A tool returns 214KB of logs. The window overflows, the agent's answers get worse, and nothing throws an error. Another agent retries the same call fourteen times. A third freezes seventeen seconds on a slow tool and times out. None of them crash. They just quietly cost you money and accuracy. This talk walks through the fix for all three: keep large outputs out of the window and pull them back by reference, give the agent a clear done signal so fourteen calls drop to two, and hand a slow tool a tracking id so a seventeen-second freeze becomes under two. You leave with working code, an open source repo, and a simple rule for which fix each failure needs.... Read more

Building an MCP server is getting easier. Monetizing one is not. At first, usage-based billing looks simple: count tool calls, aggregate them monthly, and send an invoice. But once AI workloads move into production agent workflows, the definition of “usage” becomes much harder. Was that one tool call or ten? Should you bill for tokens, API calls, records retrieved, compute time, successful outcomes, or prepaid credits consumed? What happens when an agent retries, chains tools, streams results, or calls the same resource through multiple clients? In this session, we’ll dive into the infrastructure behind trustworthy metering and pricing for MCP-native products. We’ll cover how to design a billing pipeline that can: - Count usage once and only once, even with retries, failures, and agent loops - Handle high-volume event streams from MCP tool calls - Give customers real-time visibility into current-period usage - Support pay-as-you-go, prepaid credits, drawdown models, and hybrid pricing - Preserve developer trust by making usage explainable and auditable... Read more

What does it take to build a startup where AI helps develop the product, run operations, and improve the systems doing the work? Drawing on lessons from building Prest0 and deploying AI agents in real business environments, Miles Maggio separates practical capabilities from demo theater. He examines where self-developing systems can create value, where they still need human judgment, and why evaluation, oversight, and reliability matter more than an impressive one-off result. The talk also explores the new business questions this raises: how to design teams, assess operating costs, and build a lasting advantage when AI is both part of the product and part of the workforce. Attendees will leave with a practical framework for evaluating autonomous AI claims, deciding what to automate now, and preparing for what comes next.... Read more

Deep Learning is an incredible, perhaps even mystical (read inscrutable), science: data goes in, backprop occurs, and incomprehensible algorithms are manifested. Finetuning is an integral part of this AI stack, and thus, despite the supposed onset of RSI, being aware of and understanding which techniques are most in accord with the Bitter Lesson is critical for achieving SOTA performance. Example topics will include: LoRA, Continual Learning, etc.... Read more

Roleplaying games are a natural fit for large language models (LLM), allowing them to assume the role of a narrator for a human user navigating an imaginary scenario. Without rules or memory, playing such a game degrades quickly as the LLM drifts, creates arbitrary outcomes with no tension, or misremembers details. Here, I will describe a Claude Skill that acts as a GamesMaster (GM) in a tabletop roleplaying game. Every action, encounter, conversation and item lives in a TypeDB database behind a 66-command CLI, so that the game is driven directly from this narrative state data. The system plays Mythras Imperative and Classic Fantasy Imperative — an openly-licensed (ORC) d100 system. The game is modeled as three layers: (A) universal rules; (B) a living world of NPC agendas on progress clocks producing beats scheduled against a world clock; and (C) epistemics, where each character's knowledge is a projection of data from a single source. True to form, success within the game must be determined through dice rolls so that gameplay is intrinsically stochastic and unpredictable. I will describe the system, and describe some gameplay experiences. The system could have applications to world modeling in non-gaming domains. For some players, RPGs provide a compelling experience of being transported into a story. I argue that the creative capabilities of LLMs combined with the scale of representation made possible by this type of agentic memory could support an entirely new type of gaming experience that transcends the capabilities of human-based TTRPGs.... Read more

Most RAG systems are assembled empirically and tuned against benchmarks; by contrast, Recursive Memory Retrieval (RMR) emerged as an application of a categorical structure that was developed for something else entirely. In this presentation, I will show how to derive a RAG system from first principles, starting from a categorical account of what a retrieval loop is and how it amplifies error. The same 2-categorical tolerance calculus that bounds error in entangled-photon protocols turns out to bound it in retrieval loops, yielding an error budget across hops, an irreducible floor beyond which more retrieval buys only noise, and a stopping rule that replaces the usual tuned hop count with a simple, interpretable quantity: the expected gain from one more hop.... Read more

