<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>DEV Community: Kobester</title>
    <description>The latest articles on DEV Community by Kobester (@kobester_nz).</description>
    <link>https://dev.to/kobester_nz</link>
    <image>
      <url>https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4090338%2F92e6f792-5842-4967-a54c-7b58b1d5df89.png</url>
      <title>DEV Community: Kobester</title>
      <link>https://dev.to/kobester_nz</link>
    </image>
    <atom:link rel="self" type="application/rss+xml" href="https://dev.to/feed/kobester_nz"/>
    <language>en</language>
    <item>
      <title>L102 Claude: Multi-Agent</title>
      <dc:creator>Kobester</dc:creator>
      <pubDate>Sun, 23 Aug 2026 05:39:00 +0000</pubDate>
      <link>https://dev.to/kobester_nz/l102-claude-multi-agent-38m7</link>
      <guid>https://dev.to/kobester_nz/l102-claude-multi-agent-38m7</guid>
      <description>&lt;p&gt;L102 Claude: Multi-Agent&lt;/p&gt;

&lt;ol&gt;
&lt;li&gt;Why Multi-Agent?&lt;/li&gt;
&lt;li&gt;Hub-and-Spoke Architecture&lt;/li&gt;
&lt;li&gt;Isolated Context&lt;/li&gt;
&lt;li&gt;Coordinator's 5 Responsibilities&lt;/li&gt;
&lt;li&gt;Execution Patterns&lt;/li&gt;
&lt;li&gt;Dynamic Routing &amp;amp; Work Partitioning&lt;/li&gt;
&lt;li&gt;Iterative Refinement &amp;amp; Structured Handoffs&lt;/li&gt;
&lt;li&gt;Goal-oriented prompt design&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;&lt;strong&gt;1. Why Multi-Agent?&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;The three "pro" reasons are actually three different problems:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;p&gt;&lt;strong&gt;Fixed context window&lt;/strong&gt; is a capacity problem. Partitioning is about fitting the work, not making it smarter. This ties straight back to the max_tokens / context concerns from earlier images.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;&lt;strong&gt;Specialization&lt;/strong&gt; is a quality problem. A focused system prompt outperforms one bloated prompt trying to be researcher, writer, and coder at once. This is the same "tighter scope = better output" principle behind good subagent design.&lt;/p&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;&lt;strong&gt;Parallelism&lt;/strong&gt; is a latency/throughput problem. It only helps when subtasks are genuinely independent — dependent tasks gain nothing and add coordination overhead.&lt;/p&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;strong&gt;2. Hub-and-Spoke Architecture&lt;/strong&gt; &lt;br&gt;
Coordinator is the only node with authority — communication, error handling, and context all route through the hub, while subagents stay isolated and just execute&lt;/p&gt;

&lt;p&gt;&lt;a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fp2br39p4zwkclwj0ejxx.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fp2br39p4zwkclwj0ejxx.png" alt=" " width="755" height="433"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;3. Isolated Context&lt;/strong&gt; &lt;br&gt;
Subagent start fresh, coordinator must explicitly pass all needed context &lt;/p&gt;

&lt;p&gt;&lt;a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fgn7xh7m3mpmw7s4jfx3r.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fgn7xh7m3mpmw7s4jfx3r.png" alt=" " width="753" height="698"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;4. Coordinator's 5 Responsibilities&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;Flow: &lt;br&gt;
Decompose -&amp;gt; Delegate -&amp;gt; Aggregate -&amp;gt; Evaluate -&amp;gt; Respond&lt;/p&gt;

&lt;p&gt;&lt;a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fqyr3fxyttvtwoc6rv4lt.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fqyr3fxyttvtwoc6rv4lt.png" alt=" " width="739" height="505"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Task Tool - 4 step delegation&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;&lt;a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fpyuxjbn9n5ppqp6udntf.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fpyuxjbn9n5ppqp6udntf.png" alt=" " width="751" height="511"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;A &lt;strong&gt;Task&lt;/strong&gt; is a special tool call. When a coordinator wants a subagent to do something, it emits a tool_use block with type: "task". The key insight: a Task is just a tool whose implementation is another Claude agent rather than a function like a calculator or a database query.&lt;/p&gt;

