This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.

In this Ship It Conversations episode, I talk with Mallory Haigh about why context alone isn't enough for AI agents, the harness and governance layers that actually run them, and why she tells some platform teams to pump the brakes before adding agents at all.

Mallory is Head of Platform Education and Advocacy at PlatformEngineering.org. She teaches in Platform Engineering University and coaches platform teams through Platform Engineering Consulting, where the job gets jokingly called "platform therapist".

We start with her New York City analogy. Drop someone in the middle of the city with no directions and they'll get lost, and an agents.md file on its own does the same to an agent. It also needs to know what to do, how to do it, how it'll know it's done, and what it's allowed to touch. Mallory splits that into the harness, which is how the agent does the work, and governance: who and what is allowed, what's safe, and how it's watched.

Then we get into IDPs as context layers. Mallory says that's partly right, because the IDP and its golden paths are the foundation. What's missing are path specifications. Probabilistic paths are agent-driven, like a read-only PR review. Deterministic paths are your pipelines, like a CI build. Hybrid paths pair an agent with a gate: the agent opens the PR, CI validates it, the agent retries, and a human makes the final call. Cap those retries at three to five, and if an agent always does the same thing with the same outcome, ask whether it should be an agent at all.

On governance, Mallory says platform engineering is a practice about building trust, and that in the last three weeks alone she's told multiple platform teams to pump the brakes on agents because they can't get human governance right yet. We cover agent identity (specialists, not generalists, built on the RBAC you already have), agents watching terabytes of logs a day for SRE teams, and why every team now has to write down the tribal knowledge it never documented.

Her advice on where to start: ask why. Then try a read-only PR review agent, move to a hybrid validate-change path, and remember the line from one of her PlatformCon New York workshops: if we can't even write a README for our repos, how are we going to write one for our agents?

Highlights

• Why context delivery alone isn't enough for AI agents

• The harness and governance layers that make up agent infrastructure

• Observability for agents: token spend, time to completion and retry loops

• Probabilistic, deterministic and hybrid paths

• Retry limits, and when an agent should be a checklist instead

• Pumping the brakes when human governance isn't there yet

• Agent identity, RBAC and specialist agents

• Where a platform team should start: ask why, then a read-only PR review agent

Links

Mallory on LinkedIn · PlatformEngineering.org · Platform Engineering University · Platform Engineering Consulting · Thinking in Platforms · More episodes · On Call Brief · LMGT Awards