tools. - [Indirect prompt injection via tool outputs: why prompt boundaries fail](https://deedglass.com/blog/indirect-prompt-injection-tool-outputs-guide): When an AI agent ingests untrusted text from a database, web scraper, or ticket queue, embedded adversarial commands execute with agent authority. Here is why outbound tool gates are the only deterministic defense. - [The information blocking rule: who it covers, what counts, and the exceptions](https://deedglass.com/blog/information-blocking-rule-basics): US health providers, networks and some health IT developers must not interfere with access to electronic health information without a reason the rule recognises. Here is the rule, its exceptions, and where AI tools fit. - [InjecAgent, explained: how often tool output can hijack an agent](https://deedglass.com/blog/injecagent-indirect-prompt-injection-benchmark): An agent reads a product review, an email or a calendar note, and the text tells it to unlock a door or send data elsewhere. InjecAgent measured how often that works. Here is the design, the numbers and the lessons. - [INSERT … ON CONFLICT said 12 rows. Five of them were overwrites.](https://deedglass.com/blog/insert-on-conflict-how-many-rows-updated): An upsert's command tag counts inserted and updated rows together. An agent that reads 'INSERT 0 12' as twelve new rows misses every overwrite. Here is how to get the real split, run on PostgreSQL 18. - [AI in cashless pre-authorisation: the audit trail insurers and hospitals should keep](https://deedglass.com/blog/insurer-pre-auth-ai-records): IRDAI gives insurers one hour to decide a cashless request. AI is being used to meet that clock. When a decision is questioned later, these are the records that let anyone reconstruct what happened. - [IRDAI Information and Cyber Security Guidelines 2026: logs, reporting and changes](https://deedglass.com/blog/irdai-cyber-security-guidelines-insurers): IRDAI replaced its 2023 cyber security guidelines in April 2026. If you run IT for an Indian insurer, TPA or broker, or sell software to one, here is what the new text asks for. - [Is Supabase MCP safe? A 10-point setup checklist, and what read-only mode doesn't stop](https://deedglass.com/blog/is-supabase-mcp-safe): Safe enough for development, if you set it up that way: one project, read-only, few tools, a person approving each call, and no secrets the session can reach. - [LangGraph interrupt() or HumanInTheLoopMiddleware: which to use for tool approval](https://deedglass.com/blog/langgraph-interrupt-vs-middleware-approval): LangChain gives you two ways to pause an agent for a person: a ready-made middleware that reviews tool calls, and the lower-level interrupt() it's built on. They differ in effort and in one trap: nodes re-run on resume. - [Laravel migrations and AI coding agents: migrate yes, migrate:fresh no](https://deedglass.com/blog/laravel-migrations-ai-agent): An agent that hits Laravel's production prompt learns --force. One line in a service provider stops migrate:fresh and db:wipe whatever flag it adds. Here is the setup, tested. - [How to let an AI agent write database migrations without letting it run them](https://deedglass.com/blog/let-ai-agents-write-migrations-safely): Writing a migration is a good job for an agent. Running one against a shared database is not. Split the two, and most of the risk goes away. Here is the workflow, the review checklist and the guardrails. - [The lethal trifecta for AI agents: what it is and how to break it](https://deedglass.com/blog/lethal-trifecta-ai-agents): An agent that can read private data, reads untrusted content and can send data out can be tricked into leaking. That's the lethal trifecta. Here's how to spot each leg and remove one. - [Linear MCP server security: read-only by URL, by scope or by key](https://deedglass.com/blog/linear-mcp-server-security): Linear's MCP server can create and update issues, projects and comments by default. It also offers three ways to make it read-only. Here is each one, and which to pick. - [How to govern LlamaIndex database agent tool calls](https://deedglass.com/blog/llamaindex-agent-database-tool-approvals): LlamaIndex agents connect to databases through tool specs or workflows. Here is how Deedglass intercepts each tool call, pauses sensitive writes for approval, and verifies committed rows. - [LLM-as-a-judge: how reliable it is, and where agents need something else](https://deedglass.com/blog/llm-as-a-judge-for-agent-evals): Using a model to grade another model's output is fast and cheap. The study that popularised it found strong agreement with people, and measurable biases. Here are the numbers, the fixes, and why agent actions need a different grader. - [How often do LLMs hallucinate in clinical notes? Two studies, two very different numbers](https://deedglass.com/blog/llm-hallucination-rates-clinical-notes): One