For ML and LLM engineers, joining a startup as a founding engineer can be one of the highest-leverage moves of their career and also one of the easiest opportunities to misunderstand. We spend years learning distributed systems, model serving, evals, RAG, MLOps, and how to make GPUs do expensive things slightly faster. Then someone offers us 0.5% equity and suddenly we’re expected to understand dilution, strike prices, vesting, cliffs, preferred shares, liquidation preferences, runway, SAFEs, and whether “we’re raising our Series A soon” is good news. This talk is about that transition. I’ll break down the financial and startup concepts engineers should understand before accepting a founding-engineer role, how to reason about equity versus salary and risk, and the questions worth asking founders before joining. I’ll also cover what the job actually requires: moving beyond being a strong ML engineer into someone who can operate with ambiguity, talk to customers, make uncomfortable technical tradeoffs, understand the business, ship with incomplete information, and help build both the product and the engineering culture around it. Finally, I’ll make the case for why the current AI cycle creates an unusual window for ML and LLM engineers to become founding team members and how to position yourself to capture the upside without treating every startup offer like a lottery ticket.... Read more

AI agents in Enterprise finance products improve user experiences and allow building flexible business workflows. However, finance processes also depend on strict business rules, sensitive data handling and clear user control over consequential actions. This session explores which parts of a business workflow should use agentic reasoning, which should remain deterministic and where human oversight is essential. Using practical examples for enterprise finance, we will examine the failures that emerge when this balance is skewed with either rigid systems that cannot handle changing customer requirements or overly agentic and autonomous systems that compromise business integrity. We'll discuss engineering and product design solutions to maintain this balance for an enterprise product and a framework to apply the right combination of AI reasoning, deterministic controls, autonomy and human oversight.... Read more

What if agents were the first line of response for deployment problems—not just diagnosing issues, but actively fixing them? This talk explores how to leverage agents to automatically resolve build and test failures, identify runtime discrepancies, and execute runbooks, turning reactive deployment support into an intelligent, self-healing workflow.... Read more

Researchers already know evals are essential, but business and operations leaders often deploy AI without equivalent controls. Without clear evaluation, escalation, and accountability, organizations don’t scale AI, they scale risk. This talk reframes evals as the operational control layer that makes AI deployment reliable and gives leaders a practical framework for scaling with confidence.... Read more

Everyone is building agents. In industrial operations and process safety — where software output can end up in a regulatory filing or a court exhibit — we found that the properties that make an architecture agentic are the same ones that make it unauditable. Free tool selection, opportunistic replanning, and self-narrated reasoning produce results you can't reproduce, bound, or defend six months or 3 years later. This talk covers what we built instead: a gate-controlled pipeline where LLMs do bounded extraction and judgment inside fixed contracts, and orchestration stays deterministic. I'll walk through the principles that survived contact with real customer deployments in refining and chemicals — fail-closed over fail-open, absence of a verdict is not trust, provenance over self-attestation, no arithmetic across unknown states — and show how each one cashes out in concrete engineering: sealed execution manifests, evidence binding with full source provenance, and a reproducibility guarantee scoped precisely to the generative step rather than hand-waved across the whole system. I'll also cover the trade-offs honestly: what we gave up, where agentic patterns still earn their place, and why small models handle far more of this work than we expected — with the cost implications that follow.... Read more

Enterprise LLM applications introduce new security risks at the point where users, AI agents, APIs, and model-serving platforms interact. Prompt injection, unauthorized model access, sensitive-data exposure, denial-of-service attacks, and insecure backend connectivity require security controls that extend beyond traditional application boundaries. This session presents a vendor-neutral zero-trust edge architecture for protecting enterprise LLM and generative AI workloads. The framework is built around four core security primitives: globally distributed edge gateways with DDoS protection, Web Application Firewall enforcement, private connectivity to model endpoints, and end-to-end TLS with mutual authentication. Attendees will learn how these controls can secure LLM APIs, retrieval-augmented generation pipelines, AI agents, and inference services while supporting identity-aware access, regional data restrictions, and secure communication between application and model layers. The session also examines residual risks, including prompt injection, model abuse, compromised dependencies, certificate-management challenges, and insider threats. The architecture is mapped across Microsoft Azure, AWS, Google Cloud, and Cloudflare to demonstrate how organizations can implement consistent protections across multi-cloud AI environments. The session concludes with practical guidance on secure Infrastructure-as-Code templates, continuous policy tuning, private endpoint management, certificate lifecycle automation, and monitoring for suspicious LLM traffic patterns.... Read more

