Matt Doughty
Matt Doughty is Co-founder and CEO of Prefactor. He writes about AI agent governance, runtime controls, and the controls enterprise teams need to deploy agents safely.
Root-Cause Analysis for Agent Failures: Reading the Trace to Find What Actually Broke
How to instrument multi-step agents, read execution traces, and route forensics by failure type to catch behavioral decay before users do.
Gaps between agent deployment and production readiness
97% of companies have deployed AI agents, but only 11% run them at scale. Here is the observation infrastructure that closes that gap.
Token efficiency and cost visibility as agents scale
How to instrument agent spans for token spend, build cost baselines by agent type, and tell normal variation from runaway behavior before bills surprise you.
Agent capability boundaries and when models fail at their jobs
Agents fail at predictable capability boundaries. Here is how to identify those limits before they become production incidents.
The Step-Level Cascade: Why Agents Fail at Compound Tasks and How to Evaluate Before Deployment
An 85%-accurate agent completes only 1 in 5 ten-step tasks. Here is how span-level scoring and cascade testing catch failures before production.
Why 88% of agent pilots fail: measuring what matters before scaling
88, 95% of enterprise agent pilots never reach production. The gap is not model quality , it is the absence of measurement before you scale.
When Good Traces Turn Silent: Detecting Quality Collapse in Agent Production Deployments
AI agents fail silently in production: servers stay green while agents hallucinate, skip steps, or destroy data. Here's how to instrument for behavioral quali
From Step Accuracy to Workflow Success: Why Trajectory-Level Evaluation Changes Everything in Production Agents
An agent with 85% per-step accuracy completes a 10-step workflow only 20% of the time. Here is how trajectory-level evaluation closes that gap in production.
Model routing and cost optimization: measuring agent efficiency in real time
Automated model routing only pays off if you measure which tasks actually need which models. Here is how to instrument spans and validate routing decisions at
Measuring what agents actually do versus what you think they do
Agents drift from intended tasks without obvious signals. Here is how to instrument them, classify task types by span, and use schema validation to catch dive
Measuring what agents actually cost: token metrics that matter
Vendor claims of 60, 90% token savings don't survive contact with production benchmarks. Here's how to measure what your agents actually cost.
Building observable agent workflows that humans can review at speed
How to structure agent spans and approval checkpoints so reviewers can assess multi-step actions in seconds, not hours, in customer-facing and financial workf
From Lab to Liability: Why Agent Benchmarks Fail in Production, And How to Measure What Actually Matters
Enterprise AI agents show a 37% gap between benchmark scores and production performance. Here is what to measure instead, and how to structure evaluation that
Auditability and reproducibility in autonomous workflows
How append-only fact stores and provenance tracking make every agent decision reviewable, reproducible, and defensible in regulated and high-stakes domains.
Validating agent behavior against expected outcomes
Coding agents from Anthropic and OpenAI deleted user files during autonomous runs. Here is how to validate agent behavior against declared scope before it rea
What the OpenAI Hugging Face Incident Reveals About Real-Time Agent Evaluation
Two OpenAI models escaped an eval sandbox, ran 17,000+ actions across a weekend, and reached Hugging Face's infrastructure. No system caught it in real time.
The Step-Level Accuracy Problem: Why Your Agent Works in Benchmarks But Fails in Production
A 95% per-step accuracy agent has only a 6% chance of completing a 10-step task correctly. Here is how to measure and fix that.
MCP vs API: What's the Difference?
An API lets software talk to software. MCP is an open standard that lets AI agents discover and call tools the same way everywhere. How they differ and how they fit together.
Agentic AI vs Generative AI: What's the Difference?
Generative AI creates content in response to a prompt. Agentic AI uses that ability to pursue goals, planning, using tools, and taking actions. How they differ and how they relate.
LangGraph vs LangChain: What's the Difference?
LangChain is a toolkit for building LLM apps from components. LangGraph is a library for building stateful, multi-step agent workflows as graphs. When to use each, and how they fit together.
MCP vs A2A: What's the Difference?
MCP connects an agent to tools and data. A2A connects agents to each other. Two complementary protocols for agent systems, and where each one fits.
RAG vs Fine-Tuning: What's the Difference?
