Product notes, engineering deep-dives and playbooks from the team building the AI Operating System.https://velabios.com/enhttps://velabios.com/blog/the-animation-that-hid-our-content/https://velabios.com/blog/the-animation-that-hid-our-content/A reveal effect and the observer meant to trigger it deadlocked each other. The bug was invisible in dev, total in production, and obvious in hindsight.Sat, 25 Jul 2026 00:00:00 GMTcssjavascriptdebuggingweb performancestoryhttps://velabios.com/blog/the-audit-that-measured-nothing/https://velabios.com/blog/the-audit-that-measured-nothing/I grepped a file to check for missing data, found the problem, and reported it. The strings I counted didn't exist. What I built instead was better.Sat, 25 Jul 2026 00:00:00 GMTtestingcode qualitydebuggingcraftstoryhttps://velabios.com/blog/the-demo-search-engines-couldnt-see/https://velabios.com/blog/the-demo-search-engines-couldnt-see/Eleven interactive apps, a guided tour, thousands of lines of React — and a crawler that received 76 words. One directive was the difference.Sat, 25 Jul 2026 00:00:00 GMTseojavascriptastrorenderingstoryhttps://velabios.com/blog/the-redesign-we-deleted/https://velabios.com/blog/the-redesign-we-deleted/Four phases of work, reverted in one message. Why that was the right call, what made it expensive, and the cheaper way to be wrong.Sat, 25 Jul 2026 00:00:00 GMTdesignprocesscraftdecision makingstoryhttps://velabios.com/blog/ai-agent-memory/https://velabios.com/blog/ai-agent-memory/Context windows aren't memory. The four tiers a working agent needs, why summarising too early destroys runs, and how to stop context rot.Fri, 24 Jul 2026 00:00:00 GMTai agentsmemorycontextarchitectureengineeringhttps://velabios.com/blog/ai-agent-security-best-practices/https://velabios.com/blog/ai-agent-security-best-practices/The threat model isn't a rogue AI — it's an agent doing exactly what an attacker's email told it to. Practical controls, in the order they matter.Fri, 24 Jul 2026 00:00:00 GMTsecurityai agentspermissionsengineeringhttps://velabios.com/blog/ai-agent-use-cases/https://velabios.com/blog/ai-agent-use-cases/A grounded map of what AI agents are genuinely good at today, the tasks they quietly fail, and the property that separates the two.Fri, 24 Jul 2026 00:00:00 GMTai agentsuse casesautomationcategoryhttps://velabios.com/blog/automate-inbox-triage-with-ai/https://velabios.com/blog/automate-inbox-triage-with-ai/A working triage setup: what to classify, what to automate, what must stay manual — and the archive-don't-delete rule that makes it safe.Fri, 24 Jul 2026 00:00:00 GMTinbox zeroemailai agentstutorialhttps://velabios.com/blog/automate-meeting-scheduling-with-ai/https://velabios.com/blog/automate-meeting-scheduling-with-ai/Booking links solve the easy half. What an agent adds, the timezone and buffer rules that decide quality, and why sending the invite needs a human.Fri, 24 Jul 2026 00:00:00 GMTcalendarschedulingai agentsproductivitytutorialhttps://velabios.com/blog/astro-client-only-vs-client-load/https://velabios.com/blog/astro-client-only-vs-client-load/One Astro directive made an interactive page invisible to search engines. How to tell which you need, and how to check what crawlers actually see.Fri, 24 Jul 2026 00:00:00 GMTastroseoislandsssrengineeringhttps://velabios.com/blog/how-to-design-agent-tools/https://velabios.com/blog/how-to-design-agent-tools/Most agent failures are tool design failures. Naming, arguments, error messages, and why wrapping your REST API one-to-one produces a bad agent.Fri, 24 Jul 2026 00:00:00 GMTtool designai agentsapi designtutorialhttps://velabios.com/blog/how-to-monitor-ai-agents/https://velabios.com/blog/how-to-monitor-ai-agents/Uptime and error rates tell you almost nothing about an agent. What to trace, which four metrics actually matter, and how to alert without noise.Fri, 24 Jul 2026 00:00:00 GMTobservabilitymonitoringai agentstutorialhttps://velabios.com/blog/how-to-reduce-llm-api-costs/https://velabios.com/blog/how-to-reduce-llm-api-costs/Seven levers, ordered by how much they save per hour of work. Start with the requests you shouldn't send at all, not with a cheaper model.Fri, 24 Jul 2026 00:00:00 GMTcostllmoptimizationengineeringhttps://velabios.com/blog/how-to-test-ai-agents/https://velabios.com/blog/how-to-test-ai-agents/Assert on behaviour, not strings. Golden traces, tool-call assertions, and the adversarial cases most agent test suites never cover.Fri, 24 Jul 2026 00:00:00 GMTtestingai agentsevaluationengineeringhttps://velabios.com/blog/mcp-vs-function-calling/https://velabios.com/blog/mcp-vs-function-calling/They operate at different layers and people compare them as rivals. What MCP actually standardises, what it doesn't, and when a direct integration wins.Fri, 24 Jul 2026 00:00:00 GMTmcpfunction callingtoolsarchitecturecomparisonhttps://velabios.com/blog/migrate-from-zapier-to-ai-agents/https://velabios.com/blog/migrate-from-zapier-to-ai-agents/Not a rip-and-replace. Which Zaps to keep forever, which ones an agent handles better, and a five-step migration that never leaves you without a fallback.Fri, 24 Jul 2026 00:00:00 GMTzapierautomationmigrationai agentstutorialhttps://velabios.com/blog/oauth-token-storage/https://velabios.com/blog/oauth-token-storage/Refresh tokens are long-lived credentials to someone else's account. Envelope encryption, scoping per run, and the refresh race that corrupts them.Fri, 24 Jul 2026 00:00:00 GMToauthsecurityencryptionintegrationsengineeringhttps://velabios.com/blog/open-source-vs-proprietary-llms/https://velabios.com/blog/open-source-vs-proprietary-llms/Self-hosting looks cheaper per token and usually isn't. Where the crossover actually is, and the three reasons that beat cost either way.Fri, 24 Jul 2026 00:00:00 GMTopen sourcellmself-hostingcostcomparisonhttps://velabios.com/blog/prompt-injection-defense/https://velabios.com/blog/prompt-injection-defense/Every mitigation people reach for is probabilistic. The only controls that hold are architectural — and they assume the injection already succeeded.Fri, 24 Jul 2026 00:00:00 GMTsecurityprompt injectionai agentsengineeringhttps://velabios.com/blog/rag-vs-fine-tuning/https://velabios.com/blog/rag-vs-fine-tuning/RAG adds knowledge. Fine-tuning changes behaviour. They fix different failures, and the wrong choice is expensive in a way that isn't obvious for months.Fri, 24 Jul 2026 00:00:00 GMTragfine-tuningllmarchitecturecomparisonhttps://velabios.com/blog/rate-limiting-strategies/https://velabios.com/blog/rate-limiting-strategies/Most guides teach you to protect your API. Agents mostly consume other people's. Token buckets, jitter, and respecting Retry-After properly.Fri, 24 Jul 2026 00:00:00 GMTrate limitingreliabilityintegrationsengineeringhttps://velabios.com/blog/multi-tenant-data-isolation-postgres/https://velabios.com/blog/multi-tenant-data-isolation-postgres/Row-level security only helps if the policies are right. The failure modes that look secure in review — and the assertions that catch them.Fri, 24 Jul 2026 00:00:00 GMTpostgressecuritymulti-tenancyrlsengineeringhttps://velabios.com/blog/single-agent-vs-multi-agent/https://velabios.com/blog/single-agent-vs-multi-agent/Multi-agent architectures are fashionable and often worse. The three conditions that justify a split, and the coordination costs nobody budgets for.Fri, 24 Jul 2026 00:00:00 GMTmulti-agentarchitectureai agentscomparisonhttps://velabios.com/blog/streaming-llm-responses/https://velabios.com/blog/streaming-llm-responses/Streaming