Seven principles
The method behind everything on this site: run AI agents so that mistakes stay small, and let the same controls produce the evidence compliance needs. For a first step, see Work with me.
Agents will be wrong.
Assume any agent can be wrong or manipulated, and design so that a mistake cannot reach far.
Safety-critical systems are built this way. The question is not whether an agent errs but what the error is allowed to touch.
What it costs. Effort on controls for failures that may never come, and slower work in places.
Article: make an AI World work and stay compliantTry the gate lab
Hard controls beat good intentions.
Sandboxing, isolation and limited credentials protect more than prompts or instruction files.
A rule in a prompt asks an agent to behave. A control built into how the agent runs does not ask. Treat agents as capable but fallible operators.
What it costs. Less freedom for the agent: what a control forbids needs a person or a new rule.
Gate, isolate, record.
Nothing important changes without a gate; what must stay apart stays apart; every step leaves a record someone else can follow.
The same three controls apply on the web, inside an enterprise and in the lab that builds the agents. A gate is an independent review bound to the exact change, plus a person who approves it.
What it costs. Delay and approval fatigue. Gate the consequential actions and log the rest.
Article: three layers, one set of controlsProject: core and instancesProject: review and merge gates
People own decisions and evidence.
Agents do the legwork; people decide and own the evidence.
An agent's own summary is data, not proof. Check it against the system of record before repeating it, and keep each decision with a person who can be asked about it.
What it costs. People become the bottleneck: the owner's time sets the pace.
Compliance is a by-product of good work.
Operational evidence should come from the work itself, so that collecting and checking it can be automated.
When the controls that make a system work are the ones an auditor asks to see, compliance is no longer a second system on top. Scope, risk appetite and accountability stay with people.
What it costs. Automatic collection does not replace judgement about scope and risk.
Guide: the roads to complianceTheme: compliance as automationPresentation: the AI World
Relationships are data.
A requirement, a control, its evidence, a risk and a finding belong together as linked records with a history.
Write a control once and link it to every requirement it answers; a gap shows up as a requirement with nothing behind it. Record changes as events, so the past can be read back.
What it costs. Links need maintenance, and a stale link is worse than a stale row.
Article: compliance as a graphProject: a GRC platform on one graph
Show the method, not the setup.
The method is shared openly; names, hosts and company data are not.
Anything that is not ours is a link, not a file. What is shown can be checked and learned from; what is private stays private, and nothing goes public before its owner approves the exact text.
What it costs. Readers cannot check what they cannot see, so trust rests on the method and on evidence shared in other ways.
Where this stops working
No set of controls removes these risks. This approach narrows them.
- An agent can still be misled inside what it is allowed to do. A gate limits the damage; it does not make the agent right.
- Reviewers and scanners can be wrong or evaded. A marker scan misses what it was not built to look for.
- A person who approves everything stops reading. Gate the consequential actions and log the rest.
- Separation of duties needs real independence: whoever writes a change must not approve it.
- The system that records the evidence has to be trusted too. Independent sampling and tamper-evident records reduce that dependence; they do not remove it.
- A design in a lab is not an operating environment. Say which is which.
Words used here
- Agent
- Software that acts on someone's behalf, using a language model to decide its steps.
- Gate
- A point where a change stops until an independent check and a person approve it.
- Isolation
- Keeping apart what must stay apart: credentials, environments, data.
- Evidence
- Records of what happened and who decided, kept by default.
- Allow-list
- A short list of the only things a component may do. Anything else is refused.
- Marker scan
- An automatic check that blocks a change when it carries data that must not leave.
- Graph
- Records linked to one another, so that the relationships are data too.
- Projection
- The part of the graph a person is shown, decided by their role.
- Core and instance
- One shared body of tooling, and a separate working copy for each organisation.
- Agentic Web
- The web as used by software agents acting for people.
- Dev-lab
- The environment where agents are built and run.