Loading today’s stories
Build1 distinct publisher3 min readUpdated
A dev.to translation table maps most agent vocabulary onto control loops, IAM and sandboxes. What is left over is nondeterminism and unbounded runtime cost.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
A post on dev.to takes the "twelve must-know agentic AI terms" infographic genre and does the thing the infographics do not: it checks which terms describe something platform teams do not already run. Its answer is ten of the twelve are re-labellings and two are genuinely new [1], which matters because the vocabulary rarely arrives on its own. It arrives with an executive who has read the list and wants to know how soon an agent can have production access [2].
The translation table is unremarkable, which is the point. The ten map onto control loops, IAM, sandboxes, admission policies, change gates and schedulers [3]. Guardrails are admission control [4]. Sandboxing is what infrastructure teams have been doing to untrusted workloads since cgroups [5]. The agent loop that every explainer draws as perceive, plan, act, observe, repeat is the observe-diff-act-verify cycle anyone who has written a Kubernetes controller has already drawn and called something else [6].
Two of the translations carry an operational instruction rather than just a synonym. Tool use is an IAM question, not an AI question: an agent's blast radius is exactly the union of the credentials you handed its tools, and nothing about the model changes that [7]. Prompt injection is privilege escalation with a content payload instead of a binary one, and your telemetry is one of the delivery channels [8]. Neither of those requires new machinery to reason about. They require you to answer the credentials question before the model question, including which environments are in scope and what the audit trail actually records [9].
Then the part with no analogue. The post identifies the two genuinely new things as nondeterminism and unbounded runtime cost [10]. Nondeterminism is where the controller comparison stops paying. Give a controller the same cluster state twice and you get the same action twice, and that single property is load-bearing for most of what you know about operating control loops: it is why a controller is testable, why a stuck reconcile can be reasoned about, why a rerun is a diagnostic rather than a gamble, and why "it did something different this time" is a bug report rather than expected behaviour [11]. An agent given identical inputs may take a different path, usually not a wild one, but enough that reproducing a failure is no longer a controlled experiment, passing once no longer establishes that a path is safe, and post-incident analysis may bottom out at "it sampled a different token" [12].
That reframes a lot of existing process rather than adding to it. A change gate that assumes a dry run predicts the real run is doing less work than you think it is. The post also notes, from the agent side of the loop, that the thing judging the work has to be separate from the thing doing it [13].
The weaker half of the argument is cost. It is named as one of the two new problems but the material develops determinism in detail and leaves runtime spend as an assertion [14].
Worth watching: whether anything you are asked to approve comes with a per-run ceiling on tool calls and spend, and whether your audit trail records the tool call together with the credential it used [9]. If it records only that an agent acted, you have logging, not an audit trail, and the blast radius stays theoretical until an incident prices it.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
The post says the trouble with executive-pitched agent vocabulary is what happens next: the executive brings the vocabulary to the platform team and asks how soon an agent can have production access.
Sandboxing is what infrastructure teams have been doing to untrusted workloads since cgroups.
Every agentic explainer draws the cycle perceive, plan, act, observe, repeat; the same shape appears in a Kubernetes controller as observe (watch the API), diff (current vs desired), act (call the API) and verify (read status).
Tool use is an IAM question, not an AI question: an agent's blast radius is exactly the union of the credentials handed to its tools, and nothing about the model changes that.
Prompt injection is privilege escalation with a content payload rather than a binary one, and telemetry is a delivery channel for it.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Single-source practitioner argument, internally checkable
All claims trace to one self-published dev.to post. Its core technical assertions are inspectable against widely known infrastructure behaviour (controller reconcile loops, RBAC permission enumeration, credential-bound blast radius) and it supplies a concrete verification command, which lifts it above pure assertion. But there is no second publisher, no measurement, no incident or benchmark data, and the headline ten-of-twelve count is unverifiable because the twelve terms are never enumerated.
No adoption signal supplied
The cluster contains no release, deployment, benchmark, pricing, licensing, incident or usage-disclosure evidence. The post describes a vocabulary genre and an operating posture; it reports no deployments of agents with production credentials and no counts of teams following its advice, so adoption cannot be scored without inventing facts.
Deflationary thesis, mildly over-claimed precision
The piece runs against hype: it argues most agent vocabulary is re-labelling of primitives operators already run and that credentials, not models, bound risk. That pulls the gap toward zero or negative. It is nudged positive because the framing device claims a precise ten-of-twelve split without listing the twelve terms, and because it presents two genuinely new problems while developing only one, so the article's stated rigour slightly exceeds what the supplied text demonstrates.
Mild self-promotion, no vendor stake disclosed
The post is developer-audience content on a publishing platform and routes readers to the author's own companion articles, a modest attention incentive. No product, employer, sponsor, funding round or commercial relationship is disclosed or promoted in the supplied text, and the advice given (scope credentials, audit permissions) sells nothing, so incentive pressure is low rather than absent.
Reasoning credible, corroboration and adoption absent
Confidence is moderate-low: the operational reasoning is coherent and largely verifiable by any reader with cluster access, and the claims are correctly attributed to a single identified post. It is capped by the single-publisher cluster, the absence of any adoption or outcome data, the unenumerated ten-of-twelve count, and an excerpt that cuts off mid-sentence.
build
Rate limit your MCP servers, because a retrying agent turns one error into a billing incident1 distinct publisher
build
Your meter now runs on someone else's machine: signed receipts, fsync, and failing open1 distinct publisher
build
Per-developer environments hit their ceiling the day one engineer ran five agents1 distinct publisher
build
Thirteen tasks green, then "give up (Recommended)" on the one that needed understanding1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 19, 2026