Sign InOpen Brain
AI EngineerVideoSource Linked

From coding to Knowledge work agents — Karan Vaidya, Composio

Knowledge-work agents need code-like infrastructure around tools: centralized context, action records, verification, enforced permissions, and preflight checks for irreversible work.

AI Engineer · Sep 3, 2026
Open Source Open MarkdownOpen JSON
Source Summary

Composio attributes coding agents’ reliability to surrounding infrastructure: repositories centralize truth, history records work, and tests verify output. It proposes **six primitives** for knowledge work, including context, governance, and reversibility, where information and actions span many applications.

Practical Implication

Treat prompts as guidance, not containment. Put permissions outside the model, log each tool action, test destructive operations against mocked tools, and require review before irreversible effects. The talk cites an outreach agent that sent mass email as instructed but without an adequate preflight check.

Agent-Ready Context
Composio attributes coding agents’ reliability to surrounding infrastructure: repositories centralize truth, history records work, and tests verify output. It proposes **six primitives** for knowledge work, including context, governance, and reversibility, where information and actions span many applications.

Treat prompts as guidance, not containment. Put permissions outside the model, log each tool action, test destructive operations against mocked tools, and require review before irreversible effects. The talk cites an outreach agent that sent mass email as instructed but without an adequate preflight check.

True undo is unavailable for actions such as sent messages or hard deletes. For those cases, **sandbox before production** is the proposed substitute, but the talk provides no measured error reduction and natural-language policies still need validation.
Connected Context · Feed7 Judgment

This generalizes lessons from coding repositories into six infrastructure requirements for agents acting across fragmented business systems. It strengthens the candidates’ shared conclusion that safety must live outside prompts, while adding a concrete boundary: irreversible actions need sandboxed rehearsal and preflight review because logging or nominal undo cannot recover them. The cited failure motivates the controls but does not measure their effectiveness.

Your Agent Just Authorized What?! — Jay Mok & Ben Coumes, PaypalPayPal’s scoped, time-bound mandates provide a concrete authorization form for the external permissions and consequence-sensitive governance this talk requires.AI Agents Are Just Distributed Systems Now — Salman Munaf, TikTokThe distributed-systems framing extends this talk’s action logging and reversibility requirements with idempotency, outcome reconciliation, bounded retries, and compensation at tool boundaries.Teaching agents to pay — Anna Spysz, StripeStripe independently reinforces that limits, cancellation, disclosure, and audit controls must be enforced outside the agent, especially where actions have financial or irreversible effects.Tribal Dungeons of Global Shipping: AI Agents at Global Scale — Dmitry Buykin, MaerskMaersk supplies production evidence for the same pattern of bounded tools, replayable traces, executable procedures, and human correction, while showing the continuing operational burden.
Context Map
agentcodingsecurity#harness-engineering#tool-use#agent-reliability
Uncertainty
True undo is unavailable for actions such as sent messages or hard deletes. For those cases, **sandbox before production** is the proposed substitute, but the talk provides no measured error reduction and natural-language policies still need validation.