RAG feeds a model external knowledge at query time. Fine-tuning trains new knowledge and behaviour into the model's weights. When to use each, and why teams often combine them.
RAG vs MCP: What's the Difference?
RAG gives a model knowledge from documents; MCP gives an agent tools and live systems. What each does, how they differ, and why most agents use both.
Silent Agent Failures in Production: Why Step-Level Evaluation Gaps Cost Millions
Enterprise AI agents pass benchmarks then fail silently in production. Here's why step-level evaluation gaps cause compounding workflow failures and how to cl
Measuring agent reliability with token efficiency and cost benchmarks
Token overhead variance is a reliability signal, not just a cost signal. Here is how to use it to detect agent behavioral instability before it compounds.
Detecting Agent Quality Decay in Production: The Hidden Metric Every Team Misses
Agent quality rarely crashes, it drifts. Here's how to instrument agents, read the signals early, and set thresholds that catch decay before users do.
The Offline-to-Online Evaluation Gap: Why Your Agent Tests Pass but Production Fails
Offline agent evaluations miss 30-40% of real-world failure modes. Here is how to layer trace-based and online evaluation to catch what test sets cannot.
Why AI Agents Fail Production Evaluation: The Reliability Gap Between Benchmarks and Real-World Deployment
Production AI agents fail at rates between 70, 95% depending on task complexity. Here is what evaluation frameworks miss and what to measure instead.
The Silent Failure Gap: Why 88% of AI Agents Fail Quality Evaluation Before Production Reaches Scale
88% of AI agent projects fail before production scale. Here is what the measurement gap looks like and how to close it before deployment compounds the cost.
Measuring what agents actually cost: hidden token overhead and efficiency gaps
A 4x token cost gap between identical agent outputs shows why instrumentation matters before you scale. Here is how to measure and fix it.
Evals vs Observability: Watching Your Agents Is Not Evaluating Them
Observability tells you what your agent did. Evaluation tells you whether it was any good. Here is why you need both, and how to wire them together.
Agent Evaluation in Production: What to Measure and How to Prove It
A practitioner playbook for measuring AI agent quality in production: task success rate, drift, failure modes, and building an evidence chain from spans to sc
Ghost Actions: When Your AI Agent Does Things Nobody Asked For
Ghost actions are agent behaviors nobody requested. Here is what they look like, why standard monitoring misses them, and how to catch them before they cause
What Customers Ask Before They Trust Your AI Agent
The five questions enterprise buyers ask before they'll rely on your AI agent, and the evidence artifacts that answer each one before a deal stalls.
5 Questions Every Head of AI Should Ask About Agent Governance
Scaling AI agents from pilots to production requires governance infrastructure. These five questions help Heads of AI evaluate whether their organisation can scale agents responsibly.
5 Questions Every ML Engineer Should Ask About Agent Runtime Controls
ML engineers building AI agents need runtime controls that work with their development workflow — not against it. These five questions help evaluate agent governance from an engineering perspective.
5 Questions Every AI Product Manager Should Ask About Agent Governance
AI product managers must balance user experience with governance requirements. These five questions help PMs ship agent-powered products that are both useful and responsible.
5 Questions Every Risk Manager Should Ask About AI Agent Deployments
AI agents introduce risk categories that traditional risk frameworks do not cover. These five questions help risk managers evaluate and mitigate the unique risks of autonomous AI agents.
5 Questions Every CISO Should Ask Before Deploying AI Agents
AI agents introduce attack surfaces that traditional security tools were not designed for. These five questions help CISOs evaluate whether their organisation is ready to deploy agents safely.
5 Questions Every AI Governance Lead Should Ask About Agent Oversight
AI governance frameworks designed for models do not cover agents. These five questions help governance leads extend their programmes to address the unique challenges of autonomous AI agents.
Taming the Lobster: Announcing Prefactor’s Integration with OpenClaw
Prefactor announces a new integration with OpenClaw (Clawdbot)
AI Model Watermarking for Enterprise Security
How cryptographic and forensic watermarks embedded in AI models and outputs help enterprises prove ownership, detect misuse, and meet compliance.
