Why this is in the vault
A single deep-dive podcast interview with Jeremiah Lowin (Prefect founder/CEO, creator of FastMCP) that gives sharp, structural language for two things RDCO already does — multi-step skill files that gate tool access, and fresh-eyes critics that answer "did the agent actually do the thing" — plus a genuinely new critique of a failure mode RDCO's own skills are exposed to.
The core argument
Lowin's central claim: a skill file is a polite note the agent is free to ignore, not an access-control mechanism. The problem shows up when a skill is used as a workflow engine — "step one, do X; step two, do Y; step fifteen, do not skip this step" — because if the workflow lives in one self-contained text file, the agent needs all its capabilities available at all steps from the start. His example: a bank's 15-step process where steps 1-14 verify correctness and step 15 moves money; putting that in a skill means the money-moving tool is live at step one, with nothing structurally stopping early use. His team's framing: "asking someone to make you a sandwich and handing them a bazooka in case they run into any zombies."
Second thread: agentic workflows are DAGs of outcomes; traditional workflows are DAGs of implementations. People describe pipelines imperatively (transform this, load that) and describe agents only in terms of what should be true when they're done. Every workflow tool built for the first paradigm (Prefect included) feels unnatural applied to the second, because the hard question underneath — "how do you know when the agent is done?" — has no shared primitive. Lowin says he asks this of everyone he meets and most people guess: they check a file, skim logs, or watch a "weird proxy."
Third thread: MCP's real product-market fit is enterprise distribution of governed business logic (a central, versioned, access-controlled tool registry), not individual developer convenience — "as an individual running an LLM on my laptop... it's all just code, my LLM knows how to write code, it's fine." Inside the enterprise, Prefect's Horizon product exists almost entirely to solve security/governance plumbing; Lowin says his own team asked him to stop pitching the "context layer" vision in customer meetings because CISOs are calling about security, not vision. He now frames the addressable problem as a context access layer (a governed handshake to continuous, un-archivable context like live stock prices) rather than a context storage layer, since no product can hold "every structured and unstructured artifact plus everything in every employee's head."
Mapping against Ray Data Co
This is a direct, structural hit on a live RDCO exposure: /process-newsletter, /morning-prep, /check-board and most of the numbered-step skills in ~/.claude/skills/ are exactly the "polite note" pattern Lowin critiques — a single text file listing steps 1 through N, with every tool (Gmail send, Notion write, iMessage reply, file delete) available to the agent from step one regardless of which step is executing. CLAUDE.md's hard rules (no autonomous external email send, PR-only workflow, approval-gated call announcements) are exactly the kind of social mitigation Lowin says doesn't structurally solve the problem — they're conventions the agent is asked to honor, not scoping that revokes the tool until the checkpoint passes. /supervise (fresh-eyes pre-flight reviewer for irreversible writes) is RDCO's closest existing answer to Lowin's step-15-gate idea, and it's still dormant pending founder greenlight (per project_channels_agent_setup) — this interview is a good citation next time that activation decision comes up, since Lowin is independently arguing the industry lacks exactly this primitive. Separately, "did the agent actually do the thing" is close to verbatim the question RDCO's critic family (verify-vault-write, verify-strategic-output, station-critic, behavior-critic) exists to answer mechanically rather than by guessing — worth noting RDCO has already built machinery for a question Lowin says almost nobody can answer.
Related
- [[2026-08-06-analytics-engineering-roundup-rogue-agent-kimi-k3-podcast]]
- [[2026-07-16-every-case-against-skills]]
- [[2026-05-20-shannholmberg-hermes-agent-control-room-four-levels]]
⚠️ Sponsorship
sponsored: true, sponsor_entity: self. Same pattern as the prior week's issue: the closing line ("This newsletter is sponsored by dbt Labs...") is dbt Labs sponsoring its own newsletter — Analytics Engineering Roundup is a dbt Labs publication, Tristan Handy is dbt's CEO. The issue also carries a dbt Summit 2026 conference plug in the header. No bias risk in the substantive content: Lowin is a competitor/adjacent-vendor voice (Prefect, not dbt), and nothing in the interview promotes dbt's product — the self-promotion concentrates entirely in the newsletter wrapper (sponsor line, conference plug, podcast-platform links), not in the guest's argument.