[{"data":1,"prerenderedAt":396},["ShallowReactive",2],{"$fXmYMC8CIv-kw-Pk_85WEkM3kFQX_OYp4JCBkxAsw7EI":3},{"item":4},{"id":5,"title":6,"article":7,"articleStatus":8,"articleUrl":9,"author":10,"body":11,"deliverables":376,"description":369,"designer":379,"driveFolder":380,"extension":381,"imagesFolder":382,"kind":383,"liveUrl":384,"meta":385,"navigation":386,"nextAction":387,"outcome":384,"owner":388,"path":389,"phase":390,"postSlug":369,"seo":391,"status":392,"stem":393,"targetDate":369,"updated":394,"__hash__":395},"briefs\u002Fbriefs\u002Ffrom-watching-the-network-to-watching-the-agent.md","From watching the network to watching the agent","From watching the network to watching the agent — the \"why it's been quiet\" post that announces the pivot","draft","https:\u002F\u002Fdocs.google.com\u002Fdocument\u002Fd\u002F1c4_USc7Bp26S4__iXJsbui7wGi3ycoubIl0mrc7sHKY\u002Fedit","tyler-flint",{"type":12,"value":13,"toc":368},"minimark",[14,19,28,32,35,45,48,52,354,358],[15,16,18],"h2",{"id":17},"in-plain-words","In plain words",[20,21,22,23,27],"p",{},"For two years Qpoint built a way to see everything leaving a computer over the network, even the encrypted parts. Then AI helpers showed up on everyone's laptop, and the traffic started looking strange: hundreds of calls an hour, programs nobody remembered installing, helpers starting other helpers. Qpoint could see all of it, but couldn't answer the question that mattered: ",[24,25,26],"em",{},"why"," did the helper do that, and what was it doing just before? The answer wasn't on the wire. It was one floor up, inside the helper itself. So Qpoint climbed a floor and started watching the helper instead of the pipe.",[15,29,31],{"id":30},"the-article-in-three-lines","The article in three lines",[20,33,34],{},"Written by Tyler, in first person, to explain why the blog went quiet after January: Qpoint rebuilt itself around a different problem. The old product (QTap, eBPF, egress visibility) could see every request an agent made but not the intent behind it: which file it read first, which tool call started it, which session it belonged to. Every other layer (observability, identity, EDR, AI gateways) sees a fragment and nobody watches the agent, so Qpoint moved up to the agent runtime and now discovers every agent on the endpoint, captures every action at the source, and offers Monitor, Govern and Secure on top, with the same principles underneath: at the source, no gateways, no sidecars, one binary.",[20,36,37,38,41,42],{},"The line that wants to be the picture: ",[24,39,40],{},"\"We realized we were looking one layer too low.\""," Close second: ",[24,43,44],{},"\"Network visibility tells you the destination. It doesn't tell you the intent.\"",[20,46,47],{},"This is a personal, before-and-after post, warmer than the three series posts, and it points forward to them (\"next up: how Qpoint instruments the agent runtime, how the plugin model works\"). It also looks back at the blog's own history: the eBPF bee, the Shai-Hulud worm, the encryption paradox, DevTools. A hero that quotes the old illustrations and moves past them is a real option. No author figures exist yet; the doc has no images.",[15,49,51],{"id":50},"jargon","Jargon",[53,54,55,71],"table",{},[56,57,58],"thead",{},[59,60,61,65,68],"tr",{},[62,63,64],"th",{},"Term",[62,66,67],{},"What it means here",[62,69,70],{},"If you had to draw it",[72,73,74,86,97,108,119,130,141,152,163,174,185,196,207,218,229,240,251,262,273,284,295,306,317,332,343],"tbody",{},[59,75,76,80,83],{},[77,78,79],"td",{},"Egress, egress visibility",[77,81,82],{},"Traffic leaving a machine, and the ability to see it. Qpoint's original product.",[77,84,85],{},"Pipes leading out of a house",[59,87,88,91,94],{},[77,89,90],{},"QTap",[77,92,93],{},"Qpoint's first product: a tool that watched outbound traffic on Linux servers.",[77,95,96],{},"The old telescope",[59,98,99,102,105],{},[77,100,101],{},"eBPF",[77,103,104],{},"A Linux technology for watching programs from inside the operating system. How QTap saw through encryption without proxies. The blog's bee mascot came from it.",[77,106,107],{},"The bee, already drawn",[59,109,110,113,116],{},[77,111,112],{},"TLS, \"hook TLS before encryption\"",[77,114,115],{},"The encryption on web traffic. QTap caught the data a moment before it was scrambled.",[77,117,118],{},"Reading the letter before it goes in the envelope",[59,120,121,124,127],{},[77,122,123],{},"Proxy, gateway, sidecar, SDK, wrapper",[77,125,126],{},"Different ways of putting something in the middle of traffic or inside an app to watch it. Qpoint's principle is none of these: watch at the source.",[77,128,129],{},"Middlemen; absent on purpose",[59,131,132,135,138],{},[77,133,134],{},"Host, endpoint",[77,136,137],{},"A machine. Host usually means a server; endpoint usually means a laptop.",[77,139,140],{},"A