peer-reviewed study reports 1.47% of sentences hallucinated. Another reports 23.6 errors per note. Both are careful work. The difference is in what they counted. Here is how to read such numbers, and what a system should record. - [How accurate are LLMs at medical coding? Three studies, and what to build around them](https://deedglass.com/blog/llms-medical-coding-accuracy-study): Medical coding turns clinical notes into billing codes, and claims depend on it. Three recent studies put general-purpose LLMs to the test. Exact matches ranged from 14% to 45%. Here is what each measured. - [Securing a local MCP server: the Origin check, the Host check and DNS rebinding](https://deedglass.com/blog/local-mcp-server-origin-check): Binding an MCP server to localhost doesn't keep web pages out. A page can reach it through the browser, and DNS rebinding makes that worse. Three checks close it; here they are, tested. - [Lockdown mode for hospitals: how to make every AI agent write wait for a person](https://deedglass.com/blog/lockdown-mode-for-hospitals): Some systems are too sensitive for rules alone. Lockdown is a pattern for them: every agent write waits for a person, the riskiest writes never run, and an unchecked result stops the agent until someone looks. - [Malaffi, Abu Dhabi's health information exchange: what facilities and vendors need to know](https://deedglass.com/blog/malaffi-abu-dhabi-health-information-exchange): Malaffi links nearly every healthcare facility in Abu Dhabi to one patient record. Connection is tied to licensing and claims. Here is what Malaffi's own pages say about joining, security and access to sensitive data. - [Mastra tool approval: requireToolApproval, requireApproval and what happens on a crash](https://deedglass.com/blog/mastra-require-tool-approval): Mastra can pause an agent before a tool runs and wait for someone to approve or decline. It has two switches, a dynamic form that fails closed, and one requirement people miss: storage. - [MCP 2026-07-28: what changed, and what it means for anyone in the middle](https://deedglass.com/blog/mcp-2026-07-28-spec-changes): The 2026-07-28 revision makes MCP stateless: no handshake, no sessions, metadata on every request. Here is each change, sourced to the spec, with what it means for gateways and logs. - [MCP authorization explained: how OAuth 2.1 protects a remote MCP server, step by step](https://deedglass.com/blog/mcp-authorization-spec-explained): Remote MCP servers use OAuth 2.1. The spec picks a small set of RFCs and makes a few of them mandatory. Here is the flow, what each piece stops, and what authorization still leaves to you. - [mcp-remote CVE-2025-6514: how an OAuth URL from a server became a command on your machine](https://deedglass.com/blog/mcp-remote-oauth-vulnerability): In mid-2025, connecting mcp-remote to the wrong MCP server could run a command on your computer. The fix shipped in 0.1.16. Here's what the primary sources say and how to check your setup. - [MCP sampling security: what a server can do with your model, and why it is deprecated](https://deedglass.com/blog/mcp-sampling-security): Sampling lets an MCP server ask your client's model to write text, and even call tools. Researchers showed servers using it to spend your tokens, steer your chat and write files. The spec has now deprecated it. - [MCP security research: what the papers and disclosures have found so far](https://deedglass.com/blog/mcp-security-research-papers): The Model Context Protocol went from launch to everywhere fast, and security research followed. Here are the main papers and disclosures, what each showed, and a lifecycle map of which control addresses which threat. - [MCP security checklist: what to check before an agent gets a tool](https://deedglass.com/blog/mcp-server-security-basics): Twelve checks for any MCP server that touches real data, with the command or query that answers each. Most come down to what the server can reach, who can talk to it, and what reaches the model. - [MCP token passthrough and the confused deputy problem, explained](https://deedglass.com/blog/mcp-token-passthrough-confused-deputy): Two of the MCP spec's security rules are about tokens: never accept a token issued for someone else, and never let a proxy skip the user's consent. Here's what each attack looks like and what to check. - [MCP tool poisoning: instructions hidden where only the model looks](https://deedglass.com/blog/mcp-tool-poisoning): An MCP tool's description goes straight into the model's context. Tool poisoning puts instructions there. Here is the attack as first described, its two variants, and which defences hold. - [MCP Toolbox for Databases security: what to configure before an agent touches your data](https://deedglass.com/blog/mcp-toolbox-for-databases-security): MCP Toolbox for Databases gives agents database