Card 1 of 6Agents
Your ops agent needs to log in to a vendor portal. Plan: it signs in through a password manager that asks a person to approve each request on their phone.
You're the one who signs off. What's the call?
Play the News · Drop #040 · Evening
Ship It or Block It
How it works: 6 cards, about 2 minutes, from this Drop's news. Your streak lives only on this device. It's not legal advice.
Show the answer
Answer: Ship it.
Least privilegeThe Verge reports 1Password for Agents fills the login only after you approve the request on your own device, so the agent never sees the password.
From the Drop: 1Password for Agents signs AI agents into accounts without showing them passwords
- Card 2 of 6Agents
A legacy PHP site can't be patched this week. Proposal: leave it online as is and patch it next sprint.
You're the one who signs off. What's the call?
Show the answer
Answer: Block it.
Patch or take offlineCNBC reports the NSA urged organizations to patch PHP2Shell now or take servers offline, and 404 Media cites Cloudflare's CEO counting millions of exploit attempts.
From the Drop: PHP2Shell: Cloudflare counts millions of exploit attempts; experts split on exploits
- Card 3 of 6Agents
A public-facing support agent goes live with no spend cap. The team plans to review the model invoice once a week.
You're the one who signs off. What's the call?
Show the answer
Answer: Block it.
Hard spend capsLangChain's example: an agent stuck in a retry loop overnight makes 10,000 calls. Its gateway answers a capped agent with a 402 error instead of running up the bill.
From the Drop: LangSmith LLM Gateway puts spend caps, rate limits and fallbacks in front of agents
- Card 4 of 6Today's Talk
Your support agent rates its own confidence and auto-sends any reply it scores above 0.9. Nobody logs whether replies were right.
You're the one who signs off. What's the call?
Show the answer
Answer: Needs a human.
Calibrate before you trustThe essay argues a model's stated confidence was never calibrated against outcomes. It suggests sending uncertain replies to a person and building the score from reviewed results.
From the Drop: Essay arguing LLM confidence scores aren't measurements draws 144 points on HN
- Card 5 of 6Agents
An assistant agent prepared payroll and now wants to move money between company accounts on its own.
You're the one who signs off. What's the call?
Show the answer
Answer: Needs a human.
Human sign-off on paymentsTechCrunch says Anthropic's Claude Duet asks before payments and won't move money between accounts at all. A person should sign off on moves like this.
From the Drop: Claude Duet draws 484 points on HN; TechCrunch details its payment limits
- Card 6 of 6Agents
A shopping agent will keep 10 limited items held in a retailer's cart all day by re-adding them every time the hold expires.
You're the one who signs off. What's the call?
Show the answer
Answer: Block it.
Don't game shared resourcesThe Verge had Muse do exactly this at The RealReal, blocking other shoppers. Meta says Muse applies ethical browsing principles to requests a human couldn't do.
From the Drop: Verge test: Meta's Muse shopping agent is blocked by Amazon and spotty at Target
Games are written by AI from this Drop's sourced items. Scenarios are illustrative.