Everything I know about shipping agents, written down.

Most MCP servers are a REST API with a new hat. The model cannot drive them. This is what changes when you design the tool surface for a reader that has no memory, no screen and one shot at picking the right call.

Memory is the part most agent systems get wrong. Not because storing text is hard, but because everything gets written and nothing gets removed. Here is the three-tier split that keeps memory useful past month one.

One agent doing everything does none of it well. This is how work gets routed to the right place, how a repeatable playbook becomes a command, and when a subagent earns its cost.

A skill is not documentation. It is the judgement you would give a new hire on their first day, written down once so nobody has to give it again. Here is what separates one that gets used from one that gets ignored.

Every agent demo runs as a god user with an API key in an environment variable. That is fine until it touches someone else's data. This is what has to be true before it can.

Leverage without control is just a faster way to break things. Three categories always wait for a person - and the gate has to be in the system, not the prompt, or it is not a gate.

The security review is where most AI tooling dies, and it dies over questions that have boring answers. Know them in advance and the whole thing takes a fortnight instead of a quarter.

Same model, three front doors. The choice is not about quality or speed - it is about whose account is billed, whose IAM decides who may call it, and whose security team has already approved the shape of the thing.

Every rollout gets three enthusiasts in week one and stops. The problem is never the tool. It is that nobody wrote down what good looks like, so everyone else is guessing in public.

Almost every bad output traces to one of four causes, and only one of them is the model. Work the list in order and most problems resolve in minutes instead of turning into a rewrite of the prompt.