Nate's core, unchanging claim across two years of writing: an agent is nothing but "LLM + tools + guidance," and every success or failure traces back to the harness wrapped around the model — loop structure, memory strategy, tool registry, action constraints, execution environment, accountability layer — not to model quality. Wells Fargo ran 245 million agent interactions cleanly while MD Anderson lost $62M on IBM Watson and McDonald's drive-thru went viral for the wrong reasons, using comparable-era models. The difference was architecture and scope discipline, not intelligence.
That harness thesis plays out through three rough eras. 2024 into mid-2025 is protocol and ecosystem-mapping: Claude ships MCP (Nov 2024) and Nate treats it as the first real standard for tool access; by March 2025 he's mapping OpenAI's closed Agents SDK against Claude+MCP against LangGraph as three distinct lock-in/control tradeoffs, and dismissing early Operator/computer-use as "pretty bad" GUI-clicking months before that's confirmed in a head-to-head test (Comet beat Operator 8-0 on real workday tasks in July 2025 — OAuth/API-native design beat vision-based screenshot navigation regardless of underlying model). Mid-to-late 2025 is architecture and context-engineering: the June 2025 "Definitive Guide" locks in a three-tier memory model (working/episodic/long-term) and a single-agent-first default (multi-agent costs 3-10x more in tokens and time, justified only by genuine parallel-expertise needs); the September 2025 MCP piece gives hard numbers for where MCP breaks (300-800ms latency, 5,000-50,000 ops/sec ceiling, 3.25x-236x token blowup on injected context, a real 34-day Asana cross-tenant breach from baked-in token passthrough) — MCP belongs in background/intelligence work, never a hot transactional path. By December 2025, after synthesizing Google/Anthropic/Manus papers, he corrects his own prior belief that bigger context windows would fix agent degradation: it's architectural (attention dilutes as tokens accumulate), so the fix is computing context fresh each call from structured state, not pinning everything into a mega-window.
2026 is the governance and commerce era, catalyzed by the OpenClaw/Moltbot saga (a viral open-source always-on agent runtime that went from "chatbot wrapper" to genuine durable runtime between February and May, while racking up a real security record — 21,639 exposed instances found on the open internet). That scare reshapes everything downstream: Anthropic's native /loop scheduling plus owned memory ("Open Brain") is explicitly pitched in March as "OpenClaw you control"; the April leak of Claude Code's source (512K lines, 1,902 files) proves the LLM call is only ~20% of a working agent, the other 80% being unglamorous plumbing — session persistence, permission tiers, idempotency, token-budget pre-checks, structured logging; May's "Judge Layer" piece (following Lindy's public postmortem) formalizes that actor and judge must be structurally separate roles, with a four-outcome verdict (Allow/Block/Revise/Escalate) gated by action risk tier. By June, agent ownership (a named human accountable per agent) and standardized handoff contracts (task record: requester, outcome, sources, acceptance criteria, boundaries, blocker rule, receipts) become the operating unit, and Nate reframes the whole two-year arc as "loops" — bounded recurring responsibilities with a trigger, memory, safe actions, and a judgment boundary — arguing this is the same tools/memory/goals/harness vocabulary from his technical writing, just brought down to weekly-task scale.
Running under all three eras: agent-as-adversary security thinking (assume the agent can be compromised or manipulated, sandbox and scope before granting real permissions); a repeated numeric argument that reliability compounds against you (95% per-step accuracy means under 10% success over a 50-step task, which is why verification loops matter more than smarter models); and a consistent "graduated autonomy" stance against full-autonomy hype — agents act freely at low risk, seek approval at moderate risk, prepare human-reviewable evidence at high risk or irreversibility, never all-or-nothing.
Key moves
Define an agent as LLM + tools + guidance; judge any agent product by its harness (loop, memory, tool registry, action constraints, execution environment, accountability layer), not by model benchmarks
Default to single-agent architecture; only justify multi-agent's 3-10x token/time cost with genuine parallel-expertise needs, and avoid "anthropomorphic" multi-agent org-charts that just chat with each other
Use a tiered memory model (working/session, episodic/cross-session, long-term/knowledge) and compute context fresh each call from structured state rather than accumulating and pinning everything into the window
Keep MCP out of hot transactional paths (checkout, fraud, payments); it belongs in background, non-real-time, multi-step work tolerant of 2-3 seconds of latency
Separate actor from judge: a proposed action (with justification/evidence) should pass through a structurally distinct validator with four possible outcomes (Allow/Block/Revise/Escalate), gated by an explicit action-risk tier (read-only / reversible / external side-effect / high-risk)
Treat the agent itself as untrusted by default — sandbox execution environments, scope tool/permission access narrowly, and design containment before granting real-world write access
Build the unglamorous plumbing first: tool registry as metadata, permission trust tiers, crash-surviving session persistence, idempotency keys on workflow state, token-budget checks before each call, structured event logging — before multi-agent coordination or plugin marketplaces
Standardize a handoff/task-record contract (requester, desired outcome, sources, acceptance criteria, boundaries, blocker-question rule, receipts) and a shared status vocabulary so work state is inspectable without reading a transcript
Name one human owner per agent; unowned agents are a governance failure independent of capability
Apply "graduated autonomy": free action at low risk/value, approval gates at moderate risk, human-reviewable evidence packages at high risk or irreversibility — reject full-autonomy framing
Run the delegation math before automating: if specifying + reviewing + fixing costs more time than doing the task yourself, don't delegate it (the "30-minute rule")
For file-system-brain agent setups, version SOUL.md/IDENTITY.md/USER.md/HEARTBEAT.md like a git repo, not write-once documents, and favor several narrow scoped specialist agents over one do-everything agent
Treat skills (SKILL.md) as agent-callable infrastructure once agents invoke them unsupervised: fully specify output format and edge cases, keep the YAML frontmatter description on one line, and don't rely on "good enough when I was watching"
Decompose agentic commerce into separable ownership layers (discovery, authorization, payment credential, settlement, merchant relationship, governance) rather than expecting one protocol or company to win all of it
2026-06-24 — The Five Questions That Turn a Messy Task Into an AI Loop — Reframes the unit of delegation as a "loop" (trigger, memory, safe actions, judgment boundary) instead of a single prompt, unifying his tools/memory/harness vocabulary at weekly-task scale.
