Go One Layer Deeper

One ordinary line of code, expanded downward. Every layer names what it hides for you, how it fails, and where to learn it properly. Descend as far as the problem requires — and stop.

await fetch('/api/users')SELECT * FROM users WHERE email = 'alice@exa await userRepository.save(user)$ git push # …and it is live agent.run("refund the duplicate charge for o await auth.signIn(email, password)await stripe.charges.create({ amount: 4990 }open('out.txt', 'w').write(data)items.sort((a, b) => a.score - b.score)

One agent tool call, all the way down

Depth

A sentence of natural language that ends in a real state change: money moves, a row is written, an email is sent. Every layer between is a place where authority must be checked rather than assumed.

1agent.run("refund the duplicate charge for order 8841")

1/10 layers · Enough to build

Why should an application engineer care?

The model is not the authorization layer. Everything an agent can do, it can be persuaded to do — so the interesting question is never "will it behave" but "what is it permitted to reach".

The question this ladder asks

Do you understand what the agent is allowed to do?

What are you delegating to an llm or coding agent? →

Where this goes wrong in production

Untrusted document in context↓
Model treats it as instruction↓
Tool call with real authority↓
State change nobody approved

The lesson behind it →

What are you delegating here?

What are you delegating to an llm or coding agent?

Agentic AI

You write

1"Add retries to the payment call and make it robust."

The abstraction handles

✓Producing a plausible implementation in seconds
✓Recalling APIs, idioms and boilerplate you would otherwise look up
✓Explaining unfamiliar code, tools and error output
✓Drafting tests, docs, migrations and runbooks
✓Exploring alternatives faster than you could type them

Still your responsibility

→Verification — whether the plausible solution is correct under concurrency, failure and load
→The problem statement — the constraint it should optimise for, which it cannot guess
→The failure mode it ignored — a retry without an idempotency key looks robust and double-charges
→Security and blast radius — what the generated code can reach, with whose credentials
→Debugging without it — when it is wrong, down, or confidently repeating the same fix

Know your escape hatch

When: The output is wrong in a way you cannot articulate, or the model keeps proposing the same non-fix.

Drop to: Your own engineering knowledge: the fundamentals that let you read the trace, the plan, the packet, the stack.

This is the whole point of the principle. The LLM amplifies what you bring; it cannot supply what you lack, and neither can you tell when it did not.

Tool calling basics Evaluation: measuring, not vibes Tool permissions and least privilege Tracing agents