Dry-run is the default in the operational layer I built around an unattended coding agent, and I’ve been reading more into that flag than it can deliver. A dry run is faithful up to the first side effect the agent reads the result of. After that it’s a run through a world the agent made up.
Last month’s GxP post ended on an open question about agent-written changes swamping per-change assurance. Manufacturing hit that wall a hundred years ago and wrote down its answer, and the answer has an entry fee agent pipelines can’t pay yet.
The agent pitch prices a change by what it costs to produce. A validated GxP system never priced changes that way, and the regulated world already renegotiated the real price once, before agents showed up.
The pitch for autonomous coding is a multiplier on how fast you write code. But writing was never the part a human has to stand behind, and the part they do stand behind got no cheaper, and probably got worse.
When an agent generates a query, it binds to the column name, not the steward’s definition. A misleading name used to be a nuisance a new hire tripped over once. Now it’s a hazard that ships the wrong number every run.
The whole agent-reliability project is trying to engineer the one thing a tool can’t have: accountability. Data governance already named this. The agent is a custodian, and we keep trying to promote it to owner.
I built audit logs and self-voiding approval gates to make an autonomous agent safe to run unattended, then realized I’d rebuilt a regulation the FDA shipped in 1997. The regulated world solved agent trust before agents existed.
Birgitta Böckeler’s harness-engineering framework treats iteration as human work. Someone watches, notices, edits the rules. That assumption breaks the moment agents run overnight. The next move is sensors with memory.
Enterprise data strategy has moved its destination from ‘break the silos’ to ‘vectorize everything.’ The step in between is the layer that makes vectors actually work, and it’s the one most roadmaps quietly skip.
The model is not the system. The system is everything required to make model output selectable, constrainable, auditable, and stoppable. I spent a month building that system. Here’s what it actually looks like.