Writing
Articles and field notes, newest first. This site is the original of every article; copies elsewhere link back here.
All writing
Newest first. Filters appear when JavaScript is on; without it the full list shows.
- AI agents
AI in compliance work: what it does well, what it does badly, and where a person must stay
Five areas of compliance work, what an AI agent can safely do in each, and the method that keeps a person responsible.
- Field notes
The Approval That Said Yes to Everything
A gate that asks about every change protects nothing, because attention runs out. A composite story.
- Field notes
The Evidence Folder That Was Very Thorough
A well-organised folder proved diligence, not control, and one question showed the difference. A composite story.
- Field notes
The Training Everybody Passed
Everyone finished the awareness course; a test message showed what that meant. A composite story.
- AI security
A tiny host agent: no model, no inbound port
A design, not built: a small agent that reports host facts and runs only allow-listed commands on signed instructions over git, with nothing listening. Why each choice, what it costs, and what it does not protect against.
- Semantic web
Compliance as a graph, not a spreadsheet
Requirements, controls, evidence, risks and audit findings are related things. Kept as linked records rather than spreadsheets, they give traceability, history, mapping across frameworks and safe agent access.
- AI agents
From the Agentic Web to the dev-lab: three layers, one set of controls
Where agents act (web, enterprise, lab) and the same three controls that keep each layer safe. Roles and method only.
- AI agents
How to make an AI World work and stay compliant
Why gated, isolated agents that leave evidence are also the compliant ones.
- Automation
When the API Is Not Enough: Browser-Assisted Data Extraction on Behalf of the User
Using an authenticated browser session to retrieve data a user can already see when APIs or exports fall short, with the legal, contractual and security limits spelled out. Medium.
- AI agents
The Four-Loop Pattern: Running Autonomous Coding Agents Without Drift
Four separated loops with measurable progress rules for autonomous coding agents, including an honest account of not following them while writing the article. Medium.
- AI security
Hard Controls First: What AI Coding Agents Teach Us About Real Security
Why sandboxing, isolation and limited credentials protect more than prompts, and why AI agents should be governed like capable but fallible operators. Medium.