Home/Building reliable tool using agents on awsA tool-using agent is easy to demonstrate and difficult to operate. In a demo, the model identifies an intent, calls an API, receives a result, and responds. In production, the user may be unauthorized, the API may time out, the requested action may be irreversible, the tool description may be ambiguous, the result may contain untrusted instructions, and the model may decide to retry in a loop.On this pageDesign tools as business capabilitiesGovern agent tool access with gatewaysSeparate agent identity from user identityLeast privilege…

Home/Data governance for rag pipelines that touch sensitive informationRetrieval Augmented Generation can turn an ordinary document repository into an interactive knowledge system. It can also turn a poorly governed repository into a faster path to sensitive information. Once documents are parsed, chunked, embedded, indexed, retrieved, logged, and evaluated, the data exists in more forms and more places than the original source alone.On this pageClassify data before RAG ingestionTreat chunks and embeddings as sensitiveProtect prompts and generated outputsManage data freshness and deletionCitations do not establish authorizationControl agent tools and actionsCross-cloud RAG…

Home/Why genai testing needs adversarial casesA generative AI system can pass every happy-path test and still fail the first week it meets real users. Normal functional testing asks whether the application responds correctly to expected inputs. Adversarial testing asks what happens when the input is confusing, manipulative, malicious, incomplete, contradictory, or deliberately constructed to push the system outside its intended behavior.On this pageHappy-path data teaches teams the wrong confidencePrompt injection should be a standard regression categoryTest data exfiltration and privacy boundariesAgents need tests for excessive actionAdversarial cases should target cost…

Home/Event driven genai where serverless fitsGenerative AI applications are often introduced as a simple synchronous path: a user sends a prompt, an application calls a model, and the answer returns. That pattern matters, but it is only one slice of a production system. Real applications ingest documents, create embeddings, enrich records, run evaluations, generate long-form assets, moderate outputs, fan work out to tools, notify users, and retry failed steps. Those activities do not all belong inside the request that is waiting for a browser spinner.On this pageStart by separating interactive…

Home/Ci cd for prompts models and ai logicTraditional CI/CD assumes that most important behavior is represented by source code and configuration. Generative AI complicates that assumption. A production response can change because someone edits a prompt, switches a model, changes retrieval parameters, modifies a guardrail, updates a tool schema, changes an embedding model, or refreshes the data behind a knowledge base. None of those changes has to involve a conventional code commit, yet each can alter what users experience.On this pageThe deployable unit is a behavior bundlePrompts need versioning because…

Home/Tracing hallucinations across the generation pipeline“The model hallucinated” is a symptom report, not a diagnosis. In a production application, an unsupported answer can originate far upstream from the foundation model. The user question may have been rewritten incorrectly. Retrieval may have returned the wrong document. A metadata filter may have hidden the right source. The prompt may have truncated a key exception. A tool may have returned stale data. Post-processing may have attached a citation to a sentence the source never supported.On this pageReproduce the exact request before changing anythingCheck…

Home/Fine tuning or better retrievalWhen a generative AI application gives weak answers, fine-tuning is an attractive response because it sounds like improvement at the model itself. Sometimes that is exactly what the system needs. Often it is not. A model that cannot see the current refund policy, customer entitlement, product specification, or internal procedure does not necessarily need new weights. It may simply need the right evidence at inference time.On this pageUse retrieval for changing knowledgeFine-tuning is stronger when the problem is behaviorAvoid fine-tuning volatile factsBad retrieval can look like…

OSPF is easy to understand in a small lab. Routers discover neighbors, exchange link-state information, build a shared view of the topology, run shortest-path calculations, and install routes. That model is correct, but enterprise networks expose the parts the lab hides: the cost of flooding, the size of the link-state database, the impact of topology churn, the location of summarization boundaries, and the operational consequences of redistribution. Home/Cisco/Cisco 350-401: OSPF at Enterprise ScaleCiscoPublished October 3, 2026 On this page Scale OSPF through area design Areas are control-plane boundaries, not just…

BGP is often taught through route exchange: establish a neighbor, advertise prefixes, learn alternatives, and let the best-path algorithm choose. That is mechanically correct, but it hides the protocol’s real character. BGP exists to express routing policy between administrative domains and, in many enterprises, to express policy at the edge of the organization. The route is the object being carried; the attributes are how intent travels with it. Home/Cisco/Cisco 350-401: BGP Makes More Sense as PolicyCiscoPublished October 3, 2026 On this page Separate BGP reachability from routing policy Local preference…

Traditional campus segmentation is closely tied to topology. A VLAN belongs to a set of access ports, a subnet belongs to that VLAN, an ACL is attached somewhere in the path, and moving a user or device can mean extending Layer 2 or redesigning policy. That model works, but it couples identity, reachability, and enforcement to where the endpoint happens to connect. Home/Cisco/Cisco 350-401: Campus Fabric Changes SegmentationCiscoPublished October 3, 2026 On this page Traditional segmentation mixes several jobs together Virtual networks provide macro-segmentation Scalable group tags within virtual networks…

VXLAN and LISP are often introduced together in Cisco SD-Access, which makes it easy to blur their jobs. They solve different problems. VXLAN is primarily the data-plane encapsulation that carries endpoint traffic across the routed fabric. LISP is used by the fabric control plane to map endpoint identities to the routing locators that can reach them. One moves packets; the other helps the fabric know where those packets should go. Home/Cisco/Cisco 350-401: Why Enterprise Fabrics Need VXLAN and LISPCiscoPublished October 3, 2026 On this page Routed underlay connects fabric nodes…

Quality of Service is often described as a way to make important traffic “faster.” That wording creates the wrong mental model. QoS does not increase link capacity and it cannot make a propagation path shorter. When there is no contention, most packets should move through the device without waiting for a sophisticated policy to help them. QoS matters when demand exceeds a constrained resource and the network has to decide what waits, what gets priority, what gets delayed deliberately, and what gets dropped. Home/Cisco/Cisco 350-401: QoS Manages Congestion, Not SpeedCiscoPublished…

Putting two routers in a rack does not make a service highly available. It creates the possibility of surviving one class of hardware failure. The service still depends on power, links, routing, first-hop behavior, software state, upstream providers, configuration correctness, change procedures, and the time it takes the system to detect and recover from failure. If any of those elements has a single fragile dependency, the redundant box can become a comforting decoration. Home/Cisco/Cisco 350-401: High Availability Is a System PropertyCiscoPublished October 3, 2026 On this page Availability begins with…

Wireless networks are easy to draw and surprisingly hard to design. A floor plan can make access-point placement look like a coverage exercise, but usable Wi-Fi depends on radio-frequency behavior, client capabilities, airtime demand, interference, roaming, channel reuse, power levels, and the wired services behind the radios. Counting access points before understanding those variables reverses the design process. Home/Cisco/Cisco 350-401: Wireless Design Starts With RFCiscoPublished October 3, 2026There is also an important certification-context change for engineers who learned wireless through the Cisco CCNP Enterprise core. Cisco states that wireless content…

Python becomes valuable to a network engineer long before the engineer starts building a large automation platform. A few dozen lines can collect interface state, compare configurations, normalize inventory, validate routing neighbors, or generate a change plan. The danger begins when a useful read-only script is promoted into a write tool without adding the controls that production changes require. Home/Cisco/Cisco 350-401: Python for Network Engineers: Automate, Then VerifyCiscoPublished October 3, 2026For engineers following the Cisco CCNP Enterprise path, Cisco’s current Cisco 350-401 ENCOR blueprint still expects engineers to interpret basic…