Notes from building with AI

The ten risks on OWASP's 2025 list in a builder's language: prompt injection, data leakage, excessive agency and unbounded consumption.

A model does not remember conversations, it only sees a context window. Three ways to give an agent memory: context, memory files and RAG, and when to use each.

Three works today's practice with models stands on: Transformer, RAG and ReAct. What they propose and where you meet them in tools.

A list of coding-agent actions with a proposal: allow, ask or deny. Rule syntax, permission modes in Claude Code and rules for modes that do not ask.

An agent is a model in a loop: it thinks, calls a tool, reads the result and decides next. I explain the loop, workflow versus agent and when agents pay off.

The EU AI regulation without legal jargon: four risk levels, prohibited practices, high-risk systems and dates according to the European Commission.

Four settings files, CLAUDE.md, permission rules and hooks: what goes where, who sees it, and what is only a hint versus a hard rule in Claude Code.

A simple calculation: parameters times bytes per weight plus memory for context. How to estimate whether a model fits and what quantization does to quality.

Why design tokens and a component library make AI generate a consistent interface. The DTCG standard, Tailwind theme variables and shadcn/ui components.

What the Model Context Protocol is, how host, client and server work together, and how tools, resources and prompts differ. A plain explanation without jargon.

NIST's voluntary AI risk management framework for a small team: Govern, Map, Measure, Manage as four questions and a one-page risk register.

Generating images, video, music, speech and transcription: which categories makers offer, what the workflow looks like and what to check before publishing.