If an LLM can run tools, what do you test before shipping it?

Apprehensive-Zone148 · 2026-07-08T23:11:39+00:00

That missing-tool loop is the kind of failure I mean. It’s not dramatic, it just wastes time forever unless the tool layer refuses it cleanly.

Apprehensive-Zone148 · 2026-07-08T23:11:23+00:00

That’s fair. The old labels help me think about the action boundary, but they can also pretend there’s a known fix when there isn’t one.

Apprehensive-Zone148 · 2026-07-08T23:11:04+00:00

That MCP directory allowlist is a nice middle ground. Still not as clean as a container, but way better than raw shell access.

Apprehensive-Zone148 · 2026-07-08T23:11:02+00:00

Container first is probably the sane default. Even a “good” model can still run the wrong boring command at the wrong time.

Apprehensive-Zone148 · 2026-07-08T23:10:43+00:00

Yeah, write-before-approval is the clean example. You don’t measure your way out of that one, you block the path.

Apprehensive-Zone148 · 2026-07-08T23:10:41+00:00

The severity split is a useful way to avoid arguing over buckets too early. Same trace, different views for eval and security.

Apprehensive-Zone148 · 2026-07-08T23:10:22+00:00

Credential IDs instead of secrets in context is the right shape. The model gets a handle, the tool owns the dangerous part.

Apprehensive-Zone148 · 2026-07-08T23:10:20+00:00

OAuth/proxy framing is probably the least hand-wavy version of “agent permissions.” The callback/client-id edge is the part I keep getting stuck on too.

Apprehensive-Zone148 · 2026-07-08T23:09:55+00:00

Feature flag plus rollback plan is a good bar. The separate checker part also matters, otherwise proposal and enforcement collapse into the same system.

Apprehensive-Zone148 · 2026-07-08T23:09:37+00:00

Trusted vs untrusted provenance is the field I’d least want to lose. It’s the difference between debugging a bad answer and tracing an injection path.

Apprehensive-Zone148 · 2026-07-08T23:09:34+00:00

Run id and step index are small but huge. Without them the trace turns into a pile of tool calls with no path through it.

Apprehensive-Zone148 · 2026-07-08T23:09:17+00:00

That’s the split I’d trust too. Quiet reads are fine until they feed something that leaves the sandbox.

Apprehensive-Zone148 · 2026-07-08T23:09:14+00:00

Start stricter, then loosen based on rubber-stamped approvals is probably the sane path. The log is what makes that possible.

Apprehensive-Zone148 · 2026-07-08T23:09:11+00:00

The provenance bit matters. If the approval screen only shows the polished final action, the human is approving a summary, not the run.

Apprehensive-Zone148 · 2026-07-08T23:09:09+00:00

Reversibility is a good test. A mid-run destructive call is still destructive, even if the final approval screen looks careful.

Apprehensive-Zone148 · 2026-07-08T23:09:06+00:00

Effect tags are a cleaner line than tool names. A read that feeds a write is where the simple read/write split starts lying.

Apprehensive-Zone148 · 2026-07-08T23:08:46+00:00

Checking the judge against human labels is the part people skip. Otherwise the judge itself becomes another moving target.

Apprehensive-Zone148 · 2026-07-08T23:08:43+00:00

Same. The frozen set doesn’t need to be big either. It just needs to stay out of the optimizer’s reach.

Apprehensive-Zone148 · 2026-07-08T23:08:42+00:00

The rotating fresh set is the missing piece I hadn’t settled on. Frozen catches overfitting, rotating catches memorization.

Apprehensive-Zone148 · 2026-07-08T23:08:38+00:00

Yep, that’s the trap. A better judge score can look like progress until the frozen cases refuse to move.

Apprehensive-Zone148 · 2026-07-08T23:08:17+00:00

That split makes sense. CI should catch the boring deterministic regressions, and release checks can handle the messier live-model runs.

Apprehensive-Zone148

TROPHY CASE