Loading…
Topic
832 posts about Architecture. Every summary links to the original.
See the idea
Amazon Bedrock is the managed reasoning tier in an agent architecture, not the whole system. This layered view shows the pipelines, governed tables, query layer, and guardrails around it.
API versioning as an architecture: requests enter through a version header, pass through a chain of reversible version changes, and reach controllers that only ever see the latest model.
BIAN gives banks a shared vocabulary and service-domain contracts that sit between business concepts and the systems implementing them. See how domains, contracts, and governed access stack into one architecture.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Uber, Oracle Cloud Infrastructure, and Ampere co-optimized the OCI AmpereOne M A4 instance family after migrating large workloads from on-premises data centers to Arm-based cloud infrastructure. Early A1 and A2 deployments exposed dual-socket latency, Go performance degradation associated with smaller TLB and cache sizes, and insufficient single-thread performance for Gurobi services. Uber shared workload characteristics and targets that informed AmpereOne M silicon and an OCI FlexSKU, while the teams evaluated frequencies, core counts, deployment models, memory ratios, and storage. For latency-sensitive stateless services, the resulting guidance favors higher-frequency CPUs, about 8 GB per vCore, and virtual machines; throughput-oriented storage systems use parallelism, flexible memory-to-core ratios, and local NVMe or remote block storage according to locality. The collaboration is presented as improving price-performance and supporting energy-efficient, cost-optimized multi-architecture computing at scale.
Software development is experiencing an architectural shift as artificial intelligence agents transition individual contributors into orchestrators and reviewers of automated workflows. Rather than spending effort on manual coding, developers increasingly focus on defining system architecture, guiding agent execution, and managing operational risk through tiered human and agent review loops. The primary bottleneck for agentic systems lies in preparing organizational data so that agents can effectively reason over enterprise knowledge. To address this challenge, Google published an open knowledge format and is adopting agent-driven semantic ontology generation to infer relationships across messy data estates. This evolution transforms ontology building from manual human toil into automated generation, allowing engineers to focus on high-value data curation and strategic system design.
AgentFlo built autonomous AI sales agents to address cart abandonment, unassisted messaging channels, and severe traffic spikes across eCommerce platforms. The system uses the Strands Agents SDK alongside Amazon Bedrock AgentCore to manage intent, recommend products, and execute transactions. Incoming customer communications pass through AWS Fargate before entering AgentCore runtime, which executes model-driven agents inside isolated microVMs with stateful sessions lasting up to eight hours. Tool execution is brokered separately through AgentCore Gateway to ensure operations like cart modifications scale independently from model reasoning. This deployment model enables merchants to launch specialized conversational agents in minutes without pre-provisioning capacity or maintaining custom container configurations.
Connecting AI agents to enterprise APIs and MCP servers creates governance challenges when relying on traditional OAuth consent prompts. Cross App Access shifts authorization decisions to the enterprise identity provider, allowing IT administrators to manage agent permissions centrally. In this architecture, an identity provider like Okta authenticates the user and issues an Identity Assertion JWT Authorization Grant based on administrative policy. The requesting AI agent presents this assertion to Auth0, which validates the signature and exchanges it for a standard access token via a JWT-bearer grant. Protected APIs can then validate the final token normally without requiring code changes or direct user consent interactions.
Federating vision-language models (VLMs) across institutions requires keeping images, text, and prompts local while coordinating training and combining updates from sites with different task and modality mixes. NVIDIA FLARE addresses this workflow through server-scheduled rounds, client-local execution, and an explicit update contract, while supporting large-object externalization, pull-based tensor streaming, and disk-backed aggregation for large payloads. The post presents FedUMM as an adapter-based design in which clients train LoRA adapters over a frozen BLIP3o backbone and send only adapter updates, while full-model training remains possible when required. In reported eight-client experiments, adapter-only federation reduced per-client communication from 28.6 GB to 0.094 GB per round, improved VQA v2 by 0.7 points, and retained about 97% of centralized performance on VQA v2 and GenEval; the evaluation used simulated sites and does not establish clinical performance or formal privacy guarantees.
Cloudflare reassessed remote Spectre attack feasibility within Cloudflare Workers production workloads to evaluate defenses against modern stabilization techniques. The experimental proof of concept bypassed Dynamic Process Isolation (DyPrIs) by keeping invocations alive using WebSocket traffic, which also diluted hardware performance counter ratios below detection thresholds. By combining branch mistraining, cache line eviction, and speculative type confusion, researchers transiently accessed out-of-bounds memory via raw 64-bit TypedArray backing store pointers. This attack demonstrated cross-tenant data leakage reaching up to 12 bit/s with over 99% accuracy in production. In response, Cloudflare mitigated the vulnerability by integrating the V8 memory sandbox, deploying Memory Protection Keys for hardware-assisted in-process isolation, and redesigning DyPrIs to monitor active long-lived executions.