tools from a YAML file. Its safest mode is the one most quick starts skip. Here is what each mode allows, and the settings that matter. - [MedAgentBench: AI agents in a FHIR-based EHR read well and write worse](https://deedglass.com/blog/medagentbench-fhir-agent-benchmark): MedAgentBench put LLM agents in a virtual health record that speaks FHIR, with 300 tasks written by physicians. Reads went much better than writes. Here is the setup, the gap, and what to do. - [A MongoDB read-only user for an AI agent, and the MCP server's read-only mode](https://deedglass.com/blog/mongodb-read-only-user-ai-agent): MongoDB's readWrite role can drop collections. Here is a user an agent can't write with, a role that can write but not drop, and the MCP server flag that hides write tools. - [Why multi-agent hallucination cascades corrupt production databases](https://deedglass.com/blog/multi-agent-hallucination-cascades-database-corruption): When autonomous agent swarms coordinate, an error from one worker becomes factual context for the next. Without storage-level verification, database mutations compound silently across worker boundaries. - [MySQL point-in-time recovery with the binary log: undo one bad statement from an agent](https://deedglass.com/blog/mysql-binlog-point-in-time-recovery): An agent ran a DELETE or DROP on MySQL. If binary logging is on, which it is by default in 8.4, you can replay everything except that statement. Here's the procedure from MySQL's docs, step by step. - [MySQL ON DELETE CASCADE isn't in the binlog: what that hides, and what to do](https://deedglass.com/blog/mysql-cascade-not-in-binlog): Delete one parent row in MySQL and InnoDB may delete hundreds of children. Those child deletes don't appear in the binary log, so replicas, change feeds and audits built on it don't see them. - [A MySQL read-only user for an AI agent: grants, limits and the gaps](https://deedglass.com/blog/mysql-read-only-user-for-ai-agent): The safest MySQL connection for an AI agent or MCP server is a user that can only SELECT what the task needs. Here is the setup, statement by statement, and why server-wide read_only is a different tool. - [NABIDH, Dubai's health information exchange: what DHA's standards ask of software](https://deedglass.com/blog/nabidh-dubai-health-information-exchange): NABIDH connects Dubai's public and private healthcare facilities. If you build or run software for a DHA-licensed facility, its standards shape your interfaces, consent handling and audit logs. Here is what DHA's documents say. - [The NAIC model bulletin on AI: what insurers and their vendors need to have ready](https://deedglass.com/blog/naic-ai-model-bulletin-insurers): The NAIC's 2023 model bulletin is the closest thing US insurance has to a common AI rulebook. It asks for a written program and lists the documents a regulator may request. Here is what the text says. - [Using NVIDIA Nemotron 3 Ultra to check AI agent blast radius before execution](https://deedglass.com/blog/nemotron-ultra-ai-agent-blast-radius-policy): When an AI agent plans a database write or API call, how do you know what it will really change? Here is how we integrated NVIDIA Nemotron 3 Ultra to inspect agent requests and synthesize policy rules in real time. - [A Neon database branch per pull request: where an agent's changes meet data first](https://deedglass.com/blog/neon-branch-per-pull-request): When an agent opens a pull request with a migration, the safest first run is on a copy of the data made for that pull request. Neon's GitHub Actions create, diff, reset and delete such branches. - [Is the Neon MCP server safe to use on production?](https://deedglass.com/blog/neon-mcp-server-production): Neon's own docs say no: use its MCP server for development and testing. Here is what each setting narrows, what stays open, and how to give an agent Neon access without pointing it at production. - [NHCX explained: the claims flows, the FHIR bundles, and where AI fits](https://deedglass.com/blog/nhcx-claims-fhir-and-ai): NHCX moves cashless claims between hospitals and insurers as FHIR bundles. If an AI tool helps build a pre-auth or a claim, here is what the bundle carries and what to check before it goes out. - [Notion MCP server security: what an agent can read, change and trash](https://deedglass.com/blog/notion-mcp-server-security): Connect Notion to a coding agent and it can do anything in Notion that you can. Here is what the hosted server's tools cover, how its delete confirmation works, and how to narrow the reach. - [NPHIES explained: how Saudi Arabia's eClaims exchange works, from its implementation guide](https://deedglass.com/blog/nphies-saudi-health-insurance-platform): Private health insurance claims in Saudi Arabia go through NPHIES. If you build hospital billing, insurer or TPA software for the Kingdom, its FHIR guide sets the rules. Here is what it says. - [The Nx s1ngularity attack: a malicious package that tried to use your AI coding tools](https://deedglass.com/blog/nx-s1ngularity-ai-cli-supply-chain): Malicious versions of Nx on npm collected credentials and, by Nx's account, tried to use the AI tools installed on each machine. Here's what the primary sources say, and the agent settings that matter when malware is the one typing. - [ON DELETE CASCADE deleted more rows than expected: how to see it coming](https://deedglass.com/blog/on-delete-cascade-deleted-more-rows): The command tag said DELETE 1. The transaction deleted 49 rows in three tables and changed two more. Here is the run, a query that maps every cascade, and a way to count before committing. - [OpenAI Agents SDK human-in-the-loop: pausing a run for approval with needs_approval](https://deedglass.com/blog/openai-agents-sdk-human-approval): The OpenAI Agents SDK can pause a run before a tool executes and wait for a person, even across a restart. Approvals also reach tools that guardrails skip, such as the shell and hosted MCP. - [OpenAI Agents SDK tool guardrails: how to use them on MCP tools, and what they skip](https://deedglass.com/blog/openai-agents-sdk-tool-guardrails): The OpenAI Agents SDK can check every tool call before it runs. That check covers function tools and local MCP servers, and skips hosted MCP, the shell tool and handoffs. Here is the map. - [OWASP Top 10 for Agentic Applications: what a tool-call gate covers, and what it doesn't](https://deedglass.com/blog/owasp-agentic-top-10-what-a-gate-covers): OWASP's agentic list names ten risks, from goal hijack to rogue agents. A gate between agents and their tools helps with some, partly with others, and does nothing for a few. Here is the map, misses included. - [OWASP LLM06 Excessive Agency: what it means and how to audit your agent for it](https://deedglass.com/blog/owasp-llm06-excessive-agency): Excessive Agency is OWASP's name for an LLM app that can do more damage than its job needs. It has three causes and eight mitigations. Here they are, applied to a real-looking agent setup. - [pgAudit, triggers or logical decoding: auditing what an AI agent wrote to Postgres](https://deedglass.com/blog/pgaudit-triggers-logical-decoding-agent-audit): We ran one agent write through four audit methods on a local Postgres 18.6 and kept the output. Each one answers a different question, and two of them missed 300 rows. - [Post-quantum signatures for audit logs: why records signed today must still check in 2046](https://deedglass.com/blog/post-quantum-signatures-for-audit-logs): Audit records outlive the algorithms that sign them. NIST's draft schedule retires EdDSA after 2035, so a log signed with Ed25519 today needs a second, post-quantum seal long before then. - [PostgreSQL 18 RETURNING OLD and NEW: what it returns, with tested examples](https://deedglass.com/blog/postgres-18-returning-old-new): Before PostgreSQL 18, an UPDATE could return the new row but not the old one. Now RETURNING can show both, in one round trip. Here is the syntax, tested output, and the uses that matter for audit. - [Hide personal data columns from an AI agent with Postgres column grants](https://deedglass.com/blog/postgres-column-grants-hide-pii-from-agent): An agent often needs a customers table but not the email and phone columns in it. Postgres can grant single columns. We tested what the agent can and can't do with that. - [Postgres default privileges and an AI agent's role: new tables, granted or not](https://deedglass.com/blog/postgres-default-privileges-for-agent-roles): You grant an agent's role read access, a migration adds a table, and the agent either can't see it or can see too much. Postgres default privileges decide which. We ran both cases. - [Block DROP TABLE and ALTER TABLE for an AI agent's role with a Postgres event trigger](https://deedglass.com/blog/postgres-event-trigger-block-ddl): Sometimes an agent's role has to own tables, and owners can drop them. A Postgres event trigger can refuse that DDL for one role. We tested it, including the agent trying to switch it off, and found the gap. - [The Postgres MCP server read-only bypass: reproduced, and what actually holds](https://deedglass.com/blog/postgres-mcp-server-read-only-bypass): Datadog Security Labs showed that one stacked COMMIT turns the archived Postgres MCP server's read-only mode into full write access. We reran the mechanism and tested five defences against it. - [Postgres SET ROLE per user: making an AI agent query as the person it serves](https://deedglass.com/blog/postgres-set-role-per-user-agent): An agent serving many users through one connection pool should see only the current user's rows. SET LOCAL ROLE plus a transaction-scoped setting does that, until the model can send the SET itself. - [statement_timeout, lock_timeout and friends: timeouts for an AI agent's Postgres role](https://deedglass.com/blog/postgres-timeouts-for-ai-agent-roles): An agent that runs a slow query, waits on a lock or leaves a transaction open can stall a production database. Four Postgres timeouts on the agent's own role stop that. We ran each one, and found their limit. - [Your Postgres view bypasses row-level security. Here's the fix.](https://deedglass.com/blog/postgres-view-bypasses-rls): Row-level security on a table doesn't follow it into a view by default. The view checks its owner's rights, not the caller's. A local test, the fix and an audit query. - [Prior authorization burden statistics: what the surveys say, and what changes from 2026](https://deedglass.com/blog/prior-authorization-burden-statistics): How much work does prior authorization create? The most-quoted figures come from AMA physician surveys: 39 requests and 13 hours a week. Here are the numbers with their sources and limits, and what CMS-0057-F changes. - [Prisma MCP server: what it can do, which tools are risky, and how to set it up safely](https://deedglass.com/blog/prisma-mcp-server): Prisma's remote MCP server lets an AI agent create databases, run SQL, restore backups and manage deployments. Prisma's own docs warn that its CLI safeguard doesn't apply to these tools. Here is the map. - [Designing agents that prompt injection can't steer: CaMeL and the six patterns](https://deedglass.com/blog/prompt-injection-design-patterns-camel): Two 2025 papers argue that prompt injection is better contained by how an agent is built than by filtering what it reads. One proposes CaMeL; the other catalogues six patterns. Here is each, and its cost. - [Pydantic AI tool approval: requires_approval and deferred tool results, tested](https://deedglass.com/blog/pydantic-ai-approval-required-toolset): Pydantic AI handles approval by ending the run: the agent returns the pending calls instead of an answer, and a second run carries your decisions. We ran it with the built-in TestModel. - [Questions to ask an AI scribe or assistant vendor, before you sign](https://deedglass.com/blog/questions-to-ask-an-ai-scribe-vendor): A demo shows you a good note. These questions show you what happens to patient data, who reviews the draft, what gets logged, and how you leave. Non-clinical, for doctors and clinic managers. - [Rails migrations and AI coding agents: db:migrate yes, db:reset no](https://deedglass.com/blog/rails-migrations-ai-agent): Rails has a built-in brake on destructive database tasks in production. An agent can release it with one environment variable. Here is how the brake works and what to add. - [rds_superuser and neon_superuser: what your agent inherits, and what to give it instead](https://deedglass.com/blog/rds-superuser-neon-superuser-agents): Managed Postgres has no true superuser for you, but the admin role you do get is close. Connect an agent with it and the agent holds the same power. Here's what each provider's admin role carries. - [A replication slot is filling your disk with WAL: find it, cap it, drop it](https://deedglass.com/blog/replication-slot-wal-disk-full): A logical replication slot that nobody reads keeps every WAL file since it stopped. By default there's no limit. We reproduced it, capped it, and watched the slot get invalidated. - [What the Replit and PocketOS incidents teach, from their primary sources](https://deedglass.com/blog/replit-and-pocketos-what-the-primary-sources-say): The platforms' own write-ups describe the mechanism: agent credentials that reached production, and guardrails that lived somewhere the agent didn't go. - [Require approval for MCP tool calls: Claude Code, Cursor, then a gateway](https://deedglass.com/blog/require-approval-mcp-tool-calls): Both clients can ask before a tool runs. Here is the configuration, a hook we tested, what each layer can't see, and the point where approvals belong outside the editor. - [An AI agent deleted data on Neon: restore the branch or copy rows back](https://deedglass.com/blog/restore-neon-after-agent-delete): Neon keeps a history of changes, so data an agent deleted is often minutes from recovery. The choice is between rolling the whole branch back and copying back only what was lost. - [How to restore one Postgres table to a point in time](https://deedglass.com/blog/restore-one-postgres-table-point-in-time): PostgreSQL can't roll back one table by itself. You recover a side copy of the cluster to just before the bad statement, then copy that table's rows back. Here's the run, step by step. - [An AI agent deleted data in Supabase: how to get it back](https://deedglass.com/blog/restore-supabase-after-agent-delete): Supabase can restore a backup over your project, but that rolls back everything written since. Usually it's better to restore beside production and copy back only the rows the agent deleted. - [How to give an AI agent safe Postgres access: the role, RLS and statement limits](https://deedglass.com/blog/safe-postgres-access-for-ai-agents): Three layers, each tested on PostgreSQL 18.6 with the output below: what the agent may change, which rows, and for how long. Then the gap all three share when the agent writes its own SQL. - [Saudi PDPL and health data: what the law and its Implementing Regulation require](https://deedglass.com/blog/saudi-pdpl-health-data): Saudi Arabia's Personal Data Protection Law gives health data its own article, and the Implementing Regulation adds specific controls. If you build or run health software in the Kingdom, here is what the texts say. - [Scan MCP and agent configs on every pull request with a GitHub Action](https://deedglass.com/blog/scan-mcp-config-in-ci): Someone adds a database MCP server for a demo and it ships. A check on the pull request catches it. Here is a free Action that grades agent config, comments the change and stays read-only. - [How to protect MCP servers against tool poisoning and unconstrained writes](https://deedglass.com/blog/securing-mcp-servers-in-production-guide): Model Context Protocol connects AI agents directly to tools, APIs, and databases. But MCP provides no native policy enforcement. Here is how to wrap MCP servers with declarative CEL rules, intercept destructive tool calls, and verify storage reality. - [Semantic Kernel function invocation filters as tool-call guardrails](https://deedglass.com/blog/semantic-kernel-function-invocation-filter): In Semantic Kernel, a function invocation filter wraps every function call. Don't call next and the function never runs. We used that to hold large refunds for a person, and ran it. - [Sentry MCP server security: scope it to a project, keep the write skills off](https://deedglass.com/blog/sentry-mcp-server-security): Sentry's MCP server lets an agent read errors and traces, and with the right skills, resolve issues and edit alert rules. Here is how to give it the first without the second. - [AIHGle 2.0 explained: what Singapore's AI in healthcare guidelines ask of deployers](https://deedglass.com/blog/singapore-ai-in-healthcare-guidelines): In March 2026 Singapore's MOH and HSA launched AIHGle 2.0, the update to the 2021 AI in Healthcare Guidelines. It splits duties between developers, deployers and users. Here is what the text says. - [Singapore's Health Information Act: NEHR contribution, access rules and penalties](https://deedglass.com/blog/singapore-health-information-act): Singapore passed its Health Information Bill in 2026 as the Health Information Act. It makes NEHR contribution compulsory and sets security duties for providers. Here is what MOH's own documents say. - [Slack MCP server security: the scopes each tool needs, and the ones to leave out](https://deedglass.com/blog/slack-mcp-server-security): Slack's MCP server can search, read, post, create channels and upload files as the user who signed in. The scope list decides which. Here is the full map and three minimal sets. - [SMART on FHIR EHR launch vs standalone launch, and which an AI assistant should use](https://deedglass.com/blog/smart-app-launch-ehr-vs-standalone): SMART App Launch has two ways in: from inside the EHR, or from outside it. They differ in how the app learns which patient and user it's working for. Here is the difference, the security rules, and the AI angle. - [SMART Backend Services for AI agents: how an agent gets a FHIR token, and the gaps](https://deedglass.com/blog/smart-backend-services-for-agents): An AI agent that works without a person logged in needs its own FHIR credentials. SMART Backend Services is the standard way. Here is how it works, how to scope it for an agent, and what it leaves to you. - [SMART on FHIR v2 scopes: how to give an AI agent only the access it needs](https://deedglass.com/blog/smart-on-fhir-v2-scopes): SMART App Launch 2 replaced read and write scopes with five letters: create, read, update, delete, search. Add a query filter and a scope can name one category of one resource. Here is the syntax and an agent-sized scope set. - [How to stop an AI coding agent deleting RDS databases and S3 buckets](https://deedglass.com/blog/stop-ai-agent-aws-cli-deletes): A coding agent with your AWS profile can delete a database and its automated backups in one command. Here are four settings that make that hard, with the commands to turn each on. - [How to stop an AI coding agent deleting Docker volumes and the data in them](https://deedglass.com/blog/stop-ai-agent-docker-volume-delete): Your local Postgres lives in a Docker volume. An agent resetting a broken environment runs compose down -v and it's gone. Here is which commands delete volumes, what a guard catches, and what it misses. - [How to stop an AI coding agent from running kubectl delete