What is memory injection?

Attackers poison persistent memory through normal user queries — no special access required. The injected memory is then retrieved and acted upon by the agent as if it were legitimate context. Systems that store retrieved content directly into memory without validation are the most exposed.

Why does traditional monitoring fail agents?

Standard monitoring tracks response times and error rates. Agents are non-deterministic — each prompt produces a novel execution path. Yesterday's metrics cannot detect today's failure mode. Principle 2 extends into the engineering layer: if the team cannot observe what the agent is doing, it cannot remain perceptible to anyone.

What makes human-in-the-loop insufficient?

HITL becomes insufficient when the human only appears at the boundary of execution. If the system has already acted — written to a database, sent a message, reserved a resource — the approval gate is decorative. The human is ratifying a fait accompli, not exercising control. The Blueprint's position is that governance must be embedded in the structure of the workflow, not appended to its end.

Why does the standard approach fail for agent actions on public websites?

The standard approach fails because it was built for direct manipulation by an attentive human, not for delegated execution by an agent operating across multiple steps and periods of low user attention. DOM scraping, click replay, and screenshot interpretation hide intent, blur responsibility, and make approvals feel accidental instead of designed.

Application guides

Doctrine applied to the decisions that actually break things.

Principles are the foundation. Application guides are where they meet the product. Each guide targets a specific failure mode that teams hit when building agentic systems — and maps the Blueprint doctrine to the exact decision that prevents it.

Key Facts

Published guides: 4
Design principles: 10
Bilingual: EN + IT
Searchable via MCP: MCP

What an application guide is

A named failure mode

Every guide opens with the structural failure that causes teams to ship broken or untrustworthy agentic products — not vague warnings, but the exact condition that produces the error.

The Blueprint's replacement model

The doctrine does not patch the failure — it replaces the model. Each guide shows which principles apply and why the standard approach is structurally inadequate.

Implementation guidance

Guides close with concrete decisions, escalation tiers, or pattern changes that teams can apply immediately — grounded in how real production agentic systems work.

Published guides

Each guide is MCP-searchable, and aligned to 2–4 Blueprint principles.

Application GuideSecurity application

Making trust load-bearing against adversarial pressure

The blueprint's principles of progressive disclosure, inspectability, and explicit approvals define the conditions under which agentic systems can be trusted. Security application means making those conditions load-bearing — not merely aspirational for cooperative users, but structurally enforced against active adversarial pressure.

P4P7P8

Read guide →

Application GuideObservable evaluation

Proving the system works — not just believing it does

72% of teams building agentic systems believe comprehensive evaluation drives reliability. Only 15% achieve it. The gap is not a knowledge problem — it is a structural discipline problem. Principles 2, 6, and 7 define what observable behaviour requires; this page shows how those principles extend into the engineering measurement layer.

P2P6P7

Read guide →

Application GuideBeyond human-in-the-loop

Human-in-the-loop is not enough. The human must govern the structure.

Requiring a human to click an approve button at the end of execution is not a safety control. It is a ritual. When AI systems operate across multiple steps, access live systems, and produce downstream consequences, governance must be built into the architecture of the workflow — not bolted on at its edge.

P1P8P9P10

Read guide →

Application GuidePublic Web

If agents can act on your site, every action surface needs a clear boundary, a visible state, and an explicit approval model.

WebMCP changes the shape of website interaction by letting agents call declared tools directly instead of guessing through the DOM. That makes public websites more operable for delegated work, but it also raises the bar for product design. The question is no longer whether an agent can click through a flow. The question is whether your site exposes actions as bounded transactions with understandable inputs, visible progress, clear blockers, and explicit moments of human approval.

P1P5P8P10

Read guide →

Grounded in the Blueprint doctrine

Every guide cites its principle IDs explicitly. The doctrine is not decoration — it is the source of the replacement model in each guide. Start with the principles handbook to build the foundation before applying the guides.

Principles handbook

Access guides from your coding agent

The Blueprint MCP endpoint exposes all published guides via semantic search. Connect Claude Code, Cursor, or Copilot and retrieve the guide most relevant to the problem your agent is currently solving.

Set up MCP

Browse the principles Browse examples