Notes on Infrastructure AI|Cloud|Security|Networking
Field notes and practical guides from Sebastian Maniak — gateways, agents, Kubernetes, and the systems that keep production running.
How To: Per-Key Token Budgets in agentgateway 1.5.0 — Configuring Budgets, Token Costs, and Models
Virtual API keys have always answered two governance questions well: who is calling and which models are they allowed to reach. They never answered the third one — the one finance actually asks: How much can this key …
Read article →Latest writing
View the full archive →One Front Door for Every Tool: MCP Multiplexing Through agentgateway
Here is a problem you don’t have with one MCP server, and can’t avoid with six. You wire up an MCP server for your firewall so an agent can read …
The After-Hours Kill Switch: Daytime Claude, Nighttime Grok, One CEL Expression
Here’s a decision every team using premium models eventually faces, usually after reading a bill: the expensive model is worth it during the workday, and …
The Art of the Possible: Governed Sandbox Agents, and an Arista Operator That Can't Go Rogue
Ask a network engineer if they’d let an AI run commands on their production fabric and you’ll get a very short answer. The instinct is correct: a …
How To: Build an AWS Budget SandboxAgent on kagent + Agent Substrate
I already wrote the why — why secure sandbox substrates are the future. This one is the how. Same agent, but from the build side: every object you apply, where …
A GCP Budget SandboxAgent on kagent — and the Value of an Agent That Says "Unavailable"
This is the GCP sibling of my AWS budget SandboxAgent: a gVisor-isolated agent that answers What’s our us-east1 spend this month, and are we over …
A ServiceNow Triage SandboxAgent on kagent — Where Write Tools Belong
Every ITSM demo I’ve ever sat through answers “how many tickets are open.” That’s a COUNT(*). The actual manager question is harder: …