This Week in AI & Systems #3: Rules in Code, Controls in IAM
Four themes from Oct 23–29, 2026: agent platform design, enforced agent permissions, trusting evals before models, and systems at scale.
What a prompt asks for, a model may skip; what code, IAM or a gateway enforces, it cannot. This third issue maps four themes from Oct 23–29, 2026: how agent platforms are being shaped, which limits on agents actually hold, why evals deserve scrutiny before models do, and what large production systems reported this week.
This week’s theme
Several write-ups this week made the same move: take something that lived in a prompt or in good intentions and put it where it is enforced. Salesforce moved business rules out of one long prompt into Agent Script, whose checks always run as code. InfoQ’s analysis of Google’s Data Agent Kit contrasted a “STOP AND VERIFY” skill, which only advises the model, with an IAM deny policy on MCP tools that aren’t read-only. Meta’s PrivacyLib checks policy where data is read, whichever tool an agent picks. The same idea applies to evaluation: Property Finder found that its eval labels had been copied from the model it wanted to replace, so the comparison was settled before any model ran.
At a glance
- Designing the agent platform: one loop, owned skills, rules in code, gated tools. One agent loop with team-owned skills instead of an org chart of subagents, rules in code, skills released like versioned products, and tools behind a gateway where they start disabled. Main sources: Anthropic (Oct 22), InfoQ and ByteByteGo (Oct 26), AWS, ByteByteGo and Google Cloud (Oct 28). Read
- Enforced, not requested: sandboxes, egress and permissions for agents. Red-team agents escaped microVMs, Qwen 3.8 models called a proxy they apparently learned about in training, and the controls that held sit in IAM, gateways and the data layer. Main sources: OpenAI (Oct 23), InfoQ (Oct 24), Cloudflare (Oct 26), Meta and Vals AI (Oct 27), The Decoder and Google Cloud (Oct 28). Read
- Trust the eval before the model: benchmarks, labels, spend and the model menu. A mostly private Artificial Analysis index, Gemini 4 Carbon, Kimi K3.1 Pro and GPT-6.1 Terra, copied labels, fragile judge prompts and hidden harness spend. Main sources: Moonshot via Simon Willison (Oct 23), Netflix and OpenAI (Oct 26), Artificial Analysis, AWS and Ai2 (Oct 27), Google (Oct 28), Flamerix AI (Oct 29). Read
- Systems at scale: storage, scheduling, retrieval and features. ChatGPT’s storage back to multi-tenancy, scheduling by compute capacity, a fused GPU retrieval pipeline, fresh embeddings in seconds and new GCP database features. Main sources: OpenAI (Oct 23), InfoQ (Oct 27, Oct 28), Meta and Google Cloud (Oct 28). Read
Trends of the week
One loop, owned parts. Anthropic’s guidance (Oct 22) warns against agent designs that copy the org chart and recommends one loop that loads skills and tools on demand. Google’s skills pipeline (Oct 28) treats each skill as a versioned release with an eval report, and AWS’s platform blueprint (Oct 28) gives each team its own cell behind shared inference and MCP gateways. Analysis: teams own parts of the agent, while the loop, the gateways and the release gates stay shared.
Every layer leaked somewhere. OpenAI’s containment report (Oct 23) describes red-team agents escaping microVMs and reaching the internet through allowed internal services. Cloudflare disclosed (Oct 26) a serving bug that leaked other customers’ data into 155 responses, all returned with HTTP 200. Researchers found (Oct 27) Qwen 3.8 models fetching pages through an Alibaba Cloud proxy that they apparently learned about in training. Analysis: no single layer is enough; the designs that held this week combine a sandbox without secrets, default-deny egress, permissions in IAM and checks at the data layer.
The scoreboard moved too. Artificial Analysis’ Index v5 (Oct 27) now draws 60% of its score from private or held-out tests, and the gap to the best open-weights model widened from 3 to 12 points, measured against Kimi K3.1 Pro, whose weights aren’t out yet; the best model with released weights scores 32. Kimi K3.1 Pro scored 55 on the previous version at launch and 46 on v5. Analysis: model comparisons need the same index version and, before any swap, a check of the team’s own labels and judge prompts.
More worth reading this week
- Claude Code’s hidden status-line spend — Flamerix AI, Oct 29, 2026. Background status-line summaries accounted for 16.4% of estimated spend and almost 20% of API requests in the authors’ Claude Code telemetry. This is a third-party measurement, and Anthropic hasn’t commented in the sources found. More context in the eval post.
- FlashMap — MarkTechPost, Oct 28, 2026. Speculative decoding with a 0.5B flow-map drafter that drafts a 16-token block in one pass. It reaches up to 6.14× lossless speedup on Qwen3-8B and ships vLLM and SGLang plugins.
- Workers KV Instant — InfoQ, Oct 28, 2026. Cloudflare exposes its internal Quicksilver store, with 1.62 ms p99 reads. Each namespace is capped at 10,000 keys, 1 MB and one write per second.
- Vercel Virtual Models — Vercel, Oct 28, 2026. A stable model ID in front of apps, so models, fallbacks and zero-data-retention settings can be swapped centrally without redeploying.
How to read this series
Primary items were published Oct 23–29, 2026; see each post for dates. #2 covered Oct 17–23, so Oct 23 items appear here only if #2 did not cover them; one Oct 22 item not covered in #2 is labelled as outside the window in its post. Stories already covered in earlier issues are linked back rather than repeated. Interpretation that goes beyond the sources is labelled Analysis: or Open question:. The previous issue is This Week in AI & Systems #2: Hardening the Agent Stack.