Clario developed an automated PHI and PII detection solution on AWS to process thousands of DICOM image slices and PDF files in clinical trials. Medical imaging workflows require strict privacy compliance under HIPAA, GDPR, and ICH E6 guidelines across standard tags, custom vendor metadata, and pixel-burned text. To address this, the pipeline retrieves files from Amazon S3 and runs memory-intensive detection workloads on Amazon EKS backed by Amazon RDS for PostgreSQL. Amazon Textract handles optical character recognition, while Anthropic's Claude Sonnet on Amazon Bedrock classifies sensitive data using domain-optimized prompt engineering. The system identifies precise coordinates and sensitive entity types rather than directly altering files, enabling human-in-the-loop review before downstream redaction occurs.
Manual chart review across fragmented clinical sources slows clinical trial enrollment, contributing to timeline delays and high screen failure rates. To address this bottleneck, an architecture on AWS automates eligibility and safety assessments while preserving human clinician authority. AWS HealthLake ingests and normalizes records into FHIR R4 resources, while Amazon Bedrock AgentCore orchestrates pre-screening, detailed screening, and site enrollment agents. Amazon Bedrock AgentCore Evaluations scores screening determinations using an LLM-as-a-judge approach for clinical accuracy, operational effectiveness, and safety compliance. This human-in-the-loop workflow produces structured recommendations with source citations, reducing patient matching time from days to minutes while maintaining compliance audit trails.
Modern artificial intelligence agents increasingly rely on search infrastructure to run complex, neuro-symbolic reasoning workflows that compile into deeply nested, non-monotonic Boolean queries. Standard inverted index evaluation methods struggle with these query structures, facing either exponential query complexity under Document-at-a-Time models or universe-scale space penalties under Term-at-a-Time models during logical negation. To address these theoretical limitations, the author formalizes a DAG-based retrieval language named L_R and proves its query evaluation problem is strictly P-Complete. The paper introduces ComputePN, a deterministic and sparsity-aware algorithm that employs a Positive-Negative dual representation alongside native DAG memoization. This mechanism bounds evaluation time to O(|Q| · |U_active|), effectively evaluating P-Complete queries natively over the index while bypassing combinatorial tree expansion and universal scan overhead.
Dropbox manages growing infrastructure demands from AI and standard workloads by maximizing the efficiency of its existing data centers rather than just building more capacity. Through a system-level approach spanning software, hardware, and physical facility design, the company dynamically manages power and balances workloads. These optimizations, combined with higher storage density and data-driven hardware lifecycle management, have significantly reduced energy use per unit of storage.
Border Gateway Protocol route leaks occur when routing announcements propagate beyond their intended customer-provider or peer relationships, causing traffic misdirection and performance degradation. RFC 9234 embeds relationship awareness directly into BGP by establishing negotiated BGP Roles and attaching an Only to Customer (OTC) transitive path attribute to prevent unauthorized route propagation. To assess real-world adoption, Cloudflare monitored OTC attribute transmission across peer networks and discovered that 33.1 percent of IPv4 and 17 percent of IPv6 paths were missing the OTC attribute. Investigation revealed that Tier-1 transit providers AS1299 and AS3257 were stripping the attribute due to legacy defensive BGP error-handling configurations. Following direct engagement, AS1299 updated its configurations to preserve OTC propagation, whereas AS3257 continued stripping it, highlighting the necessity of broader vendor and carrier support across the Internet.
Retailers are moving from isolated generative-AI pilots to enterprise-wide adoption, where each store, headquarters, and digital workflow needs different data, permissions, models, and cost controls. The post argues that useful AI depends on governed business context, while fragmented tools can produce separate provider contracts, logs, permission models, cost centers, and answers to the same question. It proposes an open control plane that centralizes governance and model access without forcing employees into one application or vendor. The described Databricks design combines Unity Catalog for data and business context, Unity AI Gateway for routing and oversight, Foundation Model APIs for commercial, open-source, and custom models, and Genie for natural-language queries over governed data; the intended result is faster experimentation and deployment with visibility into access, spending, lineage, and auditability.
Autonomous AI agents depend on the accuracy of the underlying data layer because retrieved data populates the LLM context window for multi-step reasoning. In distributed architectures, standard asynchronous replication lag causes agents to ingest stale data, leading to flawed execution and self-reinforcing hallucination debt when errors are saved back to memory. To resolve this, architectures must align replication strategies with specific task truth requirements across three primary patterns. High-stakes workloads utilize Amazon Aurora with global write forwarding or native Aurora DSQL for multi-region strong consistency, while high-scale scenarios leverage DynamoDB Global Tables with conditional writes to prevent lost updates. Finally, high-velocity ingestion pipelines enforce LOCAL_QUORUM reads and writes in Amazon Keyspaces to capture critical data spikes reliably.