is easy until a connection drops mid-token. Backpressure, resumability, buffering proxies, and why tool calls change the whole problem.Fri, 24 Jul 2026 00:00:00 GMTstreamingssellmarchitectureengineeringhttps://velabios.com/blog/the-mascot-that-flew-backwards/https://velabios.com/blog/the-mascot-that-flew-backwards/A 3D robot flies through our homepage. Getting it to face the right way took three failed fixes and taught me to stop debugging by eye.Fri, 24 Jul 2026 00:00:00 GMTwebglthree.jsdebuggingcraftstoryhttps://velabios.com/blog/types-of-ai-agents/https://velabios.com/blog/types-of-ai-agents/Textbook agent categories don't map to anything you'd build. A more useful split by autonomy, scope, and how many steps an agent plans ahead.Fri, 24 Jul 2026 00:00:00 GMTai agentstaxonomyarchitecturecategoryhttps://velabios.com/blog/we-built-a-demo-you-can-break/https://velabios.com/blog/we-built-a-demo-you-can-break/Videos show the happy path at the vendor's pace. We shipped the real interface with fake data, and the constraint made the product better.Fri, 24 Jul 2026 00:00:00 GMTproductdemodesignstoryhttps://velabios.com/blog/webhook-idempotency/https://velabios.com/blog/webhook-idempotency/Providers deliver at least once, so your handler will see duplicates. Verify the signature, key on the event id, and do the work in one transaction.Fri, 24 Jul 2026 00:00:00 GMTwebhooksidempotencyreliabilityengineeringhttps://velabios.com/blog/what-is-an-ai-operating-system/https://velabios.com/blog/what-is-an-ai-operating-system/The full definition: the five properties, the architecture underneath, what it isn't, the hard problems nobody solved yet, and how to evaluate one.Fri, 24 Jul 2026 00:00:00 GMTai operating systemagentsarchitecturecategoryhttps://velabios.com/blog/what-is-an-ai-workflow/https://velabios.com/blog/what-is-an-ai-workflow/The middle ground between a rigid automation and a free-roaming agent: fixed steps with model calls inside them. Often the right answer, and underrated.Fri, 24 Jul 2026 00:00:00 GMTai workflowautomationarchitecturecategoryhttps://velabios.com/blog/we-deleted-our-best-marketing-stats/https://velabios.com/blog/we-deleted-our-best-marketing-stats/2.1M kg of CO₂ saved. $12M in compute costs. 200+ apps. Every one of those numbers came out of our site, and the pages got better.Fri, 24 Jul 2026 00:00:00 GMTmarketinghonestyproductstoryhttps://velabios.com/blog/what-is-retrieval-augmented-generation/https://velabios.com/blog/what-is-retrieval-augmented-generation/RAG lets a model answer from documents it was never trained on. How the pipeline works, where it breaks, and why agents lean on it constantly.Fri, 24 Jul 2026 00:00:00 GMTragllmretrievalcategoryhttps://velabios.com/blog/ai-agent-orchestration/https://velabios.com/blog/ai-agent-orchestration/Multi-agent systems fail in ways single agents don't. The patterns that hold up, the ones that don't, and when one agent is the right answer.Thu, 23 Jul 2026 00:00:00 GMTagent orchestrationmulti-agentai agentsarchitecturehttps://velabios.com/blog/ai-agents-vs-workflow-automation/https://velabios.com/blog/ai-agents-vs-workflow-automation/Zapier-style rules are deterministic and cheap. Agents handle judgement. An honest comparison of where each belongs, from people building both.Thu, 23 Jul 2026 00:00:00 GMTworkflow automationai agentscomparisonhttps://velabios.com/blog/ai-copilot-vs-ai-agent/https://velabios.com/blog/ai-copilot-vs-ai-agent/A copilot works beside you in one app. An agent works instead of you across many. The distinction is about initiative, not intelligence.Thu, 23 Jul 2026 00:00:00 GMTai copilotai agentscomparisonhttps://velabios.com/blog/build-vs-buy-ai-agents/https://velabios.com/blog/build-vs-buy-ai-agents/The