Resources
What we are building, and what we have learned building it.
A client-side tool runs in your application's process, which is exactly the right place for it — until there is no application process. Then the same agent, with the same permissions, on the same account, simply cannot do the thing.
Almost everyone gets retrieval scoping right. The agent cannot read the wrong customer's documents. Then it calls a tool, and the tool goes and fetches them, because the tool runs as your service account and nobody re-checked.
Spinning up a Linux box and letting a model run commands in it takes an afternoon. Everything after that afternoon — the file it edits without reading, the export that never reaches the user, the sandbox nobody cleaned up — is where the months go.