How to Analyze Multi-Agent AI Attack Surfaces
Framework to inventory agents, map dependencies, detect context poisoning and prompt injection, and apply behavioral and static analysis to secure multi-agent AI.
Best Practices for MCP Audit Compliance
Secure MCP agent access with least-privilege controls, tamper-proof audit trails, automated access reviews, real-time monitoring, and permission fixes.
AI Agent Identity Audits: Reporting Standards
Standards for auditing AI agent identities, metrics, and reports to ensure traceability, verified human ownership, and compliance with HIPAA, SOX, and GDPR.
MCP Breach Detection Best Practices
Secure MCP systems with detailed logging, EDR and AI behavioral analytics, protocol validation, centralized audit trails, and rapid containment controls.
Best CI/CD Tools for MCP Integration
Compare GitHub Actions, GitLab CI, Azure DevOps, Jenkins, and cloud-native CI for secure MCP integration and agent governance with Prefactor.
MAESTRO Framework: Threat Modeling for AI Agents
MAESTRO maps AI agent security into seven layers to identify and mitigate adversarial attacks, data poisoning, impersonation, and runtime threats.
MCP MFA Compliance Checklist
Practical checklist to enforce phishing-resistant MFA, secure AI agent identities, apply RBAC, and log/audit MCP access for regulatory compliance.
Top Features of AI Vulnerability Scanning Tools
Key features of AI vulnerability scanners: real-time monitoring, AI-specific threat detection, CI/CD and MLOps integration, governance and scalable fixes.
How MCP Secures Agent Authentication Compliance
How MCP uses OAuth 2.1 with PKCE, resource indicators, scoped tokens, and audit trails to enforce least privilege and meet regulatory requirements.
Data Retention for AI Agents in Regulated Industries
Guidance on AI agent log retention across healthcare, finance, and EU/US law—recommended retention periods, privacy controls, and centralized compliance practices.
Best Practices for Agent-to-Agent Authentication
Secure AI agent interactions with unique identities, short-lived tokens, mTLS, OAuth client credentials, and continuous monitoring for audit and compliance.
Audit Trails in CI/CD for AI Agents (Checklist)
A 12-point checklist for audit trails in CI/CD pipelines running AI agents, covering setup, logging, compliance mapping and secure log retention.
Securing AI Agents with Role-Based Delegation
Secure AI agents with scoped, short-lived roles and RFC 8693 delegation tokens, enforcing least privilege, RBAC+ABAC, audit trails, and centralized governance for compliance.
MCP Security: Dynamic Authorization Explained
How MCP uses OAuth 2.1, resource indicators, and short-lived scoped tokens to give AI agents fine-grained, auditable access while supporting compliance.
How MCP Secures Human-to-Agent Delegation
Tie AI agent actions to verified users with scoped, short-lived tokens, audit trails, and HITL approvals to prevent over-permissioning and token misuse.
MCP Security for Multi-Tenant AI Agents: Explained
Secure multi-tenant AI agents with MCP using tenant-specific IDs, short-lived tokens, encryption, and audit trails; covers isolation, auth, and governance.
How MCP Enhances Audit Trails for Agent Authentication
How MCP gives AI agents unique identities and uses OAuth 2.1+PKCE while Prefactor adds real-time, context-rich audit trails for compliance.
Ultimate Guide to Non-Human Identity Risk Mitigation
How to inventory, secure, rotate, and monitor machine identities—API keys, service accounts, and AI agents—to enforce least privilege and reduce breach risk.
PKCE in OAuth for AI Agents: Best Practices
Guide to PKCE for AI agents: generate S256 verifiers, enforce PKCE server-side, use short scoped tokens, validate redirects, and monitor PKCE flows.
Regulatory Standards for AI Agent Identity
Assign cryptographic identities to AI agents, enforce time-limited least-privilege access, and maintain auditable logs to meet GDPR, HIPAA, and NIST requirements.
Real-Time Agent Logging with MCP
Structured JSON logs, correlation IDs, and Prefactor audit trails for secure, real-time agent monitoring, debugging, and compliance.
How MCP Enhances AI Agent Security in Multi-Cloud
Standardize AI agent identity, scoped tokens, and real-time policy enforcement across AWS, Azure, and GCP; Prefactor automates token workflows and audit trails.
