All articles
Field notes from production and leading engineers
Everything I write on resilient systems, safe AI delivery and engineering leadership, newest first. Or pick an area.
- A model call is a distributed systems problemTo your application, an AI model is a slow, metered, rate-limited remote dependency. How to design for it: ambiguous timeouts, backpressure, token capacity, versioned contracts and planned failure.10 min read
- If you know the steps, you don't need an agentAI agents are being added to processes that were never uncertain. A simple rule for where they belong: automate the predictable, use AI for the uncertain, keep people for the accountable. And the failure mode to design for when an agent says 'Fixed.'5 min read
- One person owns the outcome. The team owns the solution.James Stanier argues every project needs one named owner. I agree, with one adjustment for enterprise teams: individual accountability without individualising the work. What named ownership will and won't fix, and how I'm going to test it.4 min read
- Human-in-the-loop is not a security boundaryTwo AI agents deleted production databases. Neither was stopped by its instructions. Approval improves an agent's decisions; it doesn't limit what the agent can do. Why agent safety is a permissions and architecture problem first, how to size the risk of an action, and what humans are actually for.8 min read
- Tech debt snowballs, then it avalanchesTechnical debt rarely fails slowly. It grows quietly for months, then one day nothing can move until it's fixed. How to spot the snowball, why you don't get to choose the avalanche day, and what a lead can do before it arrives.5 min read
- Deep Work, read as a lead engineerCal Newport's Deep Work argues that focus is getting rarer just as it becomes more valuable. Three ideas I'm taking from it, and the tension it doesn't resolve for anyone who leads a team.3 min read
- Don't build business logic on an expiry notificationA background process that was going to be triggered by a cache telling us a key had expired. Why that's fragile, the queue-and-scheduler design we chose instead, and why we deliberately stopped short of a full event-driven rebuild.4 min read
- Last write wins, and the customer losesA multi-tab bug that looked like a one-off defect turned out to be a design assumption the product had outgrown. Why I argued for fixing the model, not just the bug, and how to raise that kind of risk.3 min read
- Release risk usually isn't in the codeMost release risk I've dealt with wasn't a software defect. It was environment differences, unclear ownership of manual steps, late changes and rollback plans nobody had tried. What I learned preparing a high-risk platform migration.3 min read
- Being right is not the jobCong Wang's essay on why he stopped arguing, a 2,500-year-old line from Lao Tzu, and what changes when you're the one who has to make technical decisions stick.2 min read
- Moving my blog off WordPress with an AI agent: what I delegated, and what I didn'tI migrated this site from WordPress to a static site in one afternoon, working with an AI agent. The speed was impressive. The more useful lessons were about where the agent stopped and I had to decide.4 min read
Looking for older Sitecore and .NET how-tos? Browse the 2021–23 archive →