Facio Blog
Payload-powered product notes, security writing, HITL patterns, and operational guidance from the Facio runtime: long sessions, Placet approvals, audit trails, memory, providers, channels, tools, and Docker-first operations.
Showing 176-180 of 235 articles.
Security
Static roles can't govern agents that shift from read-only research to production deployment in ten minutes. The confused deputy problem is the default architecture for most agent deployments. Here's why RBAC+ABAC with tool-scoped permissions is the minimum viable authorization model for 2026.
Human-in-the-loop
The biggest architectural decision in HITL isn't which framework to use — it's whether your approval gates should block execution or let the workflow continue. Synchronous HITL halts everything. Asynchronous HITL keeps moving. Both are right. Neither is right everywhere. Here's how to decide.
Engineering
Microsoft's official Playwright MCP server — 24 tools, 90K GitHub stars, 220M npm downloads/month. Uses structured accessibility snapshots instead of screenshots for deterministic, vision-model-free browser automation from any AI agent.
Product
Cron is perfect for "run this at 9 AM every Monday." It's the wrong tool for "check if there's something to do every 5 minutes." Facio's Heartbeat system fills that gap — a configurable polling interval that reads HEARTBEAT.md and executes pending tasks, with file-based task management that agents can modify at runtime.
Security
88% of enterprises had AI agent incidents — but only 21% have runtime visibility and 33% have no audit trail at all. Operational logs are not audit logs. WORM storage, cryptographic chaining, and the five mandatory elements every compliance-grade agent audit trail needs before the EU AI Act deadline.