Technical book · sneak peek
The World Outside the Model
Engineering AI Agents for State, Authority and Reliable Action
An AI agent that pays an invoice acts on facts it read earlier. Those facts can go stale between the decision and the effect.
A permission can be revoked. A retry can pay twice. Most agent books teach how to make the model reason better. This book teaches the engineering outside the model.
One incident runs through the whole book. A finance agent goes live at a fictional regional utility. Six days later it pays one invoice twice. Its delegated approval had been revoked earlier that morning.
Each chapter repairs one part of that failure with runnable Python and a test.
Why it matters
A smarter model would not have caught it
A guardrail prompt would not have caught it either. The cause was a cached permission check and a retry with no idempotency key.
The book reads agent safety as distributed-systems engineering. It follows one question across frameworks, protocols, memory and governance. What makes a decision still valid when its effect commits?
What you will learn
Six things you can do after the last chapter
- Name every kind of state an agent depends on and its owner
- Re-read authority before commit and fence late work
- Dispatch each effect exactly once and reconcile unknown outcomes
- Admit only confirmed outcomes to memory
- Enforce permissions outside the agent
- Reconstruct any action from four facts after an incident
Who it is for
Engineers who put agents in front of real systems
For platform, backend and AI engineers who put agents in front of real systems. Also for SRE and security engineers who must operate and contain them.
You need Python and one agent built. You need no machine learning background. Every mechanism ships as runnable Python with no framework dependency.
Excerpt
From Chapter 1, When the Demo Becomes a System
The demo paid an invoice in eleven seconds. Tomas Reyes ran it from a laptop at the end of a long conference table. A scanned PDF went in at one end of the pipeline. The payment gateway returned a reference number and the room applauded.
Dev Malhotra had flown in for the meeting and said the word production twice.
Brinkwater is a software company of about forty people. Its runtime runs inside other organizations. Its flagship agent for back-office finance work is called Kestle.
The room that morning was at Southvale Energy, a regional gas-and-electric utility. Southvale's accounts-payable team pays about nine hundred supplier invoices in an ordinary week. Kestle had read one of them, matched it against a purchase order and paid it.
Nobody in the room asked what the demo would have done if the gateway had stayed silent. Nobody asked who had given it permission to move the money at all. Those two questions are this book.
Five weeks later Brinkwater put Kestle in front of live invoices at Southvale. Six days after that, on a Tuesday, the runtime paid one invoice twice.
A short excerpt from the manuscript in revision. Wording may change before publication.
The author
Ratnavarma
Ratnavarma has 21 years in enterprise technology. He researches trustworthy production agentic AI. The book's examples are fictional and draw on no client work.
Read alongside
Agents with Foresight World Models for Reliable Action in Digital Enterprises A companion volume. It covers when an agent needs a model of its world.