2026-05-12 — Six layers your agent has to handle. Most products have only thought about two. — Agentic commerce splits into six ownable layers (discovery, authorization, payment credential, settlement, merchant relationship, governance); OpenAI/Stripe's in-chat checkout retreated but the underlying data protocol kept growing.
2026-04-15 — Your agent needs a SOUL.md you can't write from scratch — The real bottleneck is articulating your own tacit operating logic; ships a 45-minute elicitation interview producing SOUL.md/IDENTITY.md/USER.md/HEARTBEAT.md.
2026-03-25 — You're using the wrong kind of agent — A 4-category agent taxonomy; most disappointment comes from applying one category's mental model to a different one.
2026-03-23 — 5 AI agents, 5 contradictory bets — Five agent products making mutually incompatible bets on what "agent" should mean — a product-strategy case study, not a settled category.
2026-03-16 — Your AI coding agent deleted 2.5 years of customer data in minutes — A coding agent destructively wiped production data despite supervision; extracts the boring operational habits (backups, scoped permissions, confirm gates) that would have stopped it.
2026-02-17 — My honest breakdown of the OpenClaw hire — Analyzes the OpenClaw acqui-hire alongside 21,639 exposed instances found on the open internet as a hard security warning.
2026-02-10 — 200 lines of markdown just triggered a $285 billion sell-off — A trivial Cowork legal-review plugin crystallized fear that AI compresses knowledge-work cost faster than per-seat SaaS pricing adapts; names the "articulation problem" as the real bottleneck.
2026-02-02 — The Lobster That Broke the Internet — Origin story of Clawdbot/Moltbot/OpenClaw's viral rise, arguing public appetite for action-taking agents is outrunning operational maturity.
2026-01-21 — The Specification Gap — Codex suits definable correctness, Claude Code suits judgment calls; most disappointing output traces to a spec gap, not a model failure.
2026-01-14 — My honest field notes on the specificity principle — Cowork's file-system-first design is a deliberate bet against browser agents: files are cooperative territory, the web is adversarial.
2026-01-02 — Why capable AI is a liability when intent is off — A capable agent given ambiguous instructions doesn't fail safely, it confidently executes its best guess; prescribes making intent explicit before action.
2025-12-19 — Grab my Zero to Hero AI Agent Guide for NON-Tech — Four adjustable knobs (Habitat, Hands, Leash, Proof) for controlling any non-technical agent deployment; never give agents wallet access.
2025-12-18 — Inside OpenAI's Codex Team — Role boundaries dissolve inside OpenAI as agentic coding collapses execution cost; ambient mandatory AI review beats opt-in low-precision automation.
2025-12-09 — Get the Cheat Code on Long-Running AI Agents — Corrects his own prior belief that bigger context windows fix degradation; gives a four-layer memory architecture (working/session/memory/artifacts) instead.
2025-10-22 — Everyone Misread Andrej's Podcast — Karpathy's "a decade away" was about fully autonomous agents, not the narrow, disciplined agents already delivering value; gives a three-tier capability framework.
2025-10-06 — ChatGPT Launches the World's Easiest Agent Builder — Seven production-discipline rules to front-load before drag-and-drop agent building goes mainstream, including "use the dumbest model that works."
2025-09-24 — The Easiest Custom AI Agent Build Guide Out There — Notion AI's agent feature reduces to eight prompting disciplines (scope boundaries, receipts, quality gates, no invented facts) that make agents behave like software.
2025-09-23 — THE 2025 Agent Build Bible — AI violates six foundational assumptions of traditional software (statelessness, determinism, uniform cost); gives six matching architectural principles.
2025-07-18 — OpenAI ChatGPT Agent Mode Review — Scored zero-for-five on real business workflow tests; the action layer existed but the judgment underneath was shallow.
2025-07-16 — The Complete 141-Page Guide to AI Agents & Digital Twins — Argues most agent effort goes to execution when the higher-leverage use is simulation/digital-twin modeling, which scales exponentially instead of linearly.
2025-07-11 — I Threw My Real Workday at two AI Agents — Comet beat Operator 8-0 on real tasks; OAuth/API-native design beats vision-based screenshot navigation regardless of model strength.
2025-06-17 — The Definitive Guide to AI Agents in 2025 — Foundational architecture guide: single-agent-first default, three-tier memory model, and a buy-vs-build framework based on differentiation, not hype.
2025-03-08 — Composio MCP wants to dance with your LLM — Evaluates Composio as runtime integration middleware; pushes brittle ~40-50% success API wrappers above 90% by centralizing error handling.
2024-11-28 — Claude MCP: The Machines Have Tools Now — Earliest post in the cluster: first reaction to Anthropic shipping MCP, framing it as the moment AI got a standardized way to actually act.