house",[59,142,143,146,149],{},[77,144,145],{},"Agent",[77,147,148],{},"An AI program that works through a goal on its own, calling APIs and running commands. Claude Code, Codex.",[77,150,151],{},"The helper",[59,153,154,157,160],{},[77,155,156],{},"Harness",[77,158,159],{},"The app an agent runs inside.",[77,161,162],{},"The helper's uniform",[59,164,165,168,171],{},[77,166,167],{},"MCP server",[77,169,170],{},"A helper program that gives the agent extra abilities. \"One we didn't remember installing\" is the unsettling example.",[77,172,173],{},"A toolbox that appeared on its own",[59,175,176,179,182],{},[77,177,178],{},"Subprocess, \"spawned by an agent, spawned by another agent\"",[77,180,181],{},"Programs started by programs. Helpers starting helpers.",[77,183,184],{},"A chain of ever-smaller figures",[59,186,187,190,193],{},[77,188,189],{},"Session",[77,191,192],{},"One run of an agent from request to finish.",[77,194,195],{},"One shift",[59,197,198,201,204],{},[77,199,200],{},"Tool call",[77,202,203],{},"One request an agent makes through its harness.",[77,205,206],{},"A hand reaching for a drawer",[59,208,209,212,215],{},[77,210,211],{},"Intent",[77,213,214],{},"Why the agent did something; what it was asked to do. The thing network data can't show.",[77,216,217],{},"A thought bubble the wire can't see",[59,219,220,223,226],{},[77,221,222],{},"Observability",[77,224,225],{},"Dashboards and logs engineering teams use to watch systems. \"Has dashboards for everything except agents.\"",[77,227,228],{},"A wall of screens with one blank",[59,230,231,234,237],{},[77,232,233],{},"Identity (as a security layer)",[77,235,236],{},"Systems that know who logged in. Not what they did next.",[77,238,239],{},"A badge reader",[59,241,242,245,248],{},[77,243,244],{},"EDR",[77,246,247],{},"Security software on laptops that watches processes. Sees a file open, not that an agent did it.",[77,249,250],{},"A guard who sees shapes, not faces",[59,252,253,256,259],{},[77,254,255],{},"AI gateway",[77,257,258],{},"A service that AI calls are routed through so they can be watched. Misses anything that doesn't go through it.",[77,260,261],{},"A toll booth on one road of many",[59,263,264,267,270],{},[77,265,266],{},"Agent runtime",[77,268,269],{},"The agent itself while running: the layer above the network where the article says the interesting behavior lives.",[77,271,272],{},"The upper floor",[59,274,275,278,281],{},[77,276,277],{},"\"One layer too low\"",[77,279,280],{},"The article's confession: they were watching the pipe when the story was in the room above.",[77,282,283],{},"Looking in the basement while the lights are on upstairs",[59,285,286,289,292],{},[77,287,288],{},"Fleet",[77,290,291],{},"All the agents across all a company's machines.",[77,293,294],{},"Many houses",[59,296,297,300,303],{},[77,298,299],{},"Monitor, Govern, Secure",[77,301,302],{},"Qpoint's three product surfaces now: see everything, set the rules, enforce them before the action completes.",[77,304,305],{},"Three panels, one scene",[59,307,308,311,314],{},[77,309,310],{},"Plugin, policy",[77,312,313],{},"Rules shipped as small separate programs; you can write your own.",[77,315,316],{},"A rulebook with blank pages at the back",[59,318,319,326,329],{},[77,320,321,325],{},[322,323,324],"code",{},".env",", SSH keys, secrets",[77,327,328],{},"Files holding passwords and keys. \"Block it from reading my .env before it happens.\"",[77,330,331],{},"A key ring",[59,333,334,337,340],{},[77,335,336],{},"Shai-Hulud npm worm",[77,338,339],{},"A real malware outbreak in open-source packages that QTap caught live; an earlier blog post with its own illustration.",[77,341,342],{},"The old worm illustration, already drawn",[59,344,345,348,351],{},[77,346,347],{},"DevTools, the encryption paradox",[77,349,350],{},"Earlier Qpoint posts and products the article refers back to.",[77,352,353],{},"Earlier illustrations on the blog",[15,355,357],{"id":356},"record","Record",[359,360,361],"ul",{},[362,363,364],"li",{},[365,366,367],"strong",{},"Shipped:",{"title":369,"searchDepth":370,"depth":370,"links":371},"",2,[372,373,374,375],{"id":17,"depth":370,"text":18},{"id":30,"depth":370,"text":31},{"id":50,"depth":370,"text":51},{"id":356,"depth":370,"text":357},[377,378],"hero","listing","sarah","https:\u002F\u002Fdrive.google.com\u002Fdrive\u002Ffolders\u002F1GPUisgW2Bg7uhaOHqUcDqoThr0baX5DG","md","\u002Fimages\u002F2026.Q4\u002F","illustration",null,{},true,"Direction conversation, Mark and Sarah. This post is the series opener in spirit; decide whether its hero belongs to the series system or stands alone.","Mark","\u002Fbriefs\u002Ffrom-watching-the-network-to-watching-the-agent","0-intake",{"title":6,"description":369},"queued","briefs\u002Ffrom-watching-the-network-to-watching-the-agent","2026-10-13","iFaHGEYLc7Xwvgb8n214zSDBrJh9JrFGumTzhgXuf7Y",1794599377674]