Day 88: Simulation and Digital Twins for Tools

Agents that only know live mutate APIs will eventually mutate the wrong thing. Give them a digital twin: dry-run endpoints, simulators, or shadow accounts that return realistic results without side effects.

⚡ TL;DR: Every mutate tool needs a dry_run=true sibling or twin environment. Agents plan against the twin; humans approve apply. Diff twin vs real carefully — drift is the enemy.

Twin contract

# ✅ Same schema, no side effects
def resize_asg(asg: str, desired: int, *, dry_run: bool):
    if dry_run:
        current = describe_asg(asg)
        return {
            "would_set_desired": desired,
            "current": current.desired,
            "delta": desired - current.desired,
            "applied": False,
        }
    return apply_resize(asg, desired)

❌ “We’ll just be careful in the prompt” as the only safety layer.

Failure modes

Twin drift: IAM in twin is laxer than prod, so dry-runs succeed and apply fails — or worse, twin is stricter and agents learn wrong refusals. Contract tests compare twin vs prod schemas nightly.

Closing checklist

• [ ] Mutate tools have dry-run or twin
• [ ] Agent default = dry-run
• [ ] Dual control to flip applied=true
• [ ] Twin drift monitors
• [ ] Eval suite runs only on twin

Series navigation

Day 87: Workflow Mining From Logs · Day 89: On-Device and Edge Completions

Last updated September 11, 2026