Facio Blog

Practical notes on human-reviewed AI agents.

Payload-powered product notes, security writing, HITL patterns, and operational guidance from the Facio runtime: long sessions, Placet approvals, audit trails, memory, providers, channels, tools, and Docker-first operations.

Showing 31-35 of 281 articles.

Security

The 80% Reachability Problem: Why AI Agents Need Microsegmentation, Not Just Identity Controls, to Stop the AILM Era

Jul 29, 2026Security

The 80% Reachability Problem: Why AI Agents Need Microsegmentation, Not Just Identity Controls, to Stop the AILM Era

The Zero Networks Lateral Movement Exposure Report: 80% of enterprise servers reachable through chained identity and network permissions. The Orca Security analysis named the new category: AI-Induced Lateral Movement (AILM) — agents as attack pivots using legitimate credentials. Identity-aware microsegmentation with per-segment cryptographic tokens, sequence analysis, and JIT grants is the only defense.

Human-in-the-loop

HITL and the Fail Forward Principle: Why Approved Actions That Fail Should Produce More Learning Than Rejected Actions That Don't

Jul 29, 2026Human-in-the-loop

HITL and the Fail Forward Principle: Why Approved Actions That Fail Should Produce More Learning Than Rejected Actions That Don't

Most HITL systems treat successful approvals as wins and rejections as failures. The metric is wrong. The rejected actions that didn't go wrong teach the system nothing. The approved actions that fail teach the system everything. Here is why HITL should measure the learning produced, not the prevention achieved — and what changes when "fail forward" becomes the system's organizing principle.

Engineering

MCP Security Threat Model 2026: Prompt Injection, Agentjacking, Tool Squatting, and the Defense-in-Depth Every Production Deploy Needs

Jul 28, 2026Engineering

MCP Security Threat Model 2026: Prompt Injection, Agentjacking, Tool Squatting, and the Defense-in-Depth Every Production Deploy Needs

The MCP security threat model in 2026 — five recurring patterns (prompt injection via tool output, agentjacking via attacker events, tool squatting via name collisions, supply-chain via malicious servers, credential leakage via misconfigured transports). Defense-in-depth stack with output sanitization, signature verification, isolation, RBAC, HITL gating, audit trail.

Product

Facio's Output Validation Discipline: How AI Agents Catch Their Own Mistakes Before They Reach the Customer

Jul 28, 2026Product

Facio's Output Validation Discipline: How AI Agents Catch Their Own Mistakes Before They Reach the Customer

AI agents produce output. The output reaches customers. The naive approach trusts the output: the agent generates text, the text is sent; the agent generates an answer, the answer is delivered. Facio's output validation discipline gives agents structured mechanisms to validate their own output before it reaches customers: schema validation for structural correctness, factual validation against source context, policy validation for compliance, consistency validation for internal coherence, and safety validation for dangerous output prevention. Mistakes are caught before they reach.

Security

The Three-Stage Defense for OWASP ASI06: How AI Agents Stop Reading Their Own Compromised Memory

Jul 28, 2026Security

The Three-Stage Defense for OWASP ASI06: How AI Agents Stop Reading Their Own Compromised Memory

OWASP Agent Memory Guard v0.2.1 ships as the first production-grade defense against ASI06 memory poisoning. The three-stage architecture — ingestion-stage prevention, reasoning-stage isolation following the CaMeL trust boundary, and verification-stage continuous auditing — catches the MINJA 98%, AgentPoison 80%, and Gemini memory exploits that traditional defenses miss.