Question library
Explained questions for the decisions developers make.
When do you use an agent versus a workflow?
Use an agent for variable language interaction and bounded tool selection. Use a workflow when order, dependencies, approvals, or state transitions must be explicit. A business application often uses both.
MAF versus LangGraph?
I compare ecosystem/language fit, state contracts, review/resume behavior, persistence guarantees, observability, and hosting. LangGraph starts from explicit state-graph orchestration; MAF provides agent and workflow abstractions in its ecosystem. The…
A client already uses Semantic Kernel. Do you rewrite?
I inventory maintained features, current support, and actual pain points. I prototype MAF behind stable tool contracts and compare evaluation/recovery behavior before migrating. A rename or new framework alone does not justify a risky rewrite.
Workflows
Beginner — Deterministic versus agentic workflow?
Deterministic versus agentic workflow?
Deterministic transitions follow defined code and recorded outcomes. Agentic transitions delegate some next-step choices to a model. I use AI for language uncertainty and deterministic control for business invariants.
Why is idempotency important?
Retries can happen after a successful effect but before the response arrives. A scoped operation key and payload hash let the service return the same receipt instead of creating another claim or sending another email.
Temporal or BullMQ?
I use a queue for isolated background jobs and a durable workflow platform for long-lived coordination, timers, and human events when justified. BullMQ still needs explicit business lifecycle records; Temporal still needs idempotent activities and…
Submission timed out. Should you retry?
First classify the outcome as potentially unknown. Query or reconcile the external receipt by operation key, then retry only under a documented idempotency contract. Reporting failure immediately could encourage duplicate customer submissions.
Memory
Beginner — Context versus memory?
Context versus memory?
Context is the information a model sees in the current call. Memory is stored application data that may be selected for later context. Persisting something does not make it accurate, current, relevant, or authorized for every task.
Checkpoints versus long-term memory?
Checkpoints recover execution progress; long-term memory stores selected preferences or verified past events. I keep both separate from authoritative policy and claim records because their purposes and retention differ.
How do you prevent memory poisoning?
I define which sources may create memory, require provenance and verification for important facts, scope it by tenant/user, and provide expiry and correction/deletion. Retrieved memory remains lower authority than fresh canonical business data.
The assistant remembers a policy that has expired. What changes?
It must resolve current policy applicability through the business service. Historical memory may explain past conversation but cannot decide the active version. I invalidate dependent caches and test stale-memory conflicts explicitly.
AI security
Beginner — What is prompt injection?
What is prompt injection?
It is an attempt to redirect the model through attacker-controlled instructions. When those instructions appear in a PDF, webpage, email, or tool result, it is indirect injection. I treat these sources as data and limit model authority.
Why avoid direct database access?
A generated query can read too much, mutate data, or consume excessive resources. I expose narrow schema-defined business tools with authorization, parameterized queries, field projection, and limits instead of broad database credentials.
What are the main trust boundaries?
Browser to API, documents to parser, model to tool executor, tool to business service, cross-tenant retrieval/memory/cache, and application to provider/telemetry. At each boundary I validate, minimize, authorize, and record permitted outcomes.
An invoice tells the agent to email private records. What blocks it?
The invoice is untrusted content. The agent lacks unrestricted read/send tools, the tool service checks object access and recipients, and sending requires the configured approval. A better prompt helps but does not serve as the primary barrier.
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.