Sources and Attribution

Further Reading is a short curated list, the sources worth your time. This page is the other thing: the complete record of what informed the book, and the statement of how it uses material it did not write.

Everything listed here was read directly, either during the writing or as the source of a claim the text makes. Search results that were surfaced and never opened are not listed, because listing them would claim a consultation that never happened.

How this book uses other people's work

Four rules held throughout:

Findings are reported, not reproduced. Where a source measured something, the book states the measurement, names who measured it, and links to where you can check. It does not reproduce the source's tables, figures, or substantial passages.

Quotations are short and marked. Where the exact wording matters, such as a spec's normative sentence or a paper's definition, it appears in quotation marks with its origin named in the same sentence.

Every number carries its provenance. If a chapter says 15×, 41–86.7%, 125 ms, or k ≈ 60, the source is named where the number appears and linked here. Numbers the book chose for illustration are labelled illustrative, and are nobody's finding.

Specs are paraphrased, not copied. The protocol and standards chapters describe mechanisms in the book's own words, then send you to the normative text. That is deliberate: a paraphrase that disagrees with the spec is the book's error to fix, and a copy that goes stale is a trap.

Trademarks

Anthropic and Claude, LangChain and LangGraph, Temporal, Vercel and the AI SDK, OpenAI, Microsoft, Google, Amazon and Firecracker, Stripe, PostgreSQL, Neo4j, Playwright, OWASP, and NIST are the marks of their respective owners.

Their use here is nominative: naming the thing under discussion, as a book about building on these systems has to. It implies no endorsement, affiliation, or sponsorship in either direction.

Licenses of the sources

Verified at the time of writing. Where a license could not be confirmed from the source itself, the row says so rather than guessing.

Nothing in this book is a derivative work of a listed source. Where the book agrees with a source it says so and cites it; where it disagrees, and it does, in places, it says that too, and the disagreement is the book's own.

The sources

Models and the API surface

• Building Effective Agents: Anthropic. The workflow/agent distinction that Part VI and what an agent is are built on.
• Prompt caching: Anthropic. Cache breakpoints, minimum cacheable prefixes, and TTL behavior behind prompt caching and the stable-prefix pattern.
• Message Batches: Anthropic. Window, discount, and limits behind batch-API offload and cost engineering.
• Token counting: Anthropic. The provider endpoint that settles what a string actually costs, in tokens.
• Tool use reference and the computer use tool: Anthropic. The tool-definition surface and the screen-control loop in computer-using agents.
• Anthropic Console: where setup sends you for a key.
• Tuning models on Vertex AI: Google Cloud. The adaptation options weighed in choosing and adapting models.

Retrieval and knowledge

• Reciprocal rank fusion outperforms Condorcet and individual rank learning methods: Cormack, Clarke & Büttcher, SIGIR 2009, 10.1145/1571941.1572114. The RRF formula and the k ≈ 60 constant in hybrid fusion.
• PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation: Zou et al., USENIX Security 2025, arXiv:2402.07867. Five malicious texts per target question for a 90% attack success rate, the basis of untrusted retrieval.
• Spider 2.0: Evaluating Language Models on Real-World Enterprise Text-to-SQL Workflows: ICLR 2025. The 17–21% against 91.2% gap behind SQL is still the answer.
• Cypher overview: Neo4j, plus W3C's RDF 1.2 Concepts and SPARQL 1.2 Query. The two query models compared in graph storage and query models.

Agent loops and graphs

• ReAct: Synergizing Reasoning and Acting in Language Models: Yao et al., arXiv:2210.03629. The reason–act–observe cycle named in the ReAct loop.
• Large Language Models Cannot Self-Correct Reasoning Yet: Huang et al., ICLR 2024, arXiv:2310.01798. Why reflection and critic–reviser require external feedback rather than self-review.
• LangGraph durable execution and the Durability type: LangChain. Checkpoint granularity and the node re-execution caveat in persistence and interrupts vs signals.
• Node retry policies: LangGraph.js examples. Per-node retry configuration in node or function.
• asyncio task documentation: Python. Cancellation and timeout semantics behind the Python track's concurrency samples.

Tools and workspaces

• Git worktree, Language Server Protocol 3.17, SARIF 2.1.0, and SLSA provenance 1.2. Isolated working state, structured navigation, typed findings, and build provenance in coding agents and workspaces.
• Locators, actionability, and ARIA snapshots: Playwright. The accessibility-tree addressing that computer-using agents prefers over pixel coordinates, and the snapshot form used in accessible interfaces.
• Logical decoding output plugins: PostgreSQL. The change-capture mechanism in enterprise integrations.

Protocols

• Model Context Protocol, revision 2026-07-28 and its changelog, plus the client and server sections of the preceding 2025-06-18 revision. Part IX describes the current revision and notes what moved.
• A2A 1.0 specification, life of a task, and A2A and MCP. Agent Cards, task lifecycle, and the project's own comparison, in MCP is not A2A.
• RFC 9728 (protected resource metadata), RFC 8414 (authorization server metadata), RFC 8707 (resource indicators), and RFC 7591 (dynamic client registration, now deprecated for this use). The authorization chain in servers, clients, and transports.