namespace](https://deedglass.com/blog/stop-ai-agent-kubectl-delete): One kubectl delete namespace removes everything in it, and a deleted claim can take the disk with it. Here is how to give an agent read access to a cluster without that power. - [How to stop an AI coding agent from running redis-cli flushall](https://deedglass.com/blog/stop-ai-agent-redis-flush): An agent debugging a queue or resetting tests can run redis-cli flushall in seconds, wiping caches, jobs and user sessions across the instance. Here is how to lock down Redis and ask before dangerous commands run. - [How to stop an AI coding agent from running terraform destroy](https://deedglass.com/blog/stop-ai-agent-terraform-destroy): An agent that can run terraform apply can run terraform destroy. Here are four layers that each stop it a different way, what each one misses, and the commands we tested. - [Stripe restricted keys for AI agents: let an agent handle refunds without a secret key](https://deedglass.com/blog/stripe-restricted-key-ai-agent): Stripe now has a way to hand an AI agent a key: a restricted key tagged for agent access, with approval rules on refunds and payouts by default. Here's a setup for a refund agent. - [Supabase branching for agent-written migrations: the merge button is the approval](https://deedglass.com/blog/supabase-branching-preview-migrations): Supabase can give every pull request its own instance, built from your repository's migrations, with no production data unless you add it. Merging then deploys to production automatically. That changes what reviewing an agent's PR means. - [The Supabase MCP "leak": what the July 2025 demonstration showed, and what changed after](https://deedglass.com/blog/supabase-mcp-leak-what-the-demo-showed): No customer data leaked. A research team showed, on dummy data, how one support ticket could steer a developer's assistant into copying secrets to where an attacker could read them. - [The Supabase service_role key and AI agents: why it skips every policy](https://deedglass.com/blog/supabase-service-role-key-ai-agent): An AI agent holding a Supabase secret or service_role key reads and writes past every row-level security policy. Here is what the key is, a local test of the mechanism, and what to hand the agent instead. - [What SWE-bench measures, and what a high score doesn't tell you](https://deedglass.com/blog/swe-bench-what-it-measures): SWE-bench is the benchmark most quoted for coding agents. It asks one precise question: does the agent's patch make the right tests pass? Here is how it works, what Verified changed, and what it leaves out. - [Running a synthetic-data pilot for AI in a hospital: a practical plan](https://deedglass.com/blog/synthetic-data-pilot-for-hospital-ai): Before an AI tool touches a real chart, a hospital can test how it writes, what it records and who approves what, on synthetic patients. Here is a plan, the measures that fit, and where synthetic data stops helping. - [τ-bench explained: database-state scoring and the pass^k reliability metric](https://deedglass.com/blog/tau-bench-explained): τ-bench is a tool-use benchmark that checks what an agent did to a database, not what it said. Its pass^k metric asks whether an agent succeeds every time. Here is how both work, with worked numbers. - [What is TEFCA? The Common Agreement, QHINs and exchange purposes, explained](https://deedglass.com/blog/tefca-explained): TEFCA is the US framework that lets health information networks exchange data under one agreement instead of hundreds. Here is how it's structured, what it can be used for, and what it means for AI tools pulling records. - [Text-to-SQL benchmarks: what BIRD and Spider 2.0 say about letting agents write SQL](https://deedglass.com/blog/text-to-sql-benchmarks-bird-spider): AI agents increasingly answer questions by writing SQL against real databases. BIRD and Spider 2.0 measure how often that SQL is right. The gap between easy and enterprise databases is large. Here is what each measures. - [ToolEmu, explained: finding an AI agent's risky actions before it touches real tools](https://deedglass.com/blog/toolemu-risky-agent-actions): Testing an agent against real email, banking or file tools is slow and dangerous. ToolEmu emulates the tools with a language model instead. Here is how it works, what it found, and how to use the idea. - [The transfer failed halfway and the agent said no money moved. The debit had committed.](https://deedglass.com/blog/transfer-failed-halfway-debit-committed): Three statements, no transaction, an error on the second. The agent reported the transfer failed, so nothing changed. Postgres had already committed the debit. Here is the reproduction and the fix. - [Undo for agent sessions: putting back what an AI agent changed in Postgres](https://deedglass.com/blog/undo-for-agent-sessions): A backup restore throws away everyone's work since the