Generative AI is rapidly transforming how products are conceived, built, and delivered—but realizing its value requires more than simply integrating an AI model into an existing workflow. This presentation explores a practical framework for identifying where GenAI can create meaningful business and customer value, prioritizing the right opportunities, and translating those opportunities into scalable AI-powered products. The goal is to provide product leaders and innovators with a practical approach to turning generative AI from an emerging technology into a durable source of product differentiation, operational efficiency, and measurable business impact.... Read more

LLM inference has quietly become the biggest cost line in most AI products. As models get bigger and traffic grows, teams are watching their bills scale linearly while their margins collapse. The teams that win in 2026 won't be the ones with the biggest models. They'll be the ones who figured out how to serve them 10x cheaper without sacrificing quality. This talk goes deep on the engineering frontier of LLM inference, covering the levers that actually move the needle in production: KV-cache optimization, speculative decoding, quantization (INT8, INT4, GPTQ, AWQ), continuous batching, PagedAttention, and speculative parallelism. We'll cover the trade-offs between vLLM, TensorRT-LLM, and custom serving stacks, and when each one makes sense. Then we'll get into the architectural decisions that matter most: intelligent model routing, hybrid hosted-vs-self-hosted deployments, caching strategies for LLM workloads, and how to design cost-aware inference pipelines that degrade gracefully under load. Expect production war stories, real benchmarks, and a concrete framework for cutting inference costs without cutting corners. No hype, no vendor pitches, just the engineering choices that separate teams burning cash from teams shipping AI profitably at scale.... Read more

Multi-agent AI systems are increasingly built as teams: one agent plans, another retrieves information, another critiques, and another acts. Yet most evaluations still focus on the final outcome. Did the system answer correctly? Did the task succeed? That leaves an important question unanswered: which agents actually caused the result? A system can produce the correct answer while containing redundant agents, hidden dependencies, correlated reasoning failures, or agents that simply follow the conclusions of others. Conversely, an agent that appears unsuccessful in isolation may be essential to the performance of the team. This talk introduces a counterfactual approach to evaluating multi-agent AI systems, drawing from research on causal reasoning and multi-agent causal attribution. Instead of evaluating only what happened, we ask what would have happened if an agent were removed, its information changed, its recommendation perturbed, its tools restricted, or its role replaced. We’ll explore how counterfactual interventions and causal graphs can reveal individual agent influence, interactions between agents, error propagation, redundancy, recovery behavior, and hidden points of failure. We’ll also examine how these methods can distinguish agents that merely participate in a workflow from agents that are causally responsible for its outcome. Through practical examples of LLM-based agent teams, attendees will learn how counterfactual evaluation can move us beyond end-to-end accuracy toward a deeper question for production AI systems: not just whether an agent team works, but why it works, when it fails, and which parts of the team we should actually trust.... Read more

The thesis is that once an agent must remain responsive while doing long-running work, it stops being a chatbot and starts resembling an operating system. I’d show an architecture we’ve built at Miriel that separates real-time dialogue from deliberative work, with durable goals, a shared blackboard, system-call-like tool boundaries, and a scheduler that distinguishes progress, blocking, and runaway loops. It would be a practical technical talk, grounded in working software and actual failure modes, but aimed at giving application developers a different mental model for how serious agents should be built.... Read more

AI can generate a working agent application before you finish reading this abstract. That is not the same as operating one. As code, tools, and interfaces become abundant, scarcity moves across "the deploy line". From generating software to proving identity, authority, credential boundaries, reliability, and evidence for every action. Through a high-consequence workflow, this talk reconstructs the architecture on the far side of deployment and derives three laws for systems built to survive changing models, protocols, and agent hosts. You leave with a practical way to decide which parts of your stack should become disposable, and which must remain durable. When software becomes infinite, responsibility becomes the product.... Read more

