Archive

Agent governance cannot stop at model behavior. Once AI systems use tools, the governed object is the whole workflow.

An agent is not autonomous because it can try a task. It is autonomous when the system can tell whether the task worked.

Agent-native apps do not become trustworthy when an agent can call tools. They become trustworthy when the app can prove those tools worked.

Proportionate AI governance only works when the lighter path is earned by evidence, not granted by missing concerns.

A system has not published when the source is correct. It has published when the reader-facing surface is correct.

Recent work only becomes public writing when the claim survives the removal of the event that produced it.

In a concurrent agent system, verifying the latest artefact is not verification. It is a scheduling bet.

When a supply chain attack lands and the timeline is asking for discipline, the durable fix is one layer down — at the package manager, not at your attention span.

Corrections that fire by judgment drift; checks that fire by trigger don't. When your AI assistant keeps making the same mistake, move the gate.

Citing a vendor defender product in a paper that argues the threat surface is moving faster than controls undercuts the case it is supposed to support.

If you are about to assert that a tool isn't installed, run `which` first. The check is one line. The cost of skipping it is a half-hour of defensive scaffolding for a problem that wasn't there.

The first time you run a quality gate against real data, the output is less about the gate and more about the data.

When your tool depends on the host, declare the dependency at the gate. Don't wrap it. Don't patch around it.

Model risk reviews the model. Application security reviews the application. Neither sits behind the agent at execution time, watching the verbs as they go out.

Persona-based AI reviews predict how stakeholders will react to a paper. They cannot tell you whether to act on those predictions, because the commissioning history is invisible to the lens.

AI cannot help an enterprise that cannot describe itself, and governance failure surfaces faster than optimisation failure.

Compression did not simply shorten the notes. It sharpened them. Headers and bullets had been doing the thinking the prose was supposed to do.

Forty thousand stars are voting on something. The framework verdict was correct. Closing the file was premature — the value still lives in the dependency tree.

A clever optimisation that was a silent regression. The override flags survived out of habit. None of the reasons survived contact with the actual numbers.

One paper for two audiences reads like leverage. It is actually a trap. The director commissions; the board governs a portfolio. They cannot read the same document.

Five rounds of the same question produced diminishing returns by round three. Then I changed the question — same document, different reviewer.

Vercel was breached through a third-party AI tool's OAuth token. The lesson is not about Vercel's security — it is about how every AI tool you onboard extends your attack surface in ways your governance framework does not track.

If you can replace 'agent' with 'application' and the principle still reads fine, it was never about agents.

Nous Research shipped an open-source personal agent that does most of what my bespoke system does. Here is what they got right, what they traded away, and what I stole.

Self-improving AI agents sound like the dream. But auto-generated knowledge is cheap, and cheap knowledge plateaus. The agents that compound are the ones someone tends.

Most agentic AI governance frameworks treat logging and assurance as the same thing. They're not. One records what happened. The other judges whether it was correct.

What Browser Harness gets right isn't the absence of structure — it's structure that emerges from use.

LLMs check whether each item in a list sounds right individually. They don't check whether all items are the same kind of thing.

The value of running six frontier models isn't six perspectives — it's six chances to be wrong, which means you can set a much higher bar for what counts as right.

Garry Tan's gstack arrived at the same architectural decisions I did, independently. The convergence matters more than either implementation.