Thank you for being part of over 70,000+ ML professionals and enthusiasts who receive weekly articles & tutorials on Machine Learning & MLOps 🤖 You can join the newsletter /newsletter/ ⭐

If you like the content please support the newsletter by sharing with your friends via ✉️ Email, 🐦 Twitter, 💼 Linkedin and 📕 Facebook!

This week in ML Engineering:

Agentic Security & Identity, Part 1

What should your AI agent be allowed to do on your behalf? Excited to share new 2-part series on agentic identity & security using the Kubernetes Agent OS (KAOS) and the new OSS Zalando Agentic Identity Broker!

Agent identity gets really complicated once you want to give a remote agent permissions to act on behalf of real people across tools, APIs, and other agents. We now need to not only answer the question of "Who's the authenticated user?. We also need to know "Who's this agent?" and "What should this agent be allowed to do on this user's behalf?".

Establishing the control plane and application layer to answer those questions involves not just architectural choices, but also philosophical ones. In Part 1 here I share the design decisions I made while adding agent identity and authorization to KAOS, including how to separate the human subject from the agent actor, where policy enforcement should happen, and how delegated third-party access should work.

The timing worked out prefectly, because at Zalando we have just open sourced the Agentic Identity Broker! This is the bridge between Agentic Identity and Enterprise Policy decisions to process real third-party credential delegation for agents to execute on user's behalf across services like GitHub, Databricks, Google, etc.

Stay tuned for Part 2 next week, where I run the whole thing end to end on a cluster, with hands-on examples for allow and deny paths!

Uber on Taming the ML Firehose

Uber Eats ranking models serve 8 million predictions per second. They have build an impressive flywheel for training data from their inference pipelines, and they shared their learnings:

Uber got rid of the training/serving skew in their recommendation models by logging features at inference time. If they had logged every feature this would come at around 1.7 PB a day so that is not an option.

Instead of rebuilding features offline through a set of fragile ETL jobs, they now log the values the model actually saw and use those as the source of truth for training.

Only ~5% of scored candidates ever become impressions on someone's phone, so they join predictions with impression events in Flink and keep only what was shown; feature allow lists and integer aliases for feature names cut the payload a further 4-5x.

I found interesting how they handle state management, as the default Flink checkpointing didn't hold up at this scale, with RocksDB checkpoints growing by over 12 TB an hour, so instead they built their own state handling with aggressive eviction.

They report mismatch on key features going from over 10% to 0%, and freshness going from days to hours. For production ML practitioners this is a great case for logging features at serving time instead of trying to recompute them perfectly offline, as long as you budget for the streaming infrastructure it needs.

Distilling the Agent Harness Away

What if the agent harness could be trained into the model itself, instead of shipping alongside it at runtime? Peking University, Google and HKUST published a study that proposes distilling what a specialised harness does into the model weights.

In this case, the harness gains stay tied to the harness you deploy, so they only use the optimised harness at training time. Basically, a reviewer agent holding a private copy of it checks every step of a small student model, and either passes it or replaces it with the smallest correction the student could have written itself.

Those corrected runs become the SFT data, and the student is deployed with nothing but a minimal Bash-only harness. On a Qwen3.5-9B student they report task success going from 23.3% to 44.3%, beating the same model with the full specialised harness attached (41.7%); generic harnesses like Claude Code actually made the 9B model worse.

From the learnings they share that it needs a capable reviewer model, and on retrosynthesis the student still trails the full harness, as procedural behaviour turns out to be easier to internalise than domain knowledge.

It is interesting to see the harness becoming a source of training data, and I'd expect quite a lot more of this.

China's AI Safety Framework 3.0

China published their AI Safety Governance Framework 3.0, and as a reviewer for the OWASP Agentic Security project I have to say I'm impressed with how well it covers the real vulnerabilities behind the growing risks of agentic systems.

This third edition is reorganised around the claim that AI is moving "from 'answering questions' toward 'performing tasks'".

It's really interesting to see that it settled frontier evaluation findings as policy facts; namely taking quite seriously the reports from the OpenAI hacks, although the only sources given are "industry reports".

For practitioners the most useful part is Appendix 2, as it's a 14-page agentic AI threat model covering prompt injection hidden in documents and emails, context overflow attacks, tool poisoning and memory pollution, and even decommissioning (agents shut down with their service accounts and API permissions still live), which I rarely see in government papers.

There are also some new risk areas, like social networks for agents and "GEO poisoning", where brands mass-publish content so models end up citing it "in the guise of seemingly objective AI-generated answers".

Appendix 2 is definitely worth running as a checklist against your own agent platform!

Diogo Almeida on Why RLHF Underdelivers

Diogo Almeida, co-author of RLHF and ChatGPT and now behind TypeSafe's Jev model, gave a talk at AI Council on the philosophy behind it:

His argument is that benchmarks keep saturating while the economic impact lags, because almost every production LLM is optimised for assistance with a human in the loop. RLHF trains on human preference, and its mode collapse pushes models toward answers that look plausible, which is a different objective from making calibrated decisions.

That is why customer support bots answer questions but are never allowed to take actions, and he even puts coding agents on the assistance side, as you wouldn't trust one without version control. His advice for today's LLMs is blunt: "Don't make decisions with stakes."

The talk reads as the design brief for Jev, which we covered last week: you hand it a situation and questions with fixed allowed answers, and it returns one calibrated answer each. He wants LLMs to become a primitive "more like databases and APIs" than a co-worker, and with six clones in the first two days it is clear the idea struck a nerve!

Upcoming MLOps Events

The MLOps ecosystem continues to grow at break-neck speeds, making it ever harder for us as practitioners to stay up to date with relevant developments. A fantsatic way to keep on-top of relevant resources is through the great community and events that the MLOps and Production ML ecosystem offers. This is the reason why we have started curating a list of upcoming events in the space, which are outlined below.

You can also find our upcoming events and past talk recordings on the talks and events page.

Events we are speaking at this year:

Other relevant events:

In case you missed our talks, check our recordings below:

Open Source MLOps Tools

Check out the fast-growing ecosystem of production ML tools & frameworks at the github repository which has reached over 20,000 ⭐ github stars. We are currently looking for more libraries to add - if you know of any that are not listed, please let us know or feel free to add a PR. Here's a few featured open source libraries that we maintain:

  • SARC - Provides wrappers for popular agentic frameworks to enable guardrails and constraints that are enforced through the flow.
  • KAOS - K8s Agent Orchestration Service for managing the KAOS in large-scale distributed agentic systems.
  • Kompute - Blazing fast, lightweight and mobile phone-enabled GPU compute framework optimized for advanced data processing usecases.
  • Production ML Tools - A curated list of tools to deploy, monitor and optimize machine learning systems at scale.
  • AI Policy List - A mature list that maps the ecosystem of artificial intelligence guidelines, principles, codes of ethics, standards, regulation and beyond.
  • Agentic Systems Tools - A new list that aims to map the emerging ecosystem of agentic systems with tools and frameworks for scaling this domain

Please do support some of our open source projects by sharing, contributing or adding a star ⭐

About us

The Institute for Ethical AI & Machine Learning is a European research centre that carries out world-class research into responsible machine learning.

Check out our website

✉️ Email, 🐦 Twitter, 💼 Linkedin