The time saved writing gets spent reading
DORA names the verification tax, four interns price an agent's context, and eight malicious scripts run on storefronts that every scanner called clean.
How we Organise
The hours came off the writing and went onto somebody else’s desk
DORA’s researchers read 1,110 open-ended answers from Google engineers about how AI had changed their work. Every one of the ten uses they found showed more speed. Every one also showed more checking. They give the pattern a name, the verification tax, and then say where the bill lands: velocity gains for an author translate into significantly increased cognitive load for the reviewer. An author can now produce a large change in minutes. The person who has to read it cannot read any faster than before.
We tell a client that the person who knows the business is the bottleneck, and that everyone else can fill their day without asking. Our practice says it plainly:
The scarcest input to the work is the domain expert’s attention, and it is the one thing everybody else can still book over.
Until today that was a claim about calendars. Now there is a mechanism underneath it. Only the writing side got a tool that multiplies what one person produces, so the queue forms on the side that did not. Two limits are worth holding. These are Google engineers on a mature internal platform, which is the best case rather than the average, and nobody has timed a senior engineer to say how many hours actually go this way, so the direction is often clearer than the amount.
How we Build
Half the tries, and the saving came out of somewhere
Four interns built a public MCP server for Vespa Cloud and then asked whether it beat handing the assistant a terminal. They designed each tool around what an agent could hold. The log tool caps its answer at a fixed size, drops the oldest events when it overflows, and offers a switch between a summary and raw lines. On pass rates the two approaches were indistinguishable, 97 per cent against 95. On attempts they were not: agents with the server needed under half the tries before a deploy worked. Their own reading of the cost is the part worth having, because every tool description sits in the context on every turn whether it is called or not. They describe two ways of spending one budget, up front on structure or afterwards on recovery.
Our view is that an agent’s context is something a team decides in advance rather than something it inherits:
What an agent is given is a budget, not a bill of materials.
A team that built both sides found the budget could not be dodged. It moved. That is the first measurement we have seen of it, and note where the effect showed up, because the pass rates hid it entirely and only the retry counts carried it. This is one product, one protocol and a summer project, graded in part by another model against a rubric the authors wrote themselves, so the size of the gap may not carry to a larger estate.
How we Assure
Seven of eight live payloads were unknown to the database everyone checks
Cloudflare found four operations running on retail storefronts, eight scripts in all, caught by a model reading the JavaScript as a structure rather than matching known bytes. Seven were absent from VirusTotal. URLScan had a verdict on none of them, and had carried one for nearly two and a half years marked as unclassified, through a direct scan. The scripts were written to wait. One checked device, country, time, referrer and browser state before doing anything, then slept for three days on that machine. Another switched off nine monitoring tools and carried a list of 325 IP fragments to avoid.
We ask a client to put everything it runs on a register, with an owner and a severity against each line:
Everything this team runs is on the risk register with a named owner and a severity.
The register is assembled from what people declare. What executed in these shoppers’ browsers was not declared by anyone, and the ordinary way of looking found nothing wrong with seven of the eight. A firm could have shown a complete register that morning. Cloudflare is describing what its own product caught, the comparison is theirs, and eight payloads are a sample of nothing. Tell us where we have this wrong, at transform@dromologue.ai.