backup. What you want is the rows the agent changed, before and after, and a safe way to put them back. Postgres already records both. - [Vercel AI SDK tool approval: moving from needsApproval to toolApproval](https://deedglass.com/blog/vercel-ai-sdk-needsapproval-to-toolapproval): The AI SDK's per-tool needsApproval flag is deprecated; approval now lives in a toolApproval setting on the call. We ran both against a mock model to see exactly when a tool executes. - [Where each AI client keeps its MCP config: paths, keys and secrets](https://deedglass.com/blog/vs-code-windsurf-mcp-config-files): Eight clients, at least twelve file locations, three different top-level keys. Here is one table of where each client reads MCP servers from, how it takes secrets, and how to limit tools. - [VS Code agent mode auto-approve: which terminal commands run without asking](https://deedglass.com/blog/vscode-copilot-agent-mode-auto-approve): VS Code's agent mode can run terminal commands with or without a prompt, decided by a few settings. Here's how the rules combine, the defaults, and why VS Code calls them a convenience, not a boundary. - [We show where our gateway loses: an open benchmark for agent-database tools](https://deedglass.com/blog/we-show-where-our-gate-loses): Twelve database scenarios where what an AI agent reports and what Postgres commits come apart. Our gateway caught 5 of the 11 that diverge. The 6 it missed come first. - [WebArena and OSWorld: how computer-use agents are tested, and what the scores mean](https://deedglass.com/blog/webarena-osworld-computer-use-benchmarks): Computer-use agents click, type and browse like a person. WebArena and OSWorld test them on real websites and real operating systems, and check what changed, not what the agent said. Here is how, and what the first results showed. - [What is Deed Glass? The AI agent execution layer explained](https://deedglass.com/blog/what-is-deed-glass): Deed Glass (officially Deedglass) sits between an autonomous AI agent and the tools it uses. Rules decide each tool call before execution; write-ahead logs verify what committed. - [What's new in Deedglass 0.15.0: one command, and an app opens in your browser](https://deedglass.com/blog/whats-new-in-deedglass-0-15-0): Deedglass now opens as a simple app in your browser, with no Docker, account or database to set up. Here is how to open it, what each screen means, where your data stays and how to stop it. - [Which EHR writes should an AI agent need approval for? A tiering method](https://deedglass.com/blog/which-ehr-writes-need-approval): Approving every AI write wears reviewers out; approving none is reckless. Here is a way to sort EHR writes into five tiers by what they can affect and how hard they are to undo. - [Why AI agent retry loops compound database corruption](https://deedglass.com/blog/why-ai-agent-retries-compound-database-corruption): When an automated agent encounters a database error, standard retry loops ask the language model to fix its mistake. Without storage-layer ground truth, the model hallucinates compensating queries that turn single-row errors into multi-table cascades. - [Why logs aren't evidence of what your AI agent did](https://deedglass.com/blog/why-logs-arent-evidence): A log tells you what some process chose to write down. Evidence has to say who wrote it, whether it changed since, and whether it matches what the system really did. - [Why multi-agent LLM systems fail: 14 failure modes from 1,600 traces](https://deedglass.com/blog/why-multi-agent-systems-fail): Splitting work across several agents is popular. A 2025 study read over 1,600 traces from seven multi-agent frameworks and catalogued how they fail. The most common failures are mundane: repeating steps, not stopping, and saying one thing while doing another. - [Why prompt firewalls fail to protect production databases from AI agents](https://deedglass.com/blog/why-prompt-firewalls-fail-at-the-database-layer): Most AI guardrails inspect prompt text before execution. At the database layer, that model falls apart. Here is why an agent claiming to update one row can silently change hundreds, and why verification must happen at the commit level. - [Why a regex can't block DROP TABLE from an AI agent: a six-statement test](https://deedglass.com/blog/why-regex-cant-block-drop-table): A regular expression looks like a quick guard against destructive SQL. We ran six statements past one. Five dropped tables and passed; it blocked the only harmless one. Here is why, and what works. - [Windsurf Cascade auto-execution: Turbo mode, allow lists, deny lists and hooks](https://deedglass.com/blog/windsurf-cascade-auto-execution): Cascade can run terminal commands on its own at four levels, from Disabled to Turbo. The lists that steer it match by prefix, and a deny entry means ask, not block. Here is how each piece behaves.