Working notes on the problems that come up repeatedly: threat modelling AI features, designing the control points that make a standard enforceable, and producing evidence that survives an audit. Technical, and free of anything a client would recognise as theirs.
Published occasionally rather than to a schedule. RSS.
· 6 min read
ISO 42001, the NIST AI RMF and DORA ask different questions of the same estate. The organisations that answer them cheaply are the ones whose controls emit evidence as a by-product of running.
· 8 min read
Agents are non-human identities that act on a user's behalf, change task mid-flight and chain to other agents. Most enterprise IAM models have no representation for that, and the gap shows up as over-permissioned service accounts.
· 6 min read
An AI gateway is the control point that makes an AI policy enforceable. It is not a firewall for prompts, and buying one does not constitute governance.
· 7 min read
A half-day method for assessing a specific AI feature: draw the trust boundaries the model crosses, work the four failure classes, and write controls a delivery team can actually build.
If a piece here is close to something you are dealing with, the quickest route is to describe the system and the deadline. I will tell you whether I am the right person for it.