The post distinguishes agent state, the run-bound working data of a single execution, from agent memory, knowledge that outlives the run and is read across sessions. Context compaction, which decides what to keep when the window fills, is lossy by construction and sets both token cost and reliability; Chroma’s study found models become unreliable well before their advertised 200k-token window, and teams compact at 95% or proactively at 60%. System prompts and skills must be versioned, governed infrastructure, not text files, with prompt registries and the SKILL.md standard for procedural memory, and skills are executable so they require sandboxing. Enterprise data enters memory through pipelines like change data capture, not migrations, with chunking, embedding, and provenance stamps. The database choice caps filtered recall under selective scoping, the consistency window, and temporal modeling, setting the ceiling for later decisions.
The post presents a constraint-aware GPU allocator as a response to utilization losses caused by fixed real-time reservations and FIFO ordering under contention. It compares the allocator with FIFO on identical hardware and workloads across seven benchmark scenarios, modeling batch-like jobs as contiguous GPU blocks and real-time inference as a timestep-by-timestep demand curve with bounded GPU swaps. Across five contention scenarios, utilization improved from 52–85% to 72–88%, while priority-weighted value increased 24.6–105.1%; the strongest case gained 33 percentage points of utilization and 105% value, and the scale test gained 15.9% value at identical utilization and throughput. The scheduler optimizes a 24-hour horizon but commits only the current timestep, re-running every 30–60 minutes so fresh observations absorb forecast error while preserving running work.
Palo Alto Networks built a new SASE Health Portal to provide real-time service health visibility for its enterprise customers. The previous architecture relied on relational databases and cloud data warehousing, which caused schema migration bottlenecks and regional lock-in. To solve this, the team deployed containerized services across multiple cloud zones in an active-active configuration. They used MongoDB Atlas as a globally replicated database, enabling automated cross-region failover and flexible document modeling for customer subscriptions. The new portal eliminates alert fatigue by allowing granular subscriptions and achieves zero relational joins for fast incident matching.
Databricks AI Functions bring model inference into SQL queries, addressing the need to combine warehouse-resident structured data with unstructured reviews, tickets, PDFs, and transcripts without exporting rows to a separate service. The post presents six Lakehouse use cases: document parsing and extraction, sentiment classification, translation, ticket routing, sales-call extraction, and generative drafting with ai_query. Task-specific functions such as ai_parse_document, ai_extract, ai_classify, and ai_translate handle specialized work, while ai_query sends prompts to an accessible Databricks-hosted Foundation Model serving endpoint. Unity Catalog permissions, existing pipelines, and system.billing.usage keep governance and billing within Databricks, while SQL execution manages planning, parallelization, and retries. Production guidance includes tagging jobs, sampling at least 10,000 rows, choosing models deliberately, requesting structured output, and versioning prompts.
AI context architecture defines the boundaries, data access, memory, and fallback behavior that constrain AI agents and make their outputs more predictable. The discussion distinguishes architecture as system design, infrastructure as the storage and delivery of context, and engineering as implementation; MCP is treated as an architectural protocol, while RAG spans all three layers. Examples include restricting retrieval to car or sports-car tires, preserving agent history, and routing incomplete or low-trust knowledge to subject-matter experts through a human-in-the-loop flow. The buy-versus-build discussion notes that coding a custom architecture is possible, but buying can provide accumulated experience with data treatment, edge cases, and recurring operational problems, while good architecture also reduces token costs and aims for consistent, predictable answers.
Traditional security boundaries assume human speed and judgment, but AI agents execute nondeterministic actions rapidly and can invoke unapproved Model Context Protocol servers through standard HTTPS traffic. To mitigate this shadow traffic, Cloudflare One introduces detection and inspection capabilities across clients, network boundaries, and MCP servers. Cloudflare Gateway leverages protocol-level headers and JSON-RPC inspection to identify direct MCP connections, verify managed paths, and enforce access through approved MCP Server Portals. Furthermore, Cloudflare Agents SDK v0.20.0 implements the stateless 2026-07-28 MCP specification while providing fallback handshakes for legacy servers. Organizations can combine Gateway traffic source rules with server middleware like WriteGuard to block unauthorized tool invocations before execution.
Ramp describes an approach to scaling integrations beyond what engineers can build and maintain by hand. Its agentic system lets customers describe a missing workflow integration, researches the provider’s API, requests credentials through a secure widget, writes and tests ordered API-call “recipes,” and generates a deterministic script that runs the integration after build time. An internal Integration Factory applies the same pattern to first-party connectors, producing evidence for review and opening pull requests; the post says 75 integrations have shipped this way, with work reduced from weeks or months to hours. Security controls include HTTPS and hostname allowlists, private-address rejection, isolated egress, bounded responses, business-scoped immutable recipes, and test credentials rather than customer data. The central design lesson is to use models during research and construction, keep them out of execution, and bound autonomy with verification artifacts.
The best engineering reads, once a week.
