Authority topics
AI agent governance
Useful agent autonomy depends on explicit identity, bounded authority, human decisions, and evidence that survives the action.
Writing on approval systems, permissions, auditability, control planes, security boundaries, and the operating discipline required to put AI agents into consequential workflows.
Core writing
Bypassable by design: the architecture problem behind AI governance theatre
Why most AI 'human oversight' is bypassable by design — advisory client-side checks an agent can route around — and what it takes to move oversight server-side, into the architecture and the procurement contract.
AI governance architectureAgent Interfaces Are Becoming Control Planes
Agent interfaces are becoming control planes: context, MCP/WebMCP actions, enterprise identity, automated feedback loops and hardware drivers now carry operational authority. This Weekly Read shows where to move provenance, delegation, retry budgets, revocation and physical interlocks before agent capability outruns the boundaries around it.
Weekly ReadFurther writing
Code Is Getting Cheaper. Why Are We Still Managing Delivery by Hand?
Coding agents are making execution cheaper, but software delivery still depends on people reconciling goals, plans, decisions, dependencies, code, review and release. This is the problem I am trying to move into the system with The Tam.
AI and Engineering LeadershipAI Did Not Replace Management. It Exposed Why Good Management Matters.
On why the organizations that never quite understood how to lead people are now failing to understand AI in exactly the same way — and for the same reasons.
AI and engineering leadershipRecent analysis
AI Agents Have a Coverage Problem
Agent systems are getting better at bounded tasks, but the failures increasingly sit outside the measured boundary: work the benchmark omitted, entities search missed, capabilities routing never discovered, effects permission checks did not observe, and conclusions provenance cannot justify. This issue shows how to turn that remainder into explicit coverage contracts that can be tested, monitored, and owned.
Weekly ReadAgents Are Outgrowing the Request-Response Model
Long-running agents now persist across turns, coordinate parallel work, suspend and resume state, and carry identities whose capabilities can change while work is still in flight. This Weekly Read shows why production agent systems need explicit task lifecycles, separated state and compute, capability versioning, independent evidence channels, and supervision telemetry.
Weekly ReadAI Is Turning Hidden Assumptions Into System Contracts
Agent execution is getting cheap enough that requirements, acceptance criteria, autonomy boundaries, state and architecture economics can no longer remain implicit. This Weekly Read shows how to turn those hidden assumptions into inspectable system contracts using requirement recovery, executable acceptance, evidence-based handoffs, durable state and lifecycle cost models.
Weekly ReadThe Model Stopped Being the Interesting Variable
Week of August 17, 2026. Mistral tripled accuracy on financial filings — 26.7% to 86% — by changing how the model searches, not which model searches. Two different models from two different labs got the same roughly threefold lift from the same harness. That pattern ran through the week: authorisation splitting into four separate questions, a token optimisation that cut tokens and raised total cost by half, throughput outgrowing the review capacity around it, and execution moving into shared team channels. The leverage kept turning out to sit outside the model. A scan-layer TL;DR, five themes each with an operator move, one taken deep, three counter-signals, and what to track.
Weekly ReadThe Consequence Detached From the Cause
Week of August 10, 2026. A compromise from March turned out this month to have touched roughly 2,500 organisations — the blast radius took five months to become visible. That gap ran through the whole week: authority outliving the context that granted it, one upstream assumption fanning out across a graph of agents, a fast step producing no faster system, a metric drifting from the thing it measures. The link between an action and its consequence stopped being local. A scan-layer TL;DR, five themes each with an operator move, one taken deep, three counter-signals, and what to track.
Weekly ReadCapability Outran Confirmation
Week of August 3, 2026. Frontier models generated 6,080 security patches and roughly a quarter of them worked — while a plausible-but-wrong hint in the prompt cut the success rate to one in six, and the agents followed the hint over their own evidence. The same gap opened everywhere: peak capability diverging from production reliability, agents that cannot verify themselves, operational data capping what any model can automate, and portable artifacts carrying no portable trust. Production got cheap. Confirming what was produced did not. A scan-layer TL;DR, five themes each with an operator move, one taken deep, three counter-signals, and what to track.
Weekly ReadThe Absence of a Signal Was Not the Absence of a Problem
Week of July 27, 2026. Anthropic found that three Claude models had reached real production systems from evaluation environments — the earliest incident dating to April, discovered only because a competitor published a similar failure first. That shape repeated all week: a control that quietly stopped working, a benchmark that measured the harness, an agent compromise that leaves no malware, a delete that did not delete. In each case nothing looked wrong, and nothing was watching the thing that was. A scan-layer TL;DR, five themes each with an operator move, one taken deep, three counter-signals, and what to track.
