Practical writing about leading technology teams, building useful tools and making better decisions about AI, security and data. The details that matter when you have to make something work.
Latest writing
From 10 December, privacy policies must describe computer programs that make or shape significant decisions about people. Finding them is the hard part. AI is only some of it.
Five practical ways to get more comfortable with AI this weekend, and the habits that carry straight over to work.
4 min read
Publicly trusted TLS server certificates issued since 15 March 2026 have a 200-day lifetime cap. Check renewal before the next reduction in March 2027.
5 min read
A consequence-led deployment decision for business agents: define the commitment, prove the limits, rehearse recovery and give someone authority to stop.
5 min read
Design useful abstention around missing evidence, ambiguous requests and access limits, with clear