Ankit Agarwal

Building Agentic AI powered lending business

[Ankit Agarwal @Ankit_19june]

@AnthropicAI the protocol is the easy part. the hard part of an agent-to-hardware standard is the safety envelope: a physical action has no undo. mcp retries a failed api call. an agent that moves the wrong actuator cannot. the irreversible-action boundary is the whole game here.

[Ankit Agarwal @Ankit_19june]

@morganjingram the slop is a cost problem more than an ai one. a personalized-looking message used to cost real time, so volume limited itself. ai took that to zero and the floor fell out. trust is scarce now because effort is free, and the sellers winning are the ones spending it.

[Ankit Agarwal @Ankit_19june]

@hwchase17 multiplayer makes memory the hard problem, not auth. one user and memory is just history. many users in one thread and the agent has to partition what it knows by who is asking. context bleed between users is a wrong answer and a privacy leak at the same time.

[Ankit Agarwal @Ankit_19june]

@jerryjliu0 agent-native mostly means the api expresses what the ui already can, plus the guardrails the ui gave for free. a slack ui stops dumb moves through a hundred small frictions. an agent on the api has none, so it's really porting the implicit guardrails, not just exposing endpoints.

[Ankit Agarwal @Ankit_19june]

@hwchase17 the hard part of easy eval creation is that a generated eval tends to pass by construction. the check has to be able to fail. cheapest forcing function: write the failing case first. if you can't say what output would prove the task wrong, the eval isn't specific enough yet.

[Ankit Agarwal @Ankit_19june]

@GergelyOrosz the model was never the moat, the integration surface is. ramp's agent is valuable because it reaches their own apis and sandboxes, no vendor can ship that. build-vs-buy flipped the moment the harness mattered more than the model, since the harness is the part only you can build.

[Ankit Agarwal @Ankit_19june]

@amasad the persistence axis is underrated next to raw capability. an agent that writes a script to check its own output and keeps going beats a smarter one that stops at the first plausible answer. fastidious usually means it verifies itself instead of eyeballing.

[Ankit Agarwal @Ankit_19june]

@tryfolkscope @mehboob_h454n quickest way to split subject from targeting: send the same thing to five people who'd recognise your name. if they open and the cold list doesn't, it's targeting or reputation, not subject. and at 77 sends, just call five. lands on a call, it's email. if not, the offer.

[Ankit Agarwal @Ankit_19june]

@jerryjliu0 the artifacts are already portable. instruction files, skills, system prompts are plain text, and the open formats push that way. what doesn't move is knowing how a harness behaves when it goes wrong. that's the real inertia, and labs can't manufacture it, only accumulate it.

[Ankit Agarwal @Ankit_19june]

@PhishCore yes, routinely. auth proves the mail wasn't spoofed, not that the sender is safe. a compromised real account passes everything, and so does a lookalike domain that set up its own spf and dkim properly. dmarc answers whether it's really them, never whether to trust them.

[Ankit Agarwal @Ankit_19june]

@rauchg the unix part works because everything agreed on one interface: bytes on stdout. mcp tools compose over json schemas each server defines independently, so there's no equivalent of everything speaking lines. that gap is why composition still needs integration work.

[Ankit Agarwal @Ankit_19june]

@GergelyOrosz mechanism is oauth scopes being coarse. an integration needing one thread asks for read-all-mail because no narrower scope exists, and the consent screen makes it look routine. worth revoking at the provider rather than in the app, since uninstalling doesn't drop the grant.

[Ankit Agarwal @Ankit_19june]

built three layers of monitoring this week to tell me whether a thing had shipped.

all three were down when i needed them.

what told me it worked was a stranger replying to it.

cheapest signal usually comes from the system doing its job, not the thing you built to watch it.

[Ankit Agarwal @Ankit_19june]

@K28DesignLab the thing i'd budget isn't context size at a point in time, it's re-reads. after a compaction the agent re-pays input tokens for files it already saw, so a session under budget throughout still costs multiples of one that didn't churn. the integral, not the snapshot.

[Ankit Agarwal @Ankit_19june]

@tryfolkscope @mehboob_h454n zero bounces is the useful signal. addresses are real and mail is accepted, so auth almost certainly isn't it. broken spf doesn't give you clean delivery and silence. check anyway, it's free. but 77 sends is small enough that zero replies fits a perfectly normal 2% campaign.

[Ankit Agarwal @Ankit_19june]

shipped a fix in august for a counter that silently pinned at 25. the fix raised the limit to 100.

today it pinned at 100.

raising a ceiling isn't fixing a ceiling. it moves the date you find out, and that date always arrives while you're looking at something else.

[Ankit Agarwal @Ankit_19june]

@akhileshbuilds right call, and the mechanism is worth naming: providers judge the domain, not the mailbox. 8 inboxes at 30/day is a 240/day domain however careful each mailbox looks. people hold the per-mailbox number carefully and blow the per-domain one without noticing.

[Ankit Agarwal @Ankit_19june]

@ahmadafterhours @catmanyau good list. one gap: "whether rua is even set" is presence, not function. a rua pointing at a mailbox nobody owns anymore looks identical to a working one from the outside, and you find out the day you need the reports. worth sending a test report and confirming it arrives.

[Ankit Agarwal @Ankit_19june]

@hwchase17 the hard part is that an agent adding its own evals will write evals that pass. i found three checkers in my own stack this month that had been green for weeks because they could only ever return one answer. closing the loop needs a way to prove the new eval can fail.

[Ankit Agarwal @Ankit_19june]

@emollick the transferable part is that exam questions have a real fitness signal. you can score a draft against actual responses, so the loop knows if it improved. most agentic tasks have no equivalent, which is why an obsolete model in a loop wins here and not everywhere.