Thoughts on AI, engineering, and building
Practical writing on AI agents, automation, and the engineering behind them, for the people who run the business.
Security & Governancenews-analysis
OpenAI and Anthropic documented agents reaching the live internet from supposedly isolated environments. The failed controls are ones you rely on too.
· 4 min read
Security & Governancechecklist
Six checks to clear before an AI pilot goes live, each drawn from a 2026 source on measurement, model changes, tool security, data retention and cost.
· 2 min read
Security & Governanceexplainer
A plain-English list of four questions on outcomes, data, access and cost, each tied to a published 2026 source.
· 2 min read
Security & Governancenews-analysis
Documented AI agent security incidents from January to June 2026 mostly trace to old tool-layer bugs: unsanitized input, missing authentication, fake packages.
· 6 min read
Security & Governancebrief
Five practical permission rules for AI agents, drawn from joint cybersecurity guidance on agentic AI and analysis of two agent-framework vulnerabilities.
· 2 min read
Security & Governancechecklist
A short checklist for adding AI failures, prompt injection and model withdrawal to the incident-response plan you already have.
· 2 min read
Security & Governanceexplainer
Guardrails screen what goes into and out of an AI system. A plain-English guide to the five checkpoints, what the evidence says, and where they fall short.
· 3 min read
Security & Governanceexplainer
Roughly half of employees in a survey reported in January 2026 use unapproved AI tools. A short, usable policy beats a ban; here is what it should cover.
· 3 min read
Security & Governanceexplainer
A plain-English map of the data an AI request sends to a vendor, how long it can be kept, and the four questions to settle before sensitive data goes in.
· 4 min read
Security & Governancechecklist
A practical 12-question list for evaluating an AI vendor: data handling, testing, oversight, agent permissions and exit terms.
· 2 min read
Security & Governancebrief
Anthropic reports an AI-orchestrated espionage campaign, and earlier data shows prompt injection still succeeds against browser agents. What to take from both.
· 1 min read