# where the hours go

> Agents get read access on day one. The engineering is deciding when they get to write.

## STACK_01: Agentic AI, in production

Getting a model to answer is the easy bit. Once it can act, every tool needs a scope and something that can say no.

In production:

- Multi-agent ops assistant on Bedrock AgentCore: a supervisor routes work to three agents (runbook RAG, ITSM, Kubernetes) through an MCP gateway on read-only credentials. Every answer passes a grounding check, every run is traced in OpenTelemetry.
- Incident investigation agent: on a page it pulls CloudWatch metrics and logs, X-Ray traces and recent deploys, then writes a root-cause hypothesis with evidence links into the ticket. Rollbacks wait for the on-call engineer.
- Claims intake on Bedrock Data Automation: S3 upload, EventBridge, one blueprint per document type. Low-confidence fields go to human review before anything is written downstream.

Labs (local model):

- **claims intake**: extract fields, check each against the source, send the rest to review
- **incident investigation**: hypothesis must cite log lines; the fix waits for a human
- **an agent on this site's tools**: picks the site tools one call at a time, answers from their results, OpenTelemetry trace

## STACK_02: The model layer

If retrieval is wrong, the answer is wrong, whatever the model. Most of my RAG time goes into chunking, reranking and checking answers against sources, not prompts.

Tags: RAG, Agentic RAG, Embeddings, Vector DBs, Bedrock, RAG eval, structured output

Labs (local model):

- **ask this page**: BM25, rerank, cited answer or refusal
- **text-to-sql**: one SELECT, allowlisted, read-only
- **x-ray a reply**: token probabilities and alternatives, branch from any token

## STACK_03: Cloud & infra

Terraform and YAML in a repo, rebuildable without me. Agents start read-only and stay that way until someone signs off.

Tags: AWS, Terraform, Kubernetes, CI/CD, SRE, Linux, OTEL

Labs (local model):

- **explain a line**: explain a deploy log line

## STACK_04: Breaking it first

I'd rather break it on purpose on a Tuesday afternoon than find out at 3am.

Tags: SLOs, Error budgets, AWS FIS, Chaos Mesh, LitmusChaos, Multi-region DR, Route 53 failover

Labs (local model):

- **draft the postmortem**: timeline from the log in code, wording from the model

## STACK_05: Red team, on my own stuff

I try to break what I build, with permission and a ticket number. Quickest way to find where the trust boundary leaks.

Tags: Recon, Web Exploitation, Privilege Escalation, Threat Modeling, Prompt-injection defense, Responsible Disclosure

Labs (local model):

- **prompt-injection test**: four client-side layers, the model as an optional fifth

## ~/poc

- **veil**, pii gateway (now): llama.cpp on the box swaps names, addresses and keys for tokens before a prompt reaches a cloud model. if it can't mask, nothing is sent
- **sift**, ci triage (now): regex cuts a CI log to the lines around the failure, the model sorts it and names the likely commit. drafts an issue, never merges
- **anchor**, drift to pr (now): terraform plan finds console drift, CloudTrail says who and when, the agent opens a PR to codify or revert it. never runs apply
- **dotnet8-port** (done): .NET Framework to .NET 8 with AWS Transform. the agent did the bulk rewrite, tests and a human review decided what merged
- **ops-text-to-sql** (done): questions to SQL: schema retrieved first, read-only replica, row limit, query shown next to the result
- **itsm-triage** (done): ServiceNow incidents matched to SOPs, fixes through Flow Designer and a MID Server, nothing runs until an engineer approves
- **zero-egress-rag** (done): llama.cpp and a local vector index on one box, for data that cannot leave the network
- **quill**, fine-tune (lab): QLoRA on Qwen2.5-1.5B with Unsloth for ticket categories and tool-call JSON. scored against the base model, served as GGUF on llama.cpp
- **pry**, jailbreak lab (lab): garak probes and PyRIT multi-turn attacks on my own models and guardrails. anything that gets through becomes a test case
- **tripwire**, guardrail bench (lab): Llama Guard and Bedrock Guardrails scored on public jailbreak and benign sets: misses and false refusals
- **flagrun**, injection ctf (lab): public prompt-injection challenges, and bounty work only inside a published scope

## rules (.sad7qrc)

- If it can't be rebuilt from a file, it doesn't exist. (error)
- The model is the easy part. (warn)
- Anything irreversible waits for a human. (error)
- Write the fix as carefully as the exploit. (error)
- Pick the boring tool you can see inside. (error)
- If I'm the only one who understands it, it's broken. (error)