Software Engineer
Gregory is a senior engineer with 26 years of experience building at the leading edge of the industry, with roles spanning IBM, Ooyala, Facebook, DoorDash, and now OpenAI. His work has consistently landed in the space before a category exists — early video infrastructure, systems at hyperscale, and the messy, high-ambiguity problems that eventually turn into products.
He is currently building the next generation of AI systems at OpenAI.
Model-generated code has to run somewhere, and the choice of isolation sets your blast radius. This page compares containers, microVMs, WebAssembly, and hosted sandboxes on startup latency, filesystem and network scope, credential exposure, and operational cost, then states which one each workload profile actually needs.
Keep a fan-out agent inside provider rate limits by bounding concurrency with a worker pool, tracking both the request-per-minute and token-per-minute axes, honouring the Retry-After header on every 429, and adding randomised jitter so retrying workers do not resynchronise into the burst that triggered the limit.
Durable execution persists the position of a running workflow so a crash resumes from the last completed step rather than restarting the sequence. It is bought with a determinism constraint on workflow code, configured per activity for retries and timeouts, and is worth adopting only when losing a run midway is unacceptable.
Cost attribution for agents means tying every model call back to the unit of work that triggered it. It is a tracing problem: propagate a task identifier into each call, record it as a span with token counts and cost, and account for cached input tokens separately from uncached ones.
Filesystem and process isolation alone does not stop an agent from exfiltrating data, because one outbound request is enough. Default-deny egress with a host allowlist, DNS included, enforced outside the sandboxed process, plus short-lived narrowly scoped credentials, fixes more risk per hour of work than a stronger isolation tier.
A golden set gives a stable, auditable score but costs human effort to build and maintain; a model judge scales to any volume while adding a second non-deterministic system that needs its own validation. Use a small golden set to calibrate the judge, then let the judge cover the rest.
Long-running hosts suit agents better on most axes: they bill for machines rather than wall-clock idle, impose no turn deadline, keep model connections and state warm across turns, and absorb bursts without cold starts. Serverless wins for short, bounded, spiky tool calls where per-account concurrency throttling is acceptable.
CI for a non-deterministic system works when you stop asserting on exact output. Assert on properties that survive rephrasing, run each input several times, and gate on a pass rate against a tolerance the product owner sets. Temperature zero narrows variance but never removes it, so design for spread.
An agent can provision a working Cloudinary environment mid-session by running one unauthenticated npx command, which writes credentials to a local env file and prints a claim URL. The environment expires after 24 hours unless a person claims it, and claiming keeps the same credentials, so nothing written against it needs rewriting.
A resource an agent creates on a user's behalf expires unless a person claims it. Cloudinary's provisioned product environment deletes itself 24 hours after creation, and claiming requires an email address plus a confirmation from that mailbox, so an unattended run leaves lost work rather than orphaned assets and silent billing.
A claimable Cloudinary environment locks media delivery to the public IP that ran the provisioning command. Uploads and transformations still succeed, so the failure surfaces only when a browser on another machine, or a preview deployment, requests the asset. Pass extra addresses at provisioning time, or claim the environment to remove the restriction.
Metered vendor billing charges a single unit against several different resources at once. With Cloudinary, one credit buys 1,000 transformations, 1 GB of storage, or 1 GB of delivered bandwidth. Agent-driven work exhausts whichever axis it touches, and transformation and bandwidth totals keep counting for thirty rolling days.
Cloudinary's agent account-creation endpoint accepts an unauthenticated POST because an agent setting up a new user has no credentials to send. It returns account details, product environment credentials and a machine-readable next-steps block, but those credentials stay inert until the human recipient verifies the account by email and sets a password.
A freshly issued credential belongs in a local environment file that version control already ignores, never in the conversation, which is copied into logs and evaluation sets by default, and never in a client-side bundle. Display-time redaction is cosmetic once the value is on disk, so find the vendor's rotation call before you need it.