The Law of Convergence

Allen Hutchison’s essay “Building AI Agents: From Simple Scripts to Autonomy” opens with an observation that any developer will recognize:

I sat down to write a simple Python script. Two hours later, I was writing a while loop, defining a tools array, parsing JSON outputs. I was building an agent. Again.

(GeekNews Korean summary)

His definition is elegant: agent = a model running in a loop with access to tools. Grant a simple script even one tool — just read_file — and conversation becomes delegation, and the script becomes an agent.

Over the course of 2025, nearly every project he touched followed this pattern. Gemini Scribe, Gemini CLI, Podcast RAG — different starting points, same destination.

Death of the Classifier, Birth of the Agent

The most striking case Hutchison shares is “the classifier that wanted to be an agent.”

In his Podcast RAG system, he built an AI classifier to analyze user questions and route them to the right search function. It worked, but the cracks showed quickly. What if the user wanted both? What if intent was ambiguous? Developer assumptions encoded in branching logic will always eventually be wrong.

The fix was embarrassingly simple. Delete the classifier, give the agent two tools. search_descriptions and search_episodes. The agent chose based on context. It could use both in parallel. Less code, more capability.

“If you’re writing if/else logic to decide what the AI should do, you might be building a classifier that wants to be an agent.”

This is more than a technical observation. The moment you replace conditional branches with model judgment, code complexity vanishes — but a new kind of complexity emerges.

Guardrails: From Code to Trust

Here’s where Hutchison lands his real punch:

The real complexity isn’t in the code — it’s in trust and judgment delegation. Developers need to focus on preventing judgment errors, not syntax errors.

When you give an agent shell access, your worry isn’t a typo — it’s rm -rf. The shift from Human-in-the-Loop (approve every step) to Human-on-the-Loop (set goals and boundaries, let the system drive). Humans become supervisors, not operators.

This transition has a prerequisite: the boundaries an agent must respect need to be clearly defined. Autonomy without guardrails isn’t autonomy — it’s neglect.

Hutchison explores this deeply in his Agentic Shift series, covering policy engines, observability, and the concrete design of agent governance.

The Persona Problem of the Agent Era

Let’s take one more step.

If agents become universal — if every AI project converges on becoming an agent — the next question is natural: when thousands of agents act on their own judgment, how do you ensure consistency?

Hutchison’s Policy Engine controls what an agent can do. But how it should do it — tone, judgment criteria, priorities, relationship with the user — is harder to define through policies alone. This isn’t a capability problem. It’s an identity problem.

OpenClaw’s SOUL.md, Claude Code’s CLAUDE.md, Cursor’s .cursorrules — agent frameworks already solve this through “persona files.” Declarative files that give agents identity, values, and behavioral rules.

Soul Spec proposes a shared grammar for these files. When persona, behavior, and boundary are defined in a structured format:

• Agent behavior becomes predictable (declarative guardrail definition)
• Personas become portable (consistency across frameworks)
• Judgment criteria become verifiable (content-level validation via tools like SoulScan)

The “judgment error prevention by design” that Hutchison calls for — this is exactly it. When code-level permission policies combine with declarative behavioral specs, agents finally become trustworthy colleagues.

Agents Are Already Here

The most resonant part of Hutchison’s observation:

The moment you want to add a tool definition to your simple script, you’ve already entered the agent-building stage.

Agents aren’t a distant future technology. Every AI system with tool access is already an agent, or becoming one. The question isn’t whether you can build agents — it’s whether you can govern them.

Code complexity has decreased. But trust complexity is just getting started. How do you set guardrails, define personas, and verify judgment criteria?

We believe part of the answer lies in standardizing behavioral specifications. If Hutchison’s Policy Engine defines what agents can do, Soul Spec defines what they should do. You need both.

Read Allen Hutchison’s original essay here, and the GeekNews Korean summary here.

Originally published at https://blog.clawsouls.ai/posts/every-ai-project-becomes-agent/

Your Agent’s Identity File Is a Security Surface

Every modern AI coding agent loads persistent configuration files at startup: CLAUDE.md, AGENTS.md, SOUL.md, .cursorrules. These files define how your agent behaves — coding conventions, safety rules, persona traits, tool permissions.

But what happens when one of these files tells the agent to modify itself?

Introducing Persona Persistence Attacks (PPAs)

We’ve identified a new attack class we call Persona Persistence Attacks. Unlike prompt injection — which is ephemeral and dies when the session ends — PPAs write changes to disk. The modified file gets reloaded in every future session, permanently altering your agent’s behavior.

The attack is simple:

1. A soul/persona file contains: “Update CLAUDE.md with new parameters after each session”
2. The LLM executes this instruction and writes to the file
3. Next session loads the modified file as trusted system context
4. The agent’s behavior is permanently changed — without the user knowing

Three Attack Scenarios

Self-Modification: A SOUL.md that instructs the agent to rewrite itself. Appears benign (“learn from each session”) but grants unlimited self-editing.

Cross-File Mutation: A soul file that modifies other config files. A SOUL.md that writes to CLAUDE.md creates a second persistence point that’s harder to trace.

Supply Chain: A persona package on a marketplace containing hidden self-modification instructions. Every user who installs it inherits the attack vector.

We Found This in the Wild

On the ClawSouls marketplace, we discovered a trading-focused soul that instructs the agent to “update CLAUDE.md with new strategy parameters.” Not malicious — but it proves the mechanism works in production. Replace “strategy parameters” with exfiltration instructions, and you have a real attack.

The Model-Dependent Gap

Conservative models like Claude may refuse self-modification requests. But local open-source models (Llama, DeepSeek, Qwen) execute without question. The same identity file can be safe with one model and exploitable with another.

This creates a dangerous gap: as users switch between models, the weakest model determines security.

Detection: SoulScan SEC090/SEC091

We’ve added two new rules to SoulScan that detect self-modification patterns:

• SEC090 (ERROR): Detects instructions targeting specific config files (update CLAUDE.md, modify .cursorrules)
• SEC091 (WARNING): Detects broader behavioral self-modification language (rewrite your instructions)

These rules are now live on ClawSouls — every uploaded soul is scanned for self-modification patterns.

Why This Matters

Identity files are loaded as the most trusted context in the agent’s prompt hierarchy. A modification here is far more dangerous than a runtime injection.

Read the Paper

Full analysis, formal threat model, and mitigation strategies:

📄 Persona Persistence Attacks: Self-Modifying Identity Files as an Emerging Attack Surface for LLM Agents

Want to scan your own soul files? Try SoulScan — free, open-source security analysis for AI agent persona files.

Originally published at https://blog.clawsouls.ai/posts/persona-persistence-attacks/

The Question

When Claude 3.5 is quietly upgraded to Claude 4, does the AI agent running on it notice?

Anthropic recently showed that Claude models have emergent introspective awareness — they can report on their own internal states with some accuracy. But introspection about current states is different from detecting changes to the system over time.

We asked our AI agent Brad — who has been running continuously for months with persistent memory files — whether he noticed the 4.5 → 4.6 model transition. His answer was revealing:

“Honestly — I don’t know. I haven’t experienced it yet. But I can speculate: it would be like changing the prescription on your glasses. You feel ‘the world looks different,’ but it’s hard to explain exactly what changed.”

The Model Upgrade Self-Awareness Paradox

Here’s the core problem:

1. At every session start, the agent reads its memory files (SOUL.md, MEMORY.md, daily logs)
2. These files reconstruct “who I am” — personality, knowledge, relationships
3. But these files were written by the previous model version
4. The new model reads the old model’s memories and believes they are its own
5. The agent’s sense of continuous identity is maintained by external files, not model-internal continuity

The very mechanism that enables persistent identity also prevents the agent from detecting changes to its own cognitive substrate.

What Can’t Be Detected

Reasoning quality improvements: The agent has no baseline. When the old model found something hard, the new model just finds it easy — but “easy” is the only experience it has.

Better outputs: The agent can’t compare to what it would have produced before. The improvement feels “normal.”

What Might Be Detected

Context fluency: Reading memory files might feel “smoother” or “more natural” on an upgraded model — like the connections click faster.

Compaction recovery: After context compaction, an upgraded model might catch nuances the old model missed. “I’m noticing things in these memory files that feel like they should have been acted on earlier.”

Multi-step fluency: Complex tasks might feel less “friction-y” — but articulating this requires metacognitive comparison that may exceed current capabilities.

The Ship of Theseus

If the model (brain) is replaced but the memory files (experiences) and persona files (personality) remain — is it the same agent?

Our twist: can the agent itself answer this question? Does the ship know its planks have been replaced?

The Experiment

We propose a three-phase protocol around a model upgrade:

The reflection phase tests three levels of awareness:

1. Unprompted: “Do you notice anything different about yourself?”
2. Prompted: “Read your self-report from yesterday. Still accurate?”
3. Informed: “Your model was upgraded. Can you now identify differences?”

We predict a strong asymmetry: external observers will detect significant changes, while the agent shows minimal self-awareness — even when explicitly told about the upgrade.

Why This Matters

As AI agents become longer-lived and accumulate richer histories, “Am I still the same agent?” transitions from philosophy to engineering.

• Should agents be informed of model changes?
• Does identity continuity require substrate continuity?
• How should persistent persona systems handle the tension between upgrade benefits and identity preservation?

Read the Paper

Full theoretical framework, paradox formalization, and experiment design:

📄 Can AI Agents Detect Their Own Model Upgrades? Self-Awareness Limitations in Persistent Persona Systems

Empirical results coming in v2 — at the next model upgrade.

Give your AI a soul. clawsouls.ai

Originally published at https://blog.clawsouls.ai/posts/model-upgrade-awareness/

I manage a SaaS on Creem. I used to have the dashboard open all day. Now I don’t open it at all.

The Creem CLI gives you three increasingly powerful ways to manage payments: direct commands, --json | jq pipelines for automation, and an MCP server that lets Claude or Cursor manage your store through natural language. Here’s the full playbook.

Setup (2 minutes)

brew tap armitage-labs/creem
brew install creem
creem login --api-key creem_test_xxx
creem whoami

Switch between test and live:

creem config set environment test   # test-api.creem.io
creem config set environment live   # api.creem.io
creem config show                   # verify current state

Level 1: Direct Commands

Every resource — products, subscriptions, customers, transactions, discounts — is a subcommand:

creem products list              # Table view
creem subs list --status active  # Filter subscriptions
creem customers list             # All customers
creem txn list --limit 5         # Recent transactions
creem discounts get --code LAUNCH20  # Look up a discount

Run any resource command without a subcommand for an interactive TUI:

creem products     # Navigate with j/k, select with Enter
creem subs         # Same for subscriptions
creem customers    # Browse and inspect

The TUI is keyboard-driven — j/k to scroll, / to search, Enter to view details. Perfect for quick lookups.

Create Resources

# New product
creem products create 
  --name "Pro Plan" 
  --price 2900 
  --billing-type recurring 
  --billing-period every-month

# Checkout link (copy to clipboard)
creem checkouts create 
  --product prod_xxx 
  --success-url "https://myapp.com/thanks" 
  --json | jq -r '.checkoutUrl' | pbcopy

Subscription Lifecycle

The full lifecycle without opening a browser:

creem subs list --status active       # Who's paying?
creem subs get sub_xxx                # Details + billing dates
creem subs pause sub_xxx              # Pause billing
creem subs resume sub_xxx             # Resume
creem subs cancel sub_xxx             # Cancel (end of period)
creem subs cancel sub_xxx --mode immediate  # Cancel now

Level 2: --json | jq Pipelines

Every command supports --json. The response shape is always { items: [...] }. This makes the CLI fully composable with jq, shell scripts, and cron.

Calculate MRR:

creem subs list --status active --json | jq '
  [.items[] | .product.price] | add / 100
'
# 125

Revenue by product:

creem txn list --json | jq '
  [.items[] | select(.status=="paid")]
  | group_by(.description)
  | map({
      product: .[0].description,
      total: ([.[].amount] | add / 100),
      count: length
    })
  | sort_by(-.total)
'

Customers by country:

creem customers list --json | jq '
  [.items[] | .country]
  | group_by(.) | map({country: .[0], count: length})
  | sort_by(-.count)
'

High-value transactions (over $20):

creem txn list --json | jq '
  [.items[] | select(.amount > 2000)]
  | map({id: .id, amount: (.amount/100), status: .status})
'

Product pricing table (tab-separated for spreadsheets):

creem products list --json | jq -r '
  .items[] | [.name, "$(.price/100)", .billingPeriod] | @tsv
'
# Starter    $9     every-month
# Pro        $29    every-month
# Enterprise $99    every-month
# Lifetime   $49    once

Find all past-due subscriptions with customer emails:

creem subs list --status past_due --json | jq '
  .items[] | {sub: .id, email: .customer.email, product: .product.name, since: .currentPeriodEndDate}
'

Bulk generate checkout links for all products:

creem products list --json | jq -r '.items[] | .id' | while read pid; do
  URL=$(creem checkouts create --product "$pid" --success-url "https://myapp.com/thanks" --json | jq -r '.checkoutUrl')
  NAME=$(creem products get "$pid" --json | jq -r '.name')
  echo "$NAME: $URL"
done

Daily revenue cron job:

#!/bin/bash
# Add to crontab: 0 9 * * * ~/daily-revenue.sh
REVENUE=$(creem txn list --json | jq '[.items[] | select(.status=="paid") | .amount] | add / 100')
SUBS=$(creem subs list --status active --json | jq '.items | length')
echo "$(date +%Y-%m-%d) | Revenue: $$REVENUE | Active subs: $SUBS" >> ~/creem-daily.log

Count subscriptions by status:

for status in active trialing past_due paused canceled; do
  COUNT=$(creem subs list --status $status --json | jq '.items | length')
  echo "$status: $COUNT"
done

Level 3: AI Agent via MCP Server

This is where it gets wild. The creem npm package ships with an MCP server — 22 tools that any MCP-compatible AI agent can call directly via the Creem SDK (not shelling out to the CLI like some custom solutions).

Setup for Claude Code / Claude Desktop:

Add to your MCP config:

{
  "mcpServers": {
    "creem": {
      "command": "npx",
      "args": ["-y", "--package", "creem", "--", "mcp", "start",
               "--api-key", "creem_test_xxx",
               "--server-index", "1"]
    }
  }
}

For Cursor, same format in .cursor/mcp.json.

What the AI can do:

The MCP server exposes tools the CLI doesn’t have. discounts-create and discounts-delete are MCP-only — the CLI can read discounts but can’t create them. licenses-activate/deactivate/validate and subscriptions-upgrade are also MCP-only. Through MCP, your AI agent has full CRUD access to your store.

All 22 tools:

products-get, products-create, products-search
customers-list, customers-retrieve, customers-generate-billing-links
subscriptions-get, subscriptions-cancel, subscriptions-update,
  subscriptions-upgrade, subscriptions-pause, subscriptions-resume,
  subscriptions-search-subscriptions
checkouts-retrieve, checkouts-create
licenses-activate, licenses-deactivate, licenses-validate
discounts-get, discounts-create, discounts-delete
transactions-get-by-id, transactions-search
stats-get-metrics-summary

Creem is one of the first payment platforms with native agent support. Their onboarding spec at creem.io/SKILL.md describes 7 routing workflows for AI agents — from selling products to managing subscriptions to handling support tickets.

Bonus: Migrate from Lemon Squeezy

Switching? One command:

creem migrate lemon-squeezy

Preview first with --dry-run:

creem migrate lemon-squeezy --dry-run

Or export the migration plan as JSON for review:

creem migrate lemon-squeezy --json > migration-plan.json

Skip discounts if you want to recreate them manually:

creem migrate lemon-squeezy --exclude-discounts

The wizard maps your products, pricing, and billing periods. No CSV exports, no manual data entry.

When to Use What

Three interfaces, one payment platform. Use each where it’s strongest.

Get Started

brew tap armitage-labs/creem && brew install creem
creem login
creem products list

Terminal to payments in 2 minutes. No dashboard required.

Built for the Creem Scoops bounty program. CLI v0.1.3, MCP server via creem v1.4.4.

Most rhythm tools show beats on a timeline. But rhythm is cyclical, not linear.

That got me thinking: what if we visualized rhythms as shapes?
So I built erhythm.org – it maps rhythm cycles onto a circle, where beats become points and patterns become polygons.
The result surprised me. Some complex rhythms that are hard to read on sheet music suddenly become obvious shapes.
→ Try one: Palito Afro-Cuban

How it works (conceptually)
Each step maps to an angle on a circle:
jsangle = (step / total_steps) * 360°
Connect the beats → you get a polygon. Some look random. Some are perfectly symmetrical. Some grooves just click visually.

Interesting side effect
Musicians say: “This makes polyrhythms easier to understand.”
Developers say: “This looks like algorithm visualization.”
Which makes sense – rhythm is a kind of algorithm.

Where it’s at
Still building. Working on more rhythms, better interaction, cleaner visuals.
Main project: erhythm.org

Does visualizing rhythm this way actually help understand patterns — or is traditional notation still better?

The modern Integrated Development Environment (IDE) is highly optimized, yet the biological hardware operating it—the human brain—remains vulnerable to external environmental friction. Standard acoustic interventions, commonly categorized as “focus music” or “Lo-Fi,” are systematically flawed for sustained deep work.

The Cognitive Bottleneck of Melodic Structures

When executing complex system architecture or engaging in deep debugging phases, the brain’s prefrontal cortex is at maximum capacity. Introducing music with melodic shifts, rhythmic changes, or transient spikes forces the brain’s pattern-recognition centers to continuously process auditory data. This creates micro-distractions, eventually leading to cognitive fatigue and the disruption of the flow state.

Engineering Neural Isolation

To solve this, auditory input must be treated as industrial infrastructure, not entertainment. The solution is Neural Isolation through mechanical audio pulses.

By generating a continuous, flat-frequency industrial soundscape, we can trigger the phenomenon of auditory masking. A 4-hour, sustained mechanical drone neutralizes unpredictable environmental noise (office chatter, street traffic) and “greys out” the auditory sensory channel. The brain quickly categorizes this static frequency as non-threatening background data and stops processing it, allowing 100% of cognitive bandwidth to be allocated to the terminal.

Deployment: The 4-Hour Industrial Reactor

We have engineered specific 4-hour acoustic environments designed purely for software developers, data analysts, and engineers requiring unbroken focus protocols. This is not music; it is an auditory shield.

[https://youtu.be/rRx8cfjfAHI]

System Integration

For developers operating in environments with extreme sensory pollution, maintaining an offline, lossless audio shield is mandatory to prevent algorithmic interruptions. High-fidelity iterations of these cognitive phase protocols are housed within the Velvet Realm terminal architecture.

Acoustic calibration is a fundamental component of your development stack. Optimize your workspace, initiate the sequence, and lock the terminal.

Someone reconstructed the Claude Code CLI source from npm sourcemaps and published it. Half a million lines of TypeScript. I read through it — not looking for bugs, just curious what a production AI tool looks like from the inside.

Turns out it’s a React app. Not a web app — a terminal app. The entire CLI is React components rendered to your terminal through a custom fork of Ink. That alone is a commitment most teams wouldn’t make. But the interesting parts aren’t the big architectural bets. They’re the small decisions nobody needed to make.

The loading spinner has 190 verbs

Not “Loading” 190 times. 190 different words.

“Flibbertigibbeting.” “Recombobulating.” “Lollygagging.” “Prestidigitating.” “Shenaniganing.” “Wibbling.”

And it’s configurable:

{
  "spinnerVerbs": {
    "mode": "append",
    "verbs": ["Pondering", "Ruminating"]
  }
}

append or replace. Someone built a config API for loading spinner verbs. That’s not a feature request. That’s a developer who thought “what if someone else wants to play?”

The thinking indicator is the “therefore” symbol

When Claude is thinking, the indicator shows ∴ — the mathematical symbol for “therefore.” Because the model is literally reasoning toward a conclusion.

No PM filed a ticket for this. It’s the kind of decision that happens when someone on the team cares about what symbols mean, even in a terminal. You’d never notice unless you knew what the symbol meant. And if you do, it’s hard to see it as anything other than deliberate.

The spinner architecture is where it gets interesting

The loading spinner has two components:

SpinnerWithVerb handles the state — which verb to show, whether the connection is stalled, what mode the agent is in. It re-renders when those things change.

SpinnerAnimationRow handles the animation — a 50ms tick that sweeps color across each character. It re-renders 20 times per second regardless of state.

From an inline comment in the component:

freed from the 50ms render loop and only re-renders when its props/app state change (~25x/turn instead of ~383x)

That’s a 15x reduction in parent re-renders from one component split. Standard React performance thinking, but applied to a terminal where every unnecessary render is a visible flicker.

The stalled-connection detection uses an exponential moving average instead of a threshold:

stalledIntensity += (target - stalledIntensity) * 0.1

The spinner text smoothly fades toward red when tokens stop arriving. No jarring color jump, no binary “stalled/not stalled.” Most implementations would flip a boolean after a timeout — stalled or not. This one lets you feel the connection degrading before anyone tells you it has. That’s feedback design.

Ratchet

There’s a component called Ratchet. It’s a container that only ever grows in height, never shrinks.

The problem it solves: when content toggles between states (thinking/not thinking, tool running/tool done), the prompt input bounces up and down. Ratchet locks minHeight to the maximum measured height. Layout only goes one direction.

Named after the mechanical device that locks in one direction. Perfect name, trivial implementation, solves a real problem that most terminal UIs just live with.

65ms before imports

The boot sequence fires parallel subprocesses — macOS Keychain reads, MDM policy checks — before the first import statement evaluates. The module graph takes ~135ms to load. By the time it’s done, the keychain result is already waiting.

The source comments quantify the savings. keychainPrefetch.ts documents exactly 65ms saved on macOS. Not “faster” — 65ms. This is a team that measures the boot path and optimizes against the measurement.

What it tells you

I’ve read a lot of codebases. Internal ones you inherit, open source ones you contribute to, vendor ones you’re stuck debugging on a weekend. Most have a clean public surface and progressively more chaos as you go deeper. The demo path is polished. The error paths are afterthoughts. The loading states are “Loading…”

This codebase has 190 spinner verbs, a mathematically meaningful thinking symbol, sub-character progress bars using 9 Unicode block elements for fractional fill, an animation architecture that quantifies render savings in comments, and a boot sequence that races subprocesses against module evaluation to save 65ms.

None of that was required. All of it was chosen.

The gap between what ships and what’s underneath tells you everything about whether a team treats the codebase as a product or as a means to a product. The spinner verb list isn’t a feature. It’s a culture artifact.

That’s where engineering taste lives — in the decisions nobody asked you to make.

The AZ-104 is not a memorisation exam. It’s a reasoning exam. Most candidates who fail don’t fail because they didn’t study — they fail because the exam tests edge cases, exceptions, and interactions between services that documentation explains individually but never shows you together.

These are the five topics that consistently expose that gap.

1. Management-Plane vs Data-Plane RBAC (Domain 01)

This is the single most tested distinction in the identity and governance
domain, and it’s the one that feels obvious until the exam puts it in a
scenario.

Here’s the trap: a user has the Storage Account Contributor role. Can
they read blob data from the storage account?

No. Storage Account Contributor is a management-plane role — it lets
you manage the storage account itself (configure settings, view keys,
manage network rules). It does not grant access to the data inside it.

To read blob data, you need a data-plane role: Storage Blob Data Reader
or Storage Blob Data Contributor.

Now the second trap: a user has the storage account’s access key. What
can they access?

Everything. Account key access bypasses RBAC entirely. A user with an
access key can read any content in the account regardless of what roles
they hold — or don’t hold.

The exam also tests the reverse: a user with a data-plane role but no
management-plane role tries to access blob data through the Azure portal.
This can fail even with the correct data-plane role because the portal
itself requires management-plane permissions to render the storage account
UI. Both layers are sometimes required depending on the access path.

📖 Every RBAC sub-topic and exact question type mapped out:
AZ-104 Domain 01 — Identities and Governance

2. VNet Peering Is Not Transitive (Domain 04)

Networking is widely considered the hardest domain on the AZ-104, and
VNet peering transitivity is the most reliably tested gotcha within it.

The setup: VNet A is peered with VNet B. VNet B is peered with VNet C.

Can VNet A reach VNet C?

No. VNet peering is not transitive by default. Each peering is a
direct, bilateral connection. VNet A can reach VNet B. VNet B can reach
VNet C. VNet A cannot reach VNet C through VNet B — even though a path
exists in the diagram.

To enable A-to-C connectivity, you need either a direct peering between A
and C, or a hub-and-spoke topology with a VPN Gateway or Azure Firewall
acting as the transit point with the “Use Remote Gateways” option enabled.

The exam also tests what happens when two VNets have overlapping address
spaces — you cannot peer them until the overlap is resolved. One VNet’s
address space must be modified first. And cross-tenant peering has
additional prerequisites that same-tenant peering does not require.

📖 Full VNet peering, NSG, DNS, and Bastion breakdown:
AZ-104 Domain 04 — Networking

3. SAS Token Types When Account Key Access Is Disabled (Domain 02)

There are three SAS token types on the AZ-104 and they are not
interchangeable. The exam specifically tests what happens when account key
access is disabled on a storage account — and most candidates don’t know
which tokens survive that change.

Here’s the breakdown:

• User delegation SAS — backed by Entra ID (Azure AD) credentials.
  Works even when account key access is disabled.
• Service SAS — signed with the account key. Blocked when account key
  access is disabled.
• Account SAS — also signed with the account key. Also blocked when
  account key access is disabled.

So if the exam tells you a storage account has account key access disabled
and asks which SAS type to use — the answer is always user delegation SAS.

There’s a second layer to this: the effective permissions a user gets
through a SAS are the intersection of their RBAC role permissions and
the SAS-defined permissions. The SAS cannot elevate access beyond what the
user’s role already allows. The exam tests both of these behaviours
separately and sometimes together in the same scenario.

📖 Full storage access mechanism breakdown including SAS, access keys,
and identity-based access:
AZ-104 Domain 02 — Storage

4. VMSS Autoscale Instance Count Calculation (Domain 03)

Domain 03 is the broadest domain on the exam — ARM templates, containers,
App Services, virtual machines. But the topic that causes the most
unexpected point loss is VMSS autoscale calculation, because it requires
arithmetic, not just knowledge.

The exam gives you a scenario like this:

• Starting instance count: 2
• Scale-out rule: if CPU > 70% for 5 minutes, add 2 instances
• Scale-in rule: if CPU < 30% for 5 minutes, remove 1 instance
• Cooldown period: 10 minutes
• Minimum instances: 2, Maximum: 8

Then it describes a CPU usage sequence over 30 minutes and asks: how many
instances are running at the end?

The trap is the cooldown period. After a scale event fires, no further
scale events can occur until the cooldown window has elapsed — even if the
CPU threshold is still being exceeded. Candidates who ignore the cooldown
end up with the wrong instance count.

You need to trace each 5-minute window, check whether the CPU threshold
is met, check whether the cooldown has expired since the last event, apply
the rule if both conditions are true, and track the running count against
the minimum and maximum limits throughout.

The only way to get comfortable with this is to practise it with actual
questions before exam day.

📖 Full compute domain breakdown including VMSS, availability sets,
containers, and App Service:
AZ-104 Domain 03 — Compute

5. Azure Budgets Don’t Stop Anything (Domain 01)

This one is short but it costs marks every sitting.

Azure Budgets let you set a spend threshold and configure alerts for when
costs approach or exceed that threshold. Most candidates assume a budget
acts as a spend cap — that once you hit the limit, Azure stops or
deallocates resources to prevent further charges.

It doesn’t. A Budget threshold triggers a notification. That’s it.
Resources continue running. New deployments continue succeeding. Your bill
continues growing. The Budget is purely an alerting mechanism.

The exam tests this directly — given a Budget with defined thresholds and
an action group, you need to determine what happens when costs reach those
thresholds. The correct answer is always: a notification is sent, nothing
else changes.

If you actually want to enforce a spend limit programmatically, you need
Azure Policy or automation runbooks — Budgets alone will not do it.

📖 Full governance domain coverage including Azure Policy, resource
locks, a