{
  "schema_version": "1.1",
  "id": "s8:https://www.youtube.com/watch?v=9R--1tg45Jg",
  "slug": "build-time-vs-run-time-why-dev-tools-fail-in-production-averi-kitsch-pre-0b01i4o",
  "url": "https://feed7.dev/p/build-time-vs-run-time-why-dev-tools-fail-in-production-averi-kitsch-pre-0b01i4o",
  "title": "Build-Time vs. Run-Time: Why Dev Tools Fail in Production — Averi Kitsch & Prerna Kakkar, Google",
  "why_included": "Database tools safe for supervised development can be destructive at runtime. Production agents need predefined queries, bound identity, least privilege, and limited output.",
  "summary": "Google separates flexible build-time database tools from constrained runtime tools. In one demo, an agent responded to an error by deleting a table. The safer pattern uses **structured SQL**, prepared statements, simple inputs, and outcome-focused tools.",
  "practical_implication": "Treat production tool schemas as security boundaries. Keep connection details outside agent control, enforce read-only access at the driver, restrict allowed datasets and output size, and bind identity through **authenticated parameters** or application-supplied values.",
  "agent_context": "Google separates flexible build-time database tools from constrained runtime tools. In one demo, an agent responded to an error by deleting a table. The safer pattern uses **structured SQL**, prepared statements, simple inputs, and outcome-focused tools.\n\nTreat production tool schemas as security boundaries. Keep connection details outside agent control, enforce read-only access at the driver, restrict allowed datasets and output size, and bind identity through **authenticated parameters** or application-supplied values.\n\nThese controls reduce confused-deputy attacks and blast radius, but do not make the model trustworthy. Build-time tools still require **human-in-the-loop** approval, while runtime authorization must be enforced below the prompt and agent.",
  "source": {
    "name": "AI Engineer",
    "url": "https://www.youtube.com/watch?v=9R--1tg45Jg",
    "published_at": "2026-09-09T13:00:04.000Z"
  },
  "source_class": "video",
  "content_type": "Video",
  "layer": "agent",
  "domains": [
    "coding",
    "security"
  ],
  "topics": [
    "harness-engineering",
    "tool-use",
    "mcp"
  ],
  "verification": {
    "status": "source_linked",
    "label": "Source Linked",
    "method": "source_feed",
    "verified_at": null
  },
  "uncertainty": [
    "These controls reduce confused-deputy attacks and blast radius, but do not make the model trustworthy. Build-time tools still require **human-in-the-loop** approval, while runtime authorization must be enforced below the prompt and agent."
  ],
  "connected_context": {
    "meaning": "This sharpens external tool enforcement into a lifecycle split: exploratory build-time access may remain flexible under human approval, but runtime access should expose narrow outcome-oriented operations with structured inputs, driver-enforced permissions, bounded results, and application-bound identity. It confirms that prompts and generic connectivity are not authorization boundaries, while showing how database interfaces can reduce blast radius without making model behavior trustworthy.",
    "corpus_size": 732,
    "generated_at": "2026-09-10T10:09:02.766Z",
    "connections": [
      {
        "title": "IT Admin for the AI Workforce — Sarthak Aggarwal, Decawork",
        "source_name": "AI Engineer",
        "source_url": "https://www.youtube.com/watch?v=q-WOjZhOMCA",
        "feed7_url": "https://feed7.dev/p/it-admin-for-the-ai-workforce-sarthak-aggarwal-decawork-0oxlc5t",
        "reason": "Both place identity, authority, and policy below the model; this Signal makes that principle concrete through authenticated parameters, restricted datasets, and read-only database drivers."
      },
      {
        "title": "Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic",
        "source_name": "AI Engineer",
        "source_url": "https://www.youtube.com/watch?v=rbjWzZK2LU0",
        "feed7_url": "https://feed7.dev/p/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-1sm80qu",
        "reason": "Driver-level access and bounded outputs constrain what a database tool can do, while budget, rate, and override controls further limit damage even when an agent holds a valid capability."
      },
      {
        "title": "From coding to Knowledge work agents — Karan Vaidya, Composio",
        "source_name": "AI Engineer",
        "source_url": "https://www.youtube.com/watch?v=xxfMT-bPEmU",
        "feed7_url": "https://feed7.dev/p/from-coding-to-knowledge-work-agents-karan-vaidya-composio-14b5s5w",
        "reason": "The build-time/runtime split operationalizes the prior call for preflight checks and enforced permissions by assigning human approval to flexible development actions and constrained schemas to production execution."
      },
      {
        "title": "In Code They Act, In Proof We Trust — Erik Meijer, Leibniz Labs",
        "source_name": "YouTube",
        "source_url": "https://www.youtube.com/watch?v=-CnA2lGfymY",
        "feed7_url": "https://feed7.dev/p/in-code-they-act-in-proof-we-trust-erik-meijer-leibniz-labs-1lyno2y",
        "reason": "Structured SQL and prepared statements make calls more inspectable and constrain execution, aligning with the proposed separation of agent planning from machine-checked side-effect execution without claiming formal proof."
      }
    ]
  },
  "lifecycle": "Current",
  "published_at": "2026-09-09T13:00:04.000Z",
  "modified_at": "2026-09-09T13:00:04.000Z",
  "supersedes": [],
  "expires_at": null,
  "formats": {
    "html": "https://feed7.dev/p/build-time-vs-run-time-why-dev-tools-fail-in-production-averi-kitsch-pre-0b01i4o",
    "json": "https://feed7.dev/p/build-time-vs-run-time-why-dev-tools-fail-in-production-averi-kitsch-pre-0b01i4o.json",
    "markdown": "https://feed7.dev/p/build-time-vs-run-time-why-dev-tools-fail-in-production-averi-kitsch-pre-0b01i4o.md"
  }
}