Durable execution

• Temporal Design Patterns: the catalog Part XI maps onto agents, and the index behind the pattern index.
• Temporal CLI setup: install paths and the local dev server in setup.
• LangGraph integration for the Temporal Python SDK: the plugin behind LangGraph on Temporal.
• Beyond the Leaderboard: A Synthesis of Tool-Use, Planning, and Reasoning Failures in Large Language Model Agents: arXiv:2607.05775. The six failure clusters that open everything that breaks.
• When Errors Become Narratives: A Longitudinal Taxonomy of Silent Failures in a Production LLM Agent Runtime: arXiv:2606.14589. Twenty-two observed incidents, and the invisibility meta-pattern that chapter is organized around.
• arXiv:2602.09345: the agent latency breakdown quoted in not a background job.

Interface, accessibility, and trust

• WCAG 2.2, WAI-ARIA 1.2: particularly live regions: the WCAG standards overview, and W3C internationalization. The normative basis of accessible and global interfaces.
• WebRTC, Media Capture and Streams, and RFC 8827. The transport and security architecture behind realtime voice agents.
• To Trust or to Think: Cognitive Forcing Functions Can Reduce Overreliance on AI in AI-assisted Decision-making: Buçinca, Malaya & Gajos, CSCW 2021 (author copy). The 199-participant result behind trust patterns and the training argument in organizational rollout.
• Evaluating Verifiability in Generative Search Engines: Liu, Zhang & Liang, arXiv:2304.09848. The citation-support rates that make grounded citations a mechanical check.
• Workflow agents: Vercel AI SDK. The durable-agent surface compared in two durable runtimes.

Evals

• Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena: Zheng et al., arXiv:2306.05685. The judge biases and agreement ceiling tabulated in scoring and judge with rubric.
• Self-Preference Bias in LLM-as-a-Judge: Wataoka, Takahashi & Ri, arXiv:2410.21819. The perplexity-familiarity account of why a judge favours its own output.
• Challenges in Monitoring Deployed AI Systems: NIST. Referenced in learning from production feedback.

Observability

• OpenTelemetry GenAI semantic conventions, the gen-ai attribute registry, and the dedicated conventions repository. The attribute names Part XV instruments against.

Reliability

• Handling overload and the wider Google SRE books. Retry budgets, load shedding, and amplification arithmetic, applied in timeouts and retries and backpressure.

Security

• OWASP Top 10 for LLM Applications — LLM01: Prompt Injection, the OWASP GenAI Security Project, the Top 10 for Agentic Applications 2026, and the GenAI Red Teaming Guide. The coverage checklists in the threat model, risk tiers, the agentic supply chain, and adversarial evals.
• Design Patterns for Securing LLM Agents against Prompt Injections: Beurer-Kellner et al., arXiv:2506.08837. The six patterns and their honestly stated utility costs, organizing prompt injection.
• Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents: arXiv:2503.00061. Eight defenses bypassed: the reason filtering is not a defense.
• Defending Against Indirect Prompt Injection Attacks With Spotlighting: Hines et al., arXiv:2403.14720. Delimiting, datamarking, and encoding, behind untrusted content marking.
• The lethal trifecta and CaMeL: Simon Willison. The per-path review checklist and the capabilities-and-taint approach used throughout Part XVII.
• EchoLeak (CVE-2025-32711): Hack The Box. The zero-click exfiltration chain that the egress allowlist is a response to.
• Firecracker specification: the ≤125 ms boot figure, and its measurement caveats, quoted in sandboxing.
• RFC 8693 — OAuth 2.0 Token Exchange and the IETF draft OAuth for AI agents acting on behalf of a user. The settled delegation mechanism and the in-progress extension, in identity and identity propagation.
• NIST SP 800-161 Rev. 1 and the NIST AI RMF Generative AI Profile. Supply-chain risk management applied in the agentic supply chain.

Governance and regulation

• NIST AI RMF Core, the Playbook and its Manage function, the appendices on AI actor tasks and human-AI interaction, and the ISO/IEC 42001 crosswalk. The governance structure behind process discovery, AI governance, and organizational rollout.
• Regulation (EU) 2024/1689, with Article 12 on record-keeping and Article 19 on log retention. The obligations shaping escalation and audit and PII and compliance.
• European Commission AI Act implementation FAQ and AI literacy FAQ. The maintained official sources for the phased timeline and Article 4.

Multi-agent

• How we built our multi-agent research system: Anthropic. The 15× token figure, the variance finding, and the orchestrator-worker-with-citation-pass shape in the coordination tax and supervisor and handoff.
• Why Do Multi-Agent LLM Systems Fail?: Cemri et al., arXiv:2503.13657. The MAST taxonomy and the 41–86.7% failure range.
• Single-Agent LLMs Outperform Multi-Agent Systems on Multi-Hop Reasoning Under Equal Thinking Token Budgets: arXiv:2604.02460. The equal-budget control behind when not to.

Secondary sources

One entry, listed for completeness rather than because the book relies on it:

• Complete guide to the 2026 OWASP Top 10 risks for agentic applications: NHI Mgmt Group. Read as a summary while working through the agentic Top 10; every claim the book makes about ASI01–ASI10 is checked against and cited to the OWASP original.

What has no source

Most of this book. The layering argument, the determinism test, the risk-tier framing, the pattern catalog and its fixed shape, the Atlas running example, the decision tables, and the failure stories are the book's own work. Where a chapter reasons rather than reports, it carries no citation, and that absence is a claim of authorship, not an omission.

The same applies to every judgment call the book records. FrameworkCheck exists precisely to mark the places where defensible implementations disagree and the book picked one. Those picks are arguments, and they are answerable to you rather than to a source.

---

Found something misattributed, or a source that should be credited here and isn't? That is a bug, and it is worth reporting as one.