FIELD NOTES

The questions to settle before AI runs where the work is.

Dated notes on what industrial teams face as AI agents and local models move onto the plant floor and into machines: how much autonomy to allow, who approves a change, what a vendor's claim leaves out, and what the evidence says. Each note opens on outside sources and ends with questions to ask or a check to run. Thing Company uses agents in its own research and outreach, and writes about the problems that come with them.

Where the notes meet the method

The agent notes record the decisions behind how we score agentic AI: autonomy tolerance, governance readiness, budget ownership and liability. The papers draw them together.

How we score agentic AI

Agents

How much an agent may do, who approves it, what the record proves afterward, and what it costs.

Test AI-written code by what a silent failure would cost: Veracode found a security flaw in 45% of its AI code tasks, and checks that read a status code miss broken paths. Set test depth by what a silent failure would cost.
AI agent unsubscribe: a suppression list is only as fresh as the send: US, Canadian and EU rules put the opt-out duty on the sender, whatever pressed send. Where an agent's consent data goes stale, and a probe that tests the check.
AI agent cost tracking: a spend cap cannot say which agent earned its bill: A cap stops a runaway bill and returns one number. Finance asks which agent, workflow or customer the money bought. Where caps, dashboards and tags fall short.
An AI agent log can prove nothing changed and still not say who acted: A record can be unaltered and still silent about which agent wrote it and under whose authority. What the EU AI Act asks of logs, and the questions that separate the two.
AI agent autonomy levels: no standard scale exists, so ask for the vendor's: One supervised-or-autonomous setting treats a comment fix and a payments change alike. Researchers and governments have proposed scales, and we found no standards body that has published one.
Where to put the human in an AI agent's work: approve the write, not the draft: Three places to put an approval gate, why a gate that always gets a yes protects nothing, and what an approver needs to see before one tap commits a change.
Human in the loop for AI outbound agents: review the send, and every route to it: Drafting is cheap to redo and a sent message is spent. Where an outbound AI agent needs a person, why queue review fails at volume, and what to ask a vendor.

Agent orchestration patterns

How several agents divide work: supervisors, hand-offs, shared state, and where each pattern breaks.

Agent hand-offs: who is accountable, and what authority travels with the task: When one agent hands work to a sub-agent, the child should hold less authority than the parent, and the parent should see a summary. Where hand-offs leak authority and how to check.
Agent loops need a wall clock: a step cap counts steps, not time or money: A step cap is the default stop for a runaway agent loop. What it misses, and why a wall-clock limit, repeated-action detection and a cost ceiling each catch a different failure.

Workflows

Sequences of steps that agents and people run on a schedule or an event, and how they survive a restart.

Retries without a ceiling: how an AI workflow turns a fault into an outage: Retry layers multiply load on a service that is already struggling. What a ceiling, jitter and a dead-letter queue each do, and what to ask a vendor.
Restarting an AI workflow without repeating a step: what it must remember: A restart can issue a work order twice or start a shutdown again. What durable engines record, why a record alone is not enough, and what to ask a vendor.

Integrations

Connecting agents to tools, systems and equipment: protocols, credentials, and what they can reach.

An agent's tool list is an attack surface: refuse at call time: OWASP, the MCP specification and two 2025 advisories on MCP reference servers all say the same thing about tools: the list is a menu, and the control has to run when the call arrives.
A webhook you cannot verify is a command channel: Stripe, Slack, GitHub and OWASP agree on four checks for an inbound webhook, and a January 2026 advisory shows what a missing one costs. Why an agent behind the endpoint raises the stakes.

Local models

Running models, language and not, on machines you own: what fits, what it costs, which license applies, which requests may leave.

How much memory an edge AI box needs: the KV cache arithmetic: Worked from a published model configuration: 128 KiB of KV cache per token, 16 GiB at full context, plus the weights at each quantization, and the questions to ask a vendor who says a model fits.
Local model vs API cost: the one division, five inputs and published prices: A break-even between a local model and a paid API is one division. Only the API side has published numbers, as of 6 October 2026, so here is the sum, the prices and what to measure.
Which AI requests may leave the building: sort by data class first: Classify the request, decide where each class may be processed, then make something other than a policy document stop the rest. Evidence from 2025 and 2026 telemetry, and a fill-in sheet.
llama.cpp or vLLM for AI agents on local hardware: concurrency decides: One person running an agent that fans out to sub-agents sends several requests at one model at once. What the llama.cpp and vLLM documentation say about that, and what to ask a vendor.
Is Llama open source? The license clauses an OEM should read: The OSI says Meta's Llama licenses are not open source. For a company shipping a product, the clauses that travel with the weights matter more, and they differ model by model.
Will this model fit my edge box? Why a parameter count cannot say: Vendors state capacity as parameters or gigabytes. A fit check needs three numbers from the model's own metadata, and a guess from parameter count can miss by a factor of four.
Swapping the model under an agent: how tool-call formats differ: Vendors retire models on schedules you do not set, and the replacement may speak a different tool-call dialect. What the primary docs say differs, and a contract test to run before any swap.
Getting valid JSON from a small local model: grammars and schemas: Berkeley's function-calling work shows output format alone moves small-model accuracy. llama.cpp and Ollama can constrain output to a schema, which fixes syntax and nothing else.
What "tokens per second" means: a vendor's speed claim, decoded: A tokens-per-second figure can mean prompt processing, generation or total time divided by length. How to read the claim, why a non-streamed reply hides the rate, and what to ask for.
The cost of running AI on your own hardware starts with updates you must reach: Standards and a 2024 outage show why an update to machines you own is an outage risk, and which cost lines a local AI budget usually leaves blank, with a worksheet to fill in.
Open or closed weights: settle the data policy before the model: Weights decide which places a model can run. The data decides which of those places are allowed. Evidence on shadow AI, licences and the quality gap, and five questions to answer first.