Four themes
Where the principles are applied: agents without drift, hard controls, compliance as automation, and data within limits.
Running agents without drift
Split autonomous coding agents into four separate loops, each with measurable progress rules.
- Work is delivered branch by branch: independent review, an automatic scan that blocks organisation data, an owner-approved merge.
- Reviewers are bound to the exact commit; heavy jobs run one at a time.
- One shared core repository with per-organisation instances.
Hard controls first
Sandboxing, isolation and limited credentials protect more than prompts or instruction files.
- Govern AI agents like capable but fallible operators.
- The design for a small, model-free host agent: it would run only allow-listed commands over git, with signed messages and no inbound port.
Compliance as automation
ISMS operations, risk registers and security tasks can run as automation instead of spreadsheets.
- ISO 27001 and SOC 2 programmes: audits and gap analysis.
- A hierarchical GRC framework on the CSA Cloud Controls Matrix, with automated control mapping and task workflows for ISMS audits.
- Readiness for the EU Cyber Resilience Act and the AI Act.
Data within limits
Retrieve, through an authenticated browser session, data a user can already see when official APIs or exports fall short, with the legal, contractual and security limits stated.
- Analysis and visual presentation in SQL, Python and BI for control and risk reporting.
Semantic web and knowledge graphs
Knowledge, requirements and evidence are best kept as a graph of linked statements, where every link says how reliable it is.
- Statements are nodes and the steps between them are edges; confidence grows when independent routes agree, not when one source is repeated.
- Connecting two models without forcing one shared vocabulary: each model describes itself, and every claimed link to another model is an explicit, checkable object.
- Splitting a definition into a few basic relations, so that "president" and "company manager" can be seen to share one structure.
Read: Compliance as a graph, not a spreadsheet Related projects →
Data lineage and trust
A dashboard number is the end of a chain of steps, so it deserves the same evidence checks as a compliance claim.
- Each derived column or metric is treated as a claim, with a trust score computed from what it was derived from.
- Definitions and translations between models carry a stated date, so a changed definition forces a review instead of being silently inherited.
- A way to onboard an unfamiliar system, such as an API or another agent: start from a generic template, query to fill it in, and amend it in a tracked way.
These are specifications and worked examples, not validated results.