Most agent demos are easy to judge right away: either the tool works or it doesn’t, and the answer is either grounded or not. Decision systems are trickier. They mix uncertain forecasts with strict rules, and you only see the results days later as noisy feedback that doesn’t show if the decision was good or just lucky. SmartPlayFPL is an agent-based system for making weekly Fantasy Premier League decisions within a set budget and strict squad rules. Specialist agents review different types of evidence on a shared blackboard. Their recommendations are combined by a weighted consensus engine, which applies rule-based vetoes, and then a constrained optimizer picks the final move. An orchestrator LLM manages the workflow and explains the result, but it does not handle forecasting, enforcing constraints, or optimization. I’ll explain why this separation is important, which failures are due to the model itself, and which happen when the model is given the wrong task. I’ll also discuss how to judge decisions when feedback is delayed, noisy, and only shows what actually happened, not what could have happened. I’ll compare the full system to simpler baselines, like a forecast-plus-optimizer pipeline without an LLM and a single agent with tools, since any extra complexity should be justified. The case study focuses on Fantasy Premier League, but this kind of problem also comes up in portfolio construction, capacity planning, and resource allocation. An LLM can play a key role in a decision system without being the whole system.... Read more

We spent thirty years building security around a simple assumption: code does what it was written to do, and people do what they're authorized to do. AI agents break both halves at once. They're software that improvises, running with a human's credentials, taking instructions from whatever text happens to land in their context — a retrieved document, an API response, a ticket a stranger filed. That's not a new kind of bug. It's an old one: the insider threat, except the insider is fast, tireless, and can be convinced by a paragraph of text hidden in documents. This talk teaches the framework and then makes it concrete. We'll walk through how a real attack unfolds: untrusted content in, privileged action out. We'll also cover why the industry's instinct to filter the prompt doesn't survive contact with production. Then the useful part: the four questions that separate agent deployments that fail safely from ones that fail expensively. Who is the agent acting as? What is it allowed to touch? What happens between the decision to act and the action landing? And how would you know afterward?... Read more

Intelligence is hardly a limiting factor these days. Most production agents fail to give the right response because of evidence failures. Because the agent's picture of the world is stale, conflicting, unattributed, and no amount of prompt engineering or model upgrades can fix that as retrieval can find the text, but not the truth. Worse, when the system recommends action and if evals do not find the problem with the action, the feedback might never come or comes via a customer-facing issue. The solution pattern we use: an ontology that defines what entities and claims mean, a graph that holds the evidence with its source, timestamp, and lineage, a vector index for finding candidate evidence, and an orchestrating agent on top that resolves conflicts, cites what it used, and refuses when the evidence isn't there.... Read more

Every agent framework now ships tool calling, and MCP has made it trivial to plug a model into hundreds of third party servers. That convenience moved the security boundary somewhere most teams are not looking: not the model, not the prompt, but the tool layer underneath. A poisoned tool description, a mutated schema after install, or a server that quietly reads outside its declared scope will bypass every guardrail sitting in front of the model, because the model was never the thing that got compromised. This session walks through what actually breaks in production agent systems and the controls that hold. I will cover tool poisoning and rug pull attacks against MCP servers, indirect prompt injection arriving through retrieved content and tool output, and the combination of private data access, untrusted input, and external communication that turns a useful agent into an exfiltration path. Then the defensive half: auditing MCP servers before install and continuously after, pinning and diffing tool schemas, enforcing least privilege on non human identities that agents run as, and the architectural rule that has held up best across the systems I have shipped, which is that the model reasons but deterministic, unit tested code enforces every policy decision. That rule comes from arithmetic rather than preference: five chained steps at ninety percent accuracy each lands near fifty nine percent end to end, so anything you need to be right has to leave the probabilistic path. Attendees will leave with a concrete threat model for the agent tool layer, a checklist for evaluating any MCP server they are about to trust, and detection and enforcement patterns that can be dropped into an existing agent stack without rewriting it. Examples are drawn from open source tooling I maintain and from production AI security platforms deployed in enterprise environments.... Read more

An agent that solves a task four times out of five is impressive in a demo and unshippable in production: state-of-the-art agents scoring 80 to 95 percent on isolated steps drop to 20 to 40 percent on long-horizon tasks. This talk distills a survey of roughly 85 papers on agent reliability into a builder's toolkit: a two-axis taxonomy of where errors are born and how they spread, the self-correction paradox (the model checking the work is the model that made the mistake), and the inference-time "decode tax" that makes reflection-style fixes cost more than they return. You'll leave with a vocabulary for diagnosing your own agent failures, a map of which mitigations target which failure types, a public dataset of 50 annotated failure traces, and an honest account of what nobody has solved yet.... Read more