demo takes a weekend. The 20% that follows takes a year. What actually costs time when you build agents in-house — and when it's still right.Thu, 23 Jul 2026 00:00:00 GMTbuild vs buyai agentsarchitecturecomparisonhttps://velabios.com/blog/chatbot-vs-ai-agent/https://velabios.com/blog/chatbot-vs-ai-agent/Both take a message and reply. Only one changes the state of your systems. Where the line actually falls, and why most 'agents' are chatbots.Thu, 23 Jul 2026 00:00:00 GMTai agentschatbotcomparisonhttps://velabios.com/blog/llm-model-routing/https://velabios.com/blog/llm-model-routing/Sending every prompt to a frontier model is the default and it's wasteful. How to classify a request first, then route it — including the fallback chain.Thu, 23 Jul 2026 00:00:00 GMTmodel routingllmcostengineeringhttps://velabios.com/blog/programmatic-seo-without-doorway-pages/https://velabios.com/blog/programmatic-seo-without-doorway-pages/We generated 600 integration pages. The difference between a page set that ranks and one that gets demoted is what varies between the pages.Thu, 23 Jul 2026 00:00:00 GMTseocontentengineeringhttps://velabios.com/blog/rpa-vs-ai-agents/https://velabios.com/blog/rpa-vs-ai-agents/RPA automates the clicks. Agents work at the API layer and handle judgement. Why brittleness, not intelligence, is the real difference.Thu, 23 Jul 2026 00:00:00 GMTrpaai agentsautomationcomparisonhttps://velabios.com/blog/transactional-email-deliverability/https://velabios.com/blog/transactional-email-deliverability/Your sign-in codes are worthless in spam. The DNS records that authenticate your domain, and why one suppression list will lock users out.Thu, 23 Jul 2026 00:00:00 GMTemaildeliverabilitydnsengineeringhttps://velabios.com/blog/what-is-agentic-ai/https://velabios.com/blog/what-is-agentic-ai/Agentic AI describes a spectrum, not a switch. The five levels from autocomplete to autonomy, and an honest account of where the technology actually is.Thu, 23 Jul 2026 00:00:00 GMTagentic aiai agentsdefinitionshttps://velabios.com/blog/what-is-an-ai-agent/https://velabios.com/blog/what-is-an-ai-agent/An agent isn't a chatbot with plugins. The four properties that separate an agent from a very good autocomplete — and the one most products are missing.Thu, 23 Jul 2026 00:00:00 GMTai agentsagentic aidefinitionshttps://velabios.com/blog/email-enumeration-attack-prevention/https://velabios.com/blog/email-enumeration-attack-prevention/Identical error messages aren't enough — response timing leaks the same secret. How to make a signup endpoint that reveals nothing about who has an account.Wed, 22 Jul 2026 00:00:00 GMTsecurityauthenticationprivacyengineeringhttps://velabios.com/blog/how-to-store-otp-codes-securely/https://velabios.com/blog/how-to-store-otp-codes-securely/A 6-digit code is only a million possibilities. Why SHA-256 isn't enough, what a server-side pepper buys you, and how to make verification atomic.Wed, 22 Jul 2026 00:00:00 GMTsecurityauthenticationotpengineeringhttps://velabios.com/blog/human-in-the-loop-approvals/https://velabios.com/blog/human-in-the-loop-approvals/Nobody wants an agent with root access. The three-tier approval model behind Velaris, why per-run scoped credentials matter, and what we refuse to automate at all.Wed, 22 Jul 2026 00:00:00 GMThuman in the loopsecurityagentstrusthttps://velabios.com/blog/how-velaris-picks-one-tool-from-a-thousand/https://velabios.com/blog/how-velaris-picks-one-tool-from-a-thousand/Tool schemas don't fit in a context window. How we treat connectors as data an agent searches at runtime, instead of stuffing 1,000 definitions into a prompt.Mon, 20 Jul 2026 00:00:00 GMTcapability meshagentsengineeringtool calling