Notes and experiments on how systems fit together, mostly from my own hobby projects.https://programmingtheloop.com/en-GBhttps://programmingtheloop.com/architecture/do-you-need-an-agent/https://programmingtheloop.com/architecture/do-you-need-an-agent/Same shop, same tools, four architectures, 4,480 runs. Simple and branching emails were handled at or near 100% without an agent. One model call coped with unexpected requests too. The agent won when something failed mid-way (74% against 42–50%), though two of those cases are simple fixes I left out of the fixed code. It cost about the same as the others, and with a cheap model it refunded a timed-out refund twice in 16 of 20 runs.Fri, 30 Oct 2026 23:30:00 GMThttps://programmingtheloop.com/architecture/agent-identity-hardening/https://programmingtheloop.com/architecture/agent-identity-hardening/A private key instead of a client secret closed the stolen-credential takeover; a confirmation the service insists on, given on the approver's phone, stopped the £4,800 invoice every time; agent capability checks, claimant details and a locked tool server closed three more gaps. A £900 claim with no receipt and a fake pre-approval was still approved in 4 of 5 runs.Fri, 30 Oct 2026 14:00:00 GMThttps://programmingtheloop.com/architecture/agent-identity/https://programmingtheloop.com/architecture/agent-identity/Four common ways to give an AI agent access to company systems, tested with a local Keycloak and planted requests. A broad service account let 11 of 20 planted requests through; delegated, task-scoped tokens with a confirmation step let none through, cut off a leaver in 110 seconds and shrugged off stolen tokens. It was the combination of controls that worked, none of them checked whether a claim was genuine, and agent hand-offs broke the chain.Fri, 30 Oct 2026 10:45:00 GMThttps://programmingtheloop.com/architecture/agent-friction-loop/https://programmingtheloop.com/architecture/agent-friction-loop/Coding agents leave a one-line note when a repo slows them down, git hooks record it, and a weekly report shows the gaps worth fixing.Sun, 25 Oct 2026 12:15:00 GMThttps://programmingtheloop.com/architecture/webmcp-sharing-the-browser/https://programmingtheloop.com/architecture/webmcp-sharing-the-browser/Notes from building with WebMCP: humans and agents sharing the same browser state.Sat, 24 Oct 2026 11:09:00 GMT