From watching the network to watching the agent

From watching the network to watching the agent — the "why it's been quiet" post that announces the pivot

The article is still being written. Its argument is settled enough to design against; its wording and figures may change.

In plain words

For two years Qpoint built a way to see everything leaving a computer over the network, even the encrypted parts. Then AI helpers showed up on everyone's laptop, and the traffic started looking strange: hundreds of calls an hour, programs nobody remembered installing, helpers starting other helpers. Qpoint could see all of it, but couldn't answer the question that mattered: why did the helper do that, and what was it doing just before? The answer wasn't on the wire. It was one floor up, inside the helper itself. So Qpoint climbed a floor and started watching the helper instead of the pipe.

The article in three lines

Written by Tyler, in first person, to explain why the blog went quiet after January: Qpoint rebuilt itself around a different problem. The old product (QTap, eBPF, egress visibility) could see every request an agent made but not the intent behind it: which file it read first, which tool call started it, which session it belonged to. Every other layer (observability, identity, EDR, AI gateways) sees a fragment and nobody watches the agent, so Qpoint moved up to the agent runtime and now discovers every agent on the endpoint, captures every action at the source, and offers Monitor, Govern and Secure on top, with the same principles underneath: at the source, no gateways, no sidecars, one binary.

The line that wants to be the picture: "We realized we were looking one layer too low." Close second: "Network visibility tells you the destination. It doesn't tell you the intent."

This is a personal, before-and-after post, warmer than the three series posts, and it points forward to them ("next up: how Qpoint instruments the agent runtime, how the plugin model works"). It also looks back at the blog's own history: the eBPF bee, the Shai-Hulud worm, the encryption paradox, DevTools. A hero that quotes the old illustrations and moves past them is a real option. No author figures exist yet; the doc has no images.

Jargon

Term	What it means here	If you had to draw it
Egress, egress visibility	Traffic leaving a machine, and the ability to see it. Qpoint's original product.	Pipes leading out of a house
QTap	Qpoint's first product: a tool that watched outbound traffic on Linux servers.	The old telescope
eBPF	A Linux technology for watching programs from inside the operating system. How QTap saw through encryption without proxies. The blog's bee mascot came from it.	The bee, already drawn
TLS, "hook TLS before encryption"	The encryption on web traffic. QTap caught the data a moment before it was scrambled.	Reading the letter before it goes in the envelope
Proxy, gateway, sidecar, SDK, wrapper	Different ways of putting something in the middle of traffic or inside an app to watch it. Qpoint's principle is none of these: watch at the source.	Middlemen; absent on purpose
Host, endpoint	A machine. Host usually means a server; endpoint usually means a laptop.	A house
Agent	An AI program that works through a goal on its own, calling APIs and running commands. Claude Code, Codex.	The helper
Harness	The app an agent runs inside.	The helper's uniform
MCP server	A helper program that gives the agent extra abilities. "One we didn't remember installing" is the unsettling example.	A toolbox that appeared on its own
Subprocess, "spawned by an agent, spawned by another agent"	Programs started by programs. Helpers starting helpers.	A chain of ever-smaller figures
Session	One run of an agent from request to finish.	One shift
Tool call	One request an agent makes through its harness.	A hand reaching for a drawer
Intent	Why the agent did something; what it was asked to do. The thing network data can't show.	A thought bubble the wire can't see
Observability	Dashboards and logs engineering teams use to watch systems. "Has dashboards for everything except agents."	A wall of screens with one blank
Identity (as a security layer)	Systems that know who logged in. Not what they did next.	A badge reader
EDR	Security software on laptops that watches processes. Sees a file open, not that an agent did it.	A guard who sees shapes, not faces
AI gateway	A service that AI calls are routed through so they can be watched. Misses anything that doesn't go through it.	A toll booth on one road of many
Agent runtime	The agent itself while running: the layer above the network where the article says the interesting behavior lives.	The upper floor
"One layer too low"	The article's confession: they were watching the pipe when the story was in the room above.	Looking in the basement while the lights are on upstairs
Fleet	All the agents across all a company's machines.	Many houses
Monitor, Govern, Secure	Qpoint's three product surfaces now: see everything, set the rules, enforce them before the action completes.	Three panels, one scene
Plugin, policy	Rules shipped as small separate programs; you can write your own.	A rulebook with blank pages at the back
`.env`, SSH keys, secrets	Files holding passwords and keys. "Block it from reading my .env before it happens."	A key ring
Shai-Hulud npm worm	A real malware outbreak in open-source packages that QTap caught live; an earlier blog post with its own illustration.	The old worm illustration, already drawn
DevTools, the encryption paradox	Earlier Qpoint posts and products the article refers back to.	Earlier illustrations on the blog

Record

Shipped: