LOCKEDIN / FORWARD-DEPLOYED ENGINEERING 101
Understand it.
Then build it.
You can be an experienced engineer and still be new to agents. Start with what each thing is and how it helps a person do useful work. Explore 58 original introductions across software, agents, cloud, security and delivery. Start here without a model key; each topic connects to deeper instruction and practice.
A place to start.
Choose a short reading route, or look up a concept below.
- 101UnderstandPlain language, visual walkthrough, vocabulary
- 102Build with guidanceOriginal lessons, examples and knowledge checks
- 103Practise and explainRunnable labs, failure cases and handover
Reusing earlier work
What is a cache?
A cache is a stored copy of data or earlier work that an application can reuse. Caching is a technique, not a model or language. A hit finds a reusable entry; a miss means the application must obtain or compute the result again. The difficult part is deciding whether that earlier work still applies.
An FDE must improve repeated AI requests without serving another customer's information or an obsolete answer. A fast result is only useful if it still belongs to this caller, task and source version.
UNDERSTAND THE SYSTEM
Can we reuse this earlier result?
Follow the same fictional excerpt through a repeat request, a changed source and revoked access. Select a part to see its job; advance the example to see why each decision changes.
Read the connections in plain English
- 01Current request → Reuse checks
Use trusted context to establish the active workspace and principal.
- 02Current source → Reuse checks
Look up current version and permission before trusting a saved copy.
- 03Reuse checks → Saved excerpt
Locate an entry only after current access is established.
- 04Reuse checks → Assemble excerpt
Missing, expired or obsolete entries require current source work.
- 05Assemble excerpt → Returned result
Store the assembled excerpt and its dependencies, then return it.
- 06Saved excerpt → Returned result
An eligible entry avoids rendering; authority checks still ran.
- 07Current source → Assemble excerpt
On a miss, read the source body from the active workspace before assembling a replacement.
- 08Assemble excerpt → Saved excerpt
Write the newly assembled excerpt, its source revision and expiry for a later request.
Check your understanding: The entry has four seconds left. Is it safe after permission changes?
No. Its age does not establish current authority. Check permission for this request and withhold on denial. Shortening TTL reduces an age window; it does not replace the access check.
CONNECT IT TO WHAT YOU KNOW
Start with something familiar.
Think of a build system reusing an earlier compiled artifact. Reuse is useful only when the inputs that mattered still match. A changed source file should invalidate its dependent output.
An AI response also depends on changing permissions, source versions and model or prompt configuration. A compiler's content hash alone cannot establish who may see a saved answer now.
Words worth knowing
- Cache key
- The identifier used to locate an entry. Its fields must distinguish requests that cannot safely share a result.
- Time to live (TTL)
- An allowed lifetime after which this entry is not reused. Being younger than the TTL does not establish current permission or source accuracy.
- Invalidation
- Making an earlier entry unusable when its dependencies change.
- Source of truth
- The authoritative record used to decide the current value or permission, rather than a convenient copy.
- Prompt caching
- A provider feature that can reuse processing of eligible repeated input. It is distinct from returning a saved final answer.
Useful foundations
Open a definition and diagram here. Your lesson stays in place.
Data foundations · object storage, SQL and retrievalFiles, databases and search indexes: what goes where?
QUICK REFERENCE / 101
Files, databases and search indexes: what goes where?
An application needs somewhere to keep information and a way to find it again. Object storage keeps named objects such as documents and images. A relational database organizes records into tables you can query and update. A search index helps find relevant material. These are different jobs, even when one product can do more than one of them.
An FDE needs to explain where the customer's information lives before connecting it to an agent. A convincing answer is not enough if it used an outdated procedure, lost a ticket update or crossed a customer's access boundary.
Access-control conceptsAuthentication, authorization and tenant isolation
QUICK REFERENCE / 101
Authentication, authorization and tenant isolation
Authentication establishes who or what is calling. Authorization decides what that identity may do. Tenant isolation keeps one organization's data and actions separate from another's. An agent's tool call is a proposed action, not proof of any of these permissions.
An FDE must protect real organizational boundaries even when prompts, retrieved text or tool arguments are hostile.
Selecting what a model seesWhat is context management?
QUICK REFERENCE / 101
What is context management?
Context is the information available to a model for a particular request: instructions, conversation, tool definitions and supplied evidence. Context management selects, orders, limits and refreshes that information. It is not the same as retraining the model or storing permanent memory.
FDEs need repeatable decisions based on current, authorized information rather than an accidental conversation history.
ONE EXAMPLE / FICTIONAL CASE
Follow the connections.
You assemble an excerpt from a fictional North workspace guide, then reuse it for the next identical request. The guide changes, or the caller loses access. Yesterday's successful read cannot authorize today's response.
UNDERSTAND THE SYSTEM
Can we reuse this earlier result?
Follow the same fictional excerpt through a repeat request, a changed source and revoked access. Select a part to see its job; advance the example to see why each decision changes.
See what moves and why.
Read the connections in plain English
- 01Current request → Reuse checks
Use trusted context to establish the active workspace and principal.
- 02Current source → Reuse checks
Look up current version and permission before trusting a saved copy.
- 03Reuse checks → Saved excerpt
Locate an entry only after current access is established.
- 04Reuse checks → Assemble excerpt
Missing, expired or obsolete entries require current source work.
- 05Assemble excerpt → Returned result
Store the assembled excerpt and its dependencies, then return it.
- 06Saved excerpt → Returned result
An eligible entry avoids rendering; authority checks still ran.
- 07Current source → Assemble excerpt
On a miss, read the source body from the active workspace before assembling a replacement.
- 08Assemble excerpt → Saved excerpt
Write the newly assembled excerpt, its source revision and expiry for a later request.
Check your understanding: The entry has four seconds left. Is it safe after permission changes?
No. Its age does not establish current authority. Check permission for this request and withhold on denial. Shortening TTL reduces an age window; it does not replace the access check.
Work through it, step by step.
Name what you are reusing
Choose the cached object: a source excerpt, generated answer or provider-managed prompt prefix. These are different layers with different contracts.
What you have now: One object and its source of truth.
Check whether it still applies
Establish current permission, workspace, source revision and allowed age. A key identifies a candidate; it is not an access decision.
What you have now: A justified hit, miss or withheld result.
Observe the whole request
Record avoided work alongside stale and denied cases. Include lookup and validation costs before claiming an improvement.
What you have now: An evidence table rather than a speed claim.
FROM RECOGNITION TO REASONING
Explain eight cache decisions using actual local rows.
- 01
Predict a repeat, a workspace switch, a source update and a permission change.
- 02
Run the SQLite lab and compare hits, misses, withheld results and excerpt-render counts.
- 03
Disable the source-version check and permission check in separate copies. Identify the stale and unauthorized returns.
Eight predicted and observed decisions, two isolated defects and one cache contract.
Compare your reasoning when you are ready
The warm request avoids rendering, while a changed source causes new work. Permission loss and missing current evidence withhold data even before the age limit. Removing either check creates a distinct defect; these local results are not a production consistency or performance proof.
Keep notes in your own working copy. Moving through these cards does not record completion.
TURN THE IDEA INTO USEFUL WORK
You can now go deeper.
A cache hit means you found something reusable only after the relevant checks. Expiry, source freshness and current authority answer different questions.
Academy lessons use your existing training access. Free guides stay open.