AI Engineering
AI engineering here means the everyday work of using language models and coding agents inside a software project: what you let an agent run, what you do with what it returns, and how you know the code and tests it wrote are any good. The notes run the agents on small, harmless tasks and say what each run does and does not show.
Start with how coding agents ask for approval and how they are extended, then the places where their output or their inputs become actions, then the decisions that follow. One note is about the agent's own tests rather than security: it asks how much a green test run proves when the agent wrote both the code and the tests.
Reading order
AI coding agents: permission and safety settings
Start here, as a reference: how three coding agents ask for approval and limit where they can act, with the versions checked.
AI coding agent extensions: skills, hooks, MCP servers and plugins
Reference: where skills, hooks, MCP servers and plugins are configured, what each can make run, and what the documentation says about approving it.
Treat model output as untrusted input
Four ways that using a model's output directly turns text into an action, and the fix for each.
When the data an AI agent reads can give orders
What changes when an agent reads outside data and then acts, shown with a local simulation.
What happens when a project asks your agent to start an MCP server
A project file that lists an MCP server is a command: what started in a non-interactive run, and what a planted tool description did.
Claude Code or Codex: which permission setup fits the task?
Decide: the same four harmless steps run through Claude Code and Codex, and what each configuration did.
How to keep an AI coding agent away from a file
Decide: an instruction, a deny rule and a hook compared on a dummy secret.
Testing AI-generated code against the spec
Check: five agent-written implementations and their tests measured against an oracle from the specification and seven injected bugs.
What we have not covered yet
- Retrieval-augmented generation, prompt design and model evaluation.
- Cost, latency and model selection.
- Agents other than Claude Code and Codex, except where the reference pages say so.