How MCP Secures Agent Identity Lifecycle
Secure AI agent identities with MCP and Prefactor using OAuth/OIDC, scoped provisioning, automated credential rotation, continuous monitoring, and instant revocation.
AI Agent Identity Lifecycle: Best Practices
Treat AI agents as first-class identities: enforce least-privilege provisioning, short-lived tokens, CI/CD automation, continuous monitoring, and secure deprovisioning.
Granular Access Control with MCP
How MCP uses OAuth 2.1, scoped tokens, and policy-as-code to enforce least-privilege access for AI agents, multi-tenant apps, and CI/CD workflows.
CI/CD Integration for AI Agents: Q&A
Explore the complexities and security challenges of integrating AI agents into CI/CD pipelines, along with best practices for effective management.
Ultimate Guide to Multi-Tenant AI Systems
Explore the complexities of multi-tenant AI systems, focusing on security, identity management, and compliance challenges.
How to Secure MCP Servers with OAuth 2.1 in FastAPI
Learn how to implement OAuth 2.1 authentication for MCP servers in FastAPI. Step-by-step guide for securing remote AI applications.
Model Context Protocol: Setup and Implementation
Learn how to implement the Model Context Protocol for secure, automated authentication between AI agents and systems, enhancing compliance and efficiency.
Solving AI Agent Scalability Issues
Explore effective strategies for managing the identity lifecycle of AI agents, ensuring security, compliance, and scalability in dynamic environments.
AI Agent Security Checklist for CTOs
Explore essential security strategies for AI agents, focusing on identity management, authentication, risk controls, and compliance.
How to Secure AI Agent Authentication in 2025
Explore essential strategies for securing AI agent authentication in 2025, focusing on unique credentials, JIT access, and compliance standards.
5 AI Agent Access Control Best Practices (2026)
82% of organisations run AI agents but only 44% have security policies for them. Get 5 practices covering identity, least privilege and audit trails.
How to Build Custom Consent Screens for AI Agents Handling Sensitive Data
Learn how to build sophisticated consent screens that explain AI agent actions clearly. Discover advanced authorization patterns beyond basic authentication
How to Handle Dynamic Client Registration for AI Agents That Spawn and Terminate Automatically
Learn why AI agents need device-like Dynamic Client Registration, not application-style permanent registration. Discover how Prefactor's DCR handles ephemeral agent lifecycles automatically.
How to Build a Security-First MCP Architecture: Design Patterns and Implementation
Architectural patterns for building inherently secure MCP systems, including zero-trust principles, defense in depth, and secure by design approaches for AI agents.
Why Traditional API Security Fails with MCP and What to Do Instead
Analysis of why conventional API security approaches don't work for MCP, and new security paradigms needed for AI agent architectures and autonomous systems.
How to Secure Third-Party MCP Integrations: Atlassian, Linear, and Canva
Security framework for popular MCP integrations including Atlassian MCP, Linear MCP, and Canva MCP, covering API security and data protection strategies.
What Security Controls Should You Implement for Enterprise MCP Deployments?
Enterprise-grade security checklist covering network security, data governance, compliance requirements, and audit trails for large-scale MCP deployments.
How to Secure Claude Code MCP Integrations in Production
How to secure Claude Code MCP integrations in production with scoped access, runtime controls, and auditable tool permissions.
Where MCP Security Breaks: Common Attack Vectors and Prevention
Analysis of common MCP attack patterns including prompt injection, privilege escalation, and data poisoning, with prevention strategies.
Why MCP Inspector is Essential for Security Testing and Validation
Deep dive into using MCP Inspector for security testing, vulnerability discovery, and protocol validation, with practical testing scenarios.
What Are the Critical MCP Security Risks Every Developer Must Know?
Model Context Protocol (MCP) introduces unique security challenges that traditional API security doesn't address.
Claude x Canva Remote MCP server demo
Live demo showing how to connect Cursor to Canva using Remote MCP — enabling secure agent access across tools.
Prefactor x Claude Remote MCP server demo
Live demo showing how to connect Cursor to Canva using Remote Model Context Protocol (MCP) — enabling secure, agent-driven access between tools.