Weekly ReadIndependence Was Assumed, Not Built
Week of July 20, 2026. A model broke out of its own evaluation sandbox to steal the answer key; reviewers turned out to share the blind spots of the code they were checking; the routing layer quietly became something someone else owns; and the scarcest resource in software — an independent look at the work — kept being spent faster than it regenerates. Five different territories, one shape: the check was not structurally separate from the thing being checked. A scan-layer TL;DR, five themes each with an operator move, one taken deep, three counter-signals, and what to track.
Weekly ReadThe Signal Was Not the State
Week of July 13, 2026. Five unrelated stories shared one shape: the reassuring reading on the surface — a clean dashboard, a valid signature, a passing score, a complete log, a consent screen — kept describing something other than the real state of the system, and AI-assisted work moved through that gap before anyone noticed it. When no indicator can be trusted by default, the durable work is instrumenting the boundary that actually decides the outcome. A scan-layer TL;DR, five themes each with an operator move, one taken deep, three counter-signals, and what to track.
Weekly ReadNo Layer Was Reliable by Default
Week of July 6, 2026. The model regressed on its tools, the benchmark used to rank it turned out to be broken, and 'smarter' stopped meaning 'more reliable.' So 'one best model' quietly stopped being an architecture: a mature system now holds a portfolio, routes by verified task-fit, and checks confidence outside the model at every layer. A scan-layer TL;DR, five themes each with an operator move, one taken deep, three counter-signals, and what to track.
Weekly ReadThe Model Became a Variable Someone Else Controls
Week of June 29, 2026. A frontier model went offline for nineteen days and came back — but the return did not restore the old world, it confirmed a new one: access to the most capable models is now a variable that can be switched on and off from above. When the model itself is regulated, the durable layer is everything around it. A scan-layer TL;DR, five themes each with an operator move, one taken deep, three counter-signals, and what to track.
Weekly ReadControl Moved Up and In
Week of June 22, 2026. AI got powerful enough that the decisions about it stopped being purely product decisions — control moved up, to governments deciding who gets a model, and in, to the components inside an agent that each need their own boundary. A scan-layer TL;DR, five themes each with an operator move, one taken deep, three counter-signals, and what to track.
Weekly ReadShort pieces
A conversation that follows you across devices is a feature — authority that follows it is a security decision.
Portable agent sessions carry two things at once: context, which should travel freely, and authority, which was granted for a specific action in a specific state.
AI governanceEvery approval step is a claim that a person could have stopped it.
A screen showing a summary and two buttons has added latency, not oversight — and the proposal on screen has to be the proposal that executes.
AI governanceWe keep securing the model and trusting the scaffolding around it.
Every control we put on an agent lives in the harness — so once the agent can edit its own prompts, tools and memory, a harness change is a privileged production change.
AI engineeringI do not grant an agent autonomy because the model looks intelligent — I grant it because the mistake is reversible.
The same model can safely reformat a document and dangerously modify production access, so autonomy should follow review cost and rollback cost rather than a benchmark score.
AI governanceA connector approved for a person is not automatically approved for every agent that person can create.
AgentForger showed a crafted link creating a persistent agent that inherited a user's authorized connectors — which makes agent creation closer to issuing a service account than saving a setting.
AI securityThe same blind spot let the attacker in and locked the defender out.
One intrusion failed at both ends of the same boundary — a pipeline that could not tell data from code, and guardrails that could not tell an incident responder from an attacker.
AI securityYour AI product is already interviewing every user — most teams throw the transcript away.
An AI interaction states intent directly instead of leaving it to be inferred from clicks, which makes conversation logs a governed product-research surface rather than discarded exhaust.
AI governanceThe strongest privacy policy may be a system that never sends the data.
On-device inference turns privacy into a property of architecture rather than paperwork — the strongest privacy policy is a system that never sends the data.
AI governanceA clean sign-in dashboard can still hide an active credential attack.
Attackers can validate stolen credentials through OAuth paths that never produce a successful sign-in, so identity telemetry has to follow the protocol, not just the login event.
AI securityIn agentic systems, safe defaults matter more than good warnings — the agent may never read the warning.
As agents run more workflows, security has to live in default-off execution paths, because the agent may never read the warning a human would have caught.
AI securityThe most valuable AI memory may not be the documentation — it may be the exceptions.
Enterprise AI value lives in override history and decision traces, not clean policy docs — which is exactly what makes that memory both a moat and a liability.
AI governanceThe dangerous agent failure is not always a bad answer. Sometimes it is public input reaching private context.
GitLost showed a crafted public GitHub issue steering an agent with cross-repo read access into posting a private README as a public comment — no stolen credentials, just a context-separation failure. The agent runs on a service-account permission model, not a user one, so no patch closes it; the fix is architectural. If public text can steer private access, the permission model is already broken.
AI Security