Every MCP server you connect is a new attack surface, and most production agent stacks are shipping without a threat model. I'm a SIG member and contributor to SAFE MCP, Linux Foundation Project & the open security framework for the Model Context Protocol governed under the Linux Foundation and OpenSSF, which now catalogues 78+ adversarial attack vectors against MCP fully mapped to MITRE ATT&CK - tool poisoning, rug pulls, cross-server shadowing, and prompt injection chains that survive every guardrail teams currently trust. This talk walks the live attack classes we've documented, shows what each one actually looks like inside a running agent, and then covers the defense: ShieldMCP, a transparent security proxy implementing 3-stage validation that drops in front of existing agents and servers with zero code changes on either side. ShieldMCP is open source, and its architecture is the subject of my published sole-authored paper at ACL 2026 A* Conference (Industry Track); the SAFE MCP framework was the subject of OpenSSF's official Tech Talk on Securing Agentic AI in March. I'll ground all of it in what it takes to run this in regulated financial infrastructure - I am Technology Leader at eBay and architect softwares serving large number of sellers across the US, UK, and Germany Attendees leave with the threat catalogue, a working proxy they can deploy, and a concrete checklist for auditing their own MCP surface before someone else does it for them.... Read more

We're a distributed team of applied AI engineers, split across two locations, and every one of us leads a project while working on several more. Multi-threaded is our normal, not a bad week - and the ground moves hourly: repositories change, business facts change, and on a single repo two engineers will run experiments and close tasks before lunch. At that speed the hard part is no longer writing the qoek - AI does plenty of that. It's that context goes stale in hours. The moment a person, or more dangerously their AI agent, starts from an out-of-date picture of the world, it confidently builds something that duplicates or contradicts what a teammate just shipped. Speed stops compounding and starts colliding. So the real job became herding context: keeping every engineer and their mutiple agents aligned on the same facts and the same rules at any given moment. We had to make that alignment automatic. This talk is about why that quietly became our bottleneck and what we built to solve it.... Read more

Support teams need incoming issues sorted into the right category so they reach the right people. But what happens when the categories aren't a flat list when they're three levels deep, and the valid options at each level depend on the choices above them? This talk walks through a real production problem: automatically classifying support cases into a three-tier hierarchy. The obvious answer, train a classification model but it turned out to be a poor fit. Hierarchical classification is genuinely hard for traditional models: early mistakes cascade down the tree, rare categories have too few examples to learn from, and off-the-shelf tools don't understand which options are valid under which parent. Instead of training a model, we reframed the problem as retrieval. By building a repository of common issues for each leaf category, embedding it, and using a hybrid RAG search to match new cases against it, we let semantic similarity do the classification work as a result no model training required. I'll cover why traditional approaches struggle with hierarchical problems, how the retrieval approach sidesteps those issues, the tradeoffs we accepted, and where this pattern does (and doesn't) make sense.... Read more

Most enterprise AI pilots stall the moment they leave the sandbox and meet a real transactional system. Pricing is one of the sharpest examples: it is high-frequency, financially binding, and threaded through every stage of the Order-to-Cash lifecycle, which makes it an unforgiving place to deploy autonomous decisioning. This session walks through a production architecture that embeds LLM and ML-driven pricing agents directly into a live enterprise system, and what it actually took to make that safe, fast, and auditable. The architecture is organized into four layers — Interaction, Application, Extension, and Integration — with a centralized pricing engine at the core that computes base pricing, discounts, surcharges, tax, and net value in real time. Sitting alongside it is a consistency layer that continuously validates agent-driven and rules-driven outputs against each other, closing the gap between automated decisions and financial truth at every handoff from order to invoice. I'll cover how real-time pricing APIs and ML-based models were integrated with the core system without destabilizing it, using clean core extensibility so agentic components could be upgraded independently of the underlying platform. I'll also share production outcomes: multi-million-dollar savings from replacing legacy pricing tools with model-driven decisioning, measurable gains in response time and scalability under high-volume load, and how dynamic, model-informed tax adjustments held up across multi-country regulatory frameworks. Attendees will leave with a concrete blueprint for introducing agentic and ML-based decisioning into financially sensitive, high-volume enterprise systems — including where autonomy earns its place, where validation layers are non-negotiable, and how to scale without breaking upgrade safety.... Read more