&lt;p&gt;&lt;a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F5fwjxw9vhg19uh2akw6m.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F5fwjxw9vhg19uh2akw6m.png" alt=" " width="738" height="346"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;6. Execution Patterns&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;Parallel vs Sequential vs Fork Sessions&lt;br&gt;
P: Multiple task calls in one response&lt;br&gt;
S: One task call per loop turn (wait for result)&lt;br&gt;
FS: Same baseline, different paths, spawn multiple subagents from the same baseline context; each explores different directions. (essentially parallel execution with shared origin and deliberate divergence)&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;5. Dynamic Routing &amp;amp; Work Partitioning&lt;/strong&gt;&lt;br&gt;
Both attack the same enemy from different angles: redundant work. Routing prevents invoking agents you don't need; partitioning prevents the agents you do invoke from duplicating each other. &lt;/p&gt;

&lt;p&gt;&lt;a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fw5d8l2qstfuri4z50j6s.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fw5d8l2qstfuri4z50j6s.png" alt=" " width="753" height="898"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;7. Iterative Refinement &amp;amp; Structured Handoffs&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;&lt;a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fnawbu8g2uzbuz26drqui.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fnawbu8g2uzbuz26drqui.png" alt=" " width="742" height="804"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;8. Goal-oriented prompt design&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;*&lt;em&gt;DO: *&lt;/em&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;strong&gt;Should do Goal + output format&lt;/strong&gt;: what is expected from sub agent to produce in what format&lt;/li&gt;
&lt;li&gt;
&lt;strong&gt;Constraints:&lt;/strong&gt; what subagent MUST NOT do or access&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;strong&gt;Don't:&lt;/strong&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Exact tool call sequence&lt;/li&gt;
&lt;li&gt;Over-constraining execution&lt;/li&gt;
&lt;/ul&gt;

</description>
    </item>
    <item>
      <title>L101 Claude: Agentic Loops</title>
      <dc:creator>Kobester</dc:creator>
      <pubDate>Sun, 23 Aug 2026 04:05:24 +0000</pubDate>
      <link>https://dev.to/kobester_nz/l100-claude-agentic-loops-166b</link>
      <guid>https://dev.to/kobester_nz/l100-claude-agentic-loops-166b</guid>
      <description>&lt;p&gt;&lt;strong&gt;L100 Claude Agentic Loops:&lt;/strong&gt;&lt;/p&gt;

&lt;ol&gt;
&lt;li&gt;Communication Stack 4 layers from your code to Claude's servers — what each one does&lt;/li&gt;
&lt;li&gt;messages.create() 5 parameters of the core API call — required vs optional&lt;/li&gt;
&lt;li&gt;Tools = Descriptions The most tested distinction — what Claude sees vs what runs&lt;/li&gt;
&lt;li&gt;The 4-Step Agentic Loop&lt;/li&gt;
&lt;li&gt;Model-Driven Agency: Claude decides what to call — vs scripted automation where you do&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;&lt;strong&gt;1. Communication Stack 4 layers from your code to Claude's servers&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;The 4 layers flow: &lt;br&gt;
Code -&amp;gt; Anthropic SDK -&amp;gt; Claude API -&amp;gt; Claude Servers&lt;/p&gt;

&lt;p&gt;*&lt;em&gt;2. messages.create() with 5 params *&lt;/em&gt;&lt;br&gt;
One function to call in every agentic loop&lt;/p&gt;

&lt;p&gt;Required:&lt;/p&gt;

&lt;ol&gt;
&lt;li&gt;model : Specify which Claude Model to use&lt;/li&gt;
&lt;li&gt;max_tokens : Hard cap on response length&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;Optional:&lt;/p&gt;

&lt;ol&gt;
&lt;li&gt;system: Persistent instructions that shape every response&lt;/li&gt;
&lt;li&gt;tools: Declare what actions Claude is allowed to request&lt;/li&gt;
&lt;li&gt;messages: Full conversation history&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;&lt;strong&gt;3. Tools, descriptions, not code&lt;/strong&gt; &lt;/p&gt;

&lt;p&gt;Tools vs code: &lt;br&gt;
Tools: Description puls a separate function (dont put execution logic inside the tool definition) &lt;br&gt;
Code: actual function, eg API call, DB query&lt;/p&gt;

&lt;p&gt;*&lt;em&gt;4. The response Object &amp;amp; Agentic Loop: *&lt;/em&gt;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Two Critical fields:&lt;/strong&gt;&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;STOP_REASON : Why Claude Stopped (end_turn: exit loop, tool_use: Claude needs code to act, max_tokens: Response cut off)&lt;/li&gt;
&lt;li&gt;CONTENT[] : Array of blocks&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;strong&gt;Tool use block fields:&lt;/strong&gt;&lt;br&gt;
id: unique ID. Must match when sending result back. &lt;br&gt;
name: which tool claude to call&lt;br&gt;
input: arguments Claude chose based on context&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Agentic Loop:&lt;/strong&gt; &lt;br&gt;
&lt;strong&gt;Send&lt;/strong&gt; (call messages.create(), including tool definitions, converesation history → &lt;strong&gt;check stop reason&lt;/strong&gt; end_turn, tool_use (step 3) → &lt;strong&gt;execute tools&lt;/strong&gt; find every tool_use block in content array → &lt;strong&gt;append &amp;amp; repeat&lt;/strong&gt;, add Claude response as assistant message, tool results as user message, back to step 1&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;5. Model-Driven Agency&lt;/strong&gt; &lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Scripted Automation vs Model-Driven Agency&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;&lt;a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fbj85vh8ozn17jrjdc34o.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fbj85vh8ozn17jrjdc34o.png" alt=" " width="514" height="333"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;Calling Claude in a rigid, predetermined sequence is automation. True agency is when Claude reads context, chooses tools dynamically, and controls when the loop ends — while your code just executes what it decides. Claude reads tool descriptions and conversation context to decide which API to call.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;5.1 Deep dive on stop_reason :&lt;/strong&gt;&lt;br&gt;
stop_reason field — the signal that tells your agentic loop what to do after each API response&lt;/p&gt;

&lt;p&gt;&lt;a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F9jseqcwk7tg5udgvbpja.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F9jseqcwk7tg5udgvbpja.png" alt=" " width="521" height="233"&gt;&lt;/a&gt;&lt;/p&gt;

</description>
    </item>
    <item>
      <title>Level 100: Claude foundations</title>
      <dc:creator>Kobester</dc:creator>
      <pubDate>Sun, 23 Aug 2026 02:37:52 +0000</pubDate>
      <link>https://dev.to/kobester_nz/level-100-claude-foundations-16ln</link>
      <guid>https://dev.to/kobester_nz/level-100-claude-foundations-16ln</guid>
      <description>&lt;p&gt;&lt;strong&gt;There are four basic components:&lt;/strong&gt;&lt;/p&gt;

&lt;ol&gt;
&lt;li&gt;Claude Code&lt;/li&gt;
&lt;li&gt;Agent SDK&lt;/li&gt;
&lt;li&gt;Claude API&lt;/li&gt;
&lt;li&gt;MCP&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;&lt;strong&gt;Claude Code&lt;/strong&gt;&lt;br&gt;
Claude Code is Anthropic's agentic command-line tool for code generation, refactoring, and debugging. It runs where your code lives, and you configure its behavior through a CLAUDE.md file, custom skills, and MCP integrations.&lt;/p&gt;

&lt;p&gt;The distinction that matters: this isn't a chat window you paste code into. It's an agent that reads your files, makes edits, runs commands, and checks its own work inside your project.&lt;/p&gt;

&lt;p&gt;Where it shines:&lt;/p&gt;

&lt;p&gt;Pair programming on a real codebase&lt;br&gt;
CI/CD automation (think fixups, migrations, dependency bumps)&lt;br&gt;
Code review bots that comment on diffs&lt;br&gt;
Monorepo tooling where context spans many packages&lt;br&gt;
If your task is "operate on this repository," Claude Code is the surface built for it.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Agent SDK&lt;/strong&gt;&lt;br&gt;
The Agent SDK is a framework for building multi-agent applications. It hands you the primitives you'd otherwise write yourself: agentic loops, subagent orchestration, tool calling, and full lifecycle hooks.&lt;/p&gt;

&lt;p&gt;The value here is that the hard parts of agent plumbing are already solved. You describe the agents and tools; the SDK runs the loop, routes between subagents, and gives you hooks to observe or intercept each step.&lt;/p&gt;

&lt;p&gt;Where it shines:&lt;/p&gt;

&lt;p&gt;Customer support agents that route, look up, and resolve&lt;br&gt;
Research pipelines that fan out across sources and synthesize&lt;br&gt;
Autonomous workflows that chain multiple decisions&lt;br&gt;
If you're writing your own while loop around a model call and manually dispatching tools, the SDK is probably what you actually wanted.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Claude API&lt;/strong&gt;&lt;br&gt;
The Claude API is the HTTP layer for programmatic access to the model. This is messages.create(), tool_use, structured JSON output, batch processing, and streaming. No agent framework, no CLI, just the model and your code.&lt;/p&gt;

&lt;p&gt;This is the lowest-level, highest-control surface. You own the loop, the state, and the orchestration. In exchange, you get maximum flexibility and the ability to run at scale.&lt;/p&gt;

&lt;p&gt;Where it shines:&lt;/p&gt;

&lt;p&gt;Data extraction from unstructured text&lt;br&gt;
Content generation pipelines&lt;br&gt;
Classification at scale (batch processing is your friend here)&lt;br&gt;
If you want a single well-defined transformation, run many times, with predictable structured output, the API is the direct path.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;MCP: Model Context Protocol&lt;/strong&gt;&lt;br&gt;
MCP is a standard, not a client. It defines how Claude connects to your databases, APIs, and services through tool and resource interfaces. You write (or install) an MCP server that exposes capabilities, and any MCP-aware client, including Claude Code and the Agent SDK, can use them.&lt;/p&gt;

&lt;p&gt;The point of MCP is that you build the connector once and reuse it everywhere. Instead of wiring a database into three different apps, you write one MCP server and every surface can talk to it.&lt;/p&gt;

</description>
      <category>agents</category>
      <category>ai</category>
      <category>claude</category>
      <category>mcp</category>
    </item>
    <item>
      <title>Note: Common Claude Architecture Challenges and Solutions</title>
      <dc:creator>Kobester</dc:creator>
      <pubDate>Sun, 23 Aug 2026 02:26:13 +0000</pubDate>
      <link>https://dev.to/kobester_nz/claude-architecture-common-challenges-and-solutions-1293</link>
      <guid>https://dev.to/kobester_nz/claude-architecture-common-challenges-and-solutions-1293</guid>
      <description>&lt;p&gt;&lt;strong&gt;Claude Architecture Common Challenges and solutions:&lt;/strong&gt;&lt;/p&gt;

&lt;ol&gt;
&lt;li&gt;Lossy Summarization vs. Immutable State Ledgers&lt;/li&gt;
&lt;li&gt;Prompt Instructions vs. Code-Level Enforcement&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;&lt;em&gt;&lt;strong&gt;Lossy Summarization vs. Immutable State Ledgers&lt;/strong&gt;&lt;/em&gt;&lt;br&gt;
The Scenario&lt;br&gt;
As long-running agentic sessions accumulate chat history, developers often introduce context-window optimization techniques—such as rolling sliding windows or recursive LLM-based summarization—to compress old turns into concise paragraphs.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Why It Fails&lt;/strong&gt;&lt;br&gt;
Summarization is inherently lossy compression. When an LLM summarizes a conversation, it abstracts away specific details to save space. Precise, exact-match entities—such as transaction UUIDs, cryptocurrency hashes, invoice numbers, or strict timestamps—frequently get generalized or dropped entirely. If a user later references an order number mentioned 20 turns ago, a summarized memory store will return a miss or a hallucination.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;The Architectural Solution&lt;/strong&gt;&lt;br&gt;
Implement a tiered memory architecture. While conversational history can be summarized for flow, critical transactional data must be preserved in a dedicated, immutable sidecar structure (often called a Case Facts store or State Ledger). Append-only logs ensure exact keys are preserved verbatim, entirely decoupled from the summarization engine.&lt;/p&gt;

&lt;p&gt;&lt;em&gt;&lt;strong&gt;Prompt Instructions vs. Code-Level Enforcement&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;

&lt;p&gt;The Scenario&lt;br&gt;
An agent has access to a tool called execute_financial_transfer or modify_database_record. To prevent dangerous actions, a developer adds strict rules to the system prompt: "You must never execute a transfer exceeding $500 without explicit manager approval."&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Why It Fails&lt;/strong&gt;&lt;br&gt;
Prompt-based guardrails are probabilistic suggestions, not hard security boundaries. Through indirect prompt injection, clever phrasing, or model drift, an LLM can easily be persuaded to bypass system instructions. Relying on prompts to enforce hard safety or monetary limits introduces a critical security vulnerability.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;The Architectural Solution&lt;/strong&gt;&lt;br&gt;
Enforce Defense-in-Depth via Programmatic Interception. Before any tool payload is dispatched to an external API or database, it must pass through a code-level middleware or PreToolUse hook. The business logic check (e.g., if payload['amount'] &amp;gt; 500: raise ValidationError) must live in deterministic code that the model cannot override or negotiate with.&lt;/p&gt;

</description>
      <category>architecture</category>
      <category>claude</category>
      <category>llm</category>
      <category>systemdesign</category>
    </item>
  </channel>
</rss>