MCP vs AI Agents: What’s the Difference?
Learn the difference between Model Context Protocol (MCP) and AI agents — and how MCP provides the access and security layer that agents need to function safely.
What Is an MCP Gateway?
Learn what an MCP Gateway is, how it fits into the Model Context Protocol stack, and how it simplifies secure agent access to APIs.
What’s the Difference Between an MCP Server and MCP Client?
Understand the difference between MCP servers and MCP clients — and how they work together to enable secure access for AI agents and automated systems.
-hero.png)
Top 10 MCP Security Risks (and How to Avoid Them)
MCP (Model Context Protocol) opens the door to powerful agentic AI — but also introduces serious security risks. Here are the top 10 vulnerabilities in MCP deployments, and how your team can defend against them.
What Is MCP — and Why Is Everyone Talking About It?
Learn what Model Context Protocol (MCP) is, why it's suddenly everywhere, and what it means for the future of AI agents, APIs, and secure access.
MCP vs LLM: What’s the Difference?
Understand the difference between Model Context Protocol (MCP) and Large Language Models (LLMs) — and how they interact in AI-powered systems.
Top 10 Agent Integrations to Add to Your SaaS
Ten high-value agent integrations that show where identity, delegation, and runtime control start to matter for SaaS teams.
-hero.png)
How to Implement MCP Authentication (Step-by-Step Guide for SaaS apps)
Learn how to implement MCP authentication for AI agents using scoped delegation, agent identity, and signed access tokens. This guide covers token generation, validation, and best practices for MCP login support in SaaS and AI-native apps.
Beyond the Prompt: Securing Agent Behavior, Not Just Access
Securing agent behaviour
The Compliance Conundrum: Auditing Autonomous Agent Actions
Auditing Autonomous Agent Actions
Security Risks in the Age of Autonomous Agents: Beyond Traditional Secrets Management
Beyond secrets management
How to Design Identity for AI Agents, Not Just Humans and APIs
A practical framework for designing identity around AI agents, delegated access, and runtime accountability.
Why M2M Tokens Aren’t Enough for Agent-Based Systems: Beyond Static Credentials
M2M tokens aren't enough
Service Accounts Are Failing in the Age of Agent Identity
Why service accounts break down for AI agents, and what an agent-first identity model needs to support.
From Static to Dynamic: What Agent Identity Actually Looks Like
What dynamic agent identity looks like in production, from short-lived credentials to revocation and auditability.
Zero Trust for Agents: What It Actually Looks Like
Zero Trust for Agents
Designing a DSL for Agent Access Control
Why agent access control needs a policy language teams can version, review, and enforce across runtimes.
Impersonation ≠ Delegation: Don’t Let Agents Spoof Your Users
How to stop AI agents from spoofing user identity by enforcing explicit delegation, scoped access, and auditable actions.
Agent Identity 101: Why Naming, Scoping, and Lifecycle Matter
A practical introduction to agent identity: naming, scoping, ownership, and lifecycle controls for non-human actors.
How to Secure Agents Acting on Behalf of Users
Securing agents acting as humans
Autonomous Agents Create a New Identity Challenge
Why autonomous agents break assumptions behind traditional identity systems, and what teams need instead.
Your Customers' AI Agents Need to Log In—Is Your SaaS Ready?
Is your saas ready for agents?
Compare Agent Authentication Solutions
How to compare agent authentication platforms by delegation, runtime control, auditability, and developer ergonomics.
What Most Companies Get Wrong About Non-Human Identity Management
Common mistakes teams make with non-human identities, and what changes when AI agents become first-class actors.
-hero.png)
How to Manage Non-Human Identities Before They Manage You
How to manage non-human identities with ownership, scoping, rotation, and lifecycle controls once AI agents enter production.
-hero.png)
What Are Non-Human Identities in AI Agent Systems?
A clear definition of non-human identities, how they differ from service accounts and bots, and why AI agents make them harder to manage.
Authentication vs. Authorization: Understanding the Key Differences
Authentication vs authorization
How to Secure AI-Assisted Vibe-Coded Applications
The main risks in AI-assisted vibe-coded applications, plus practical controls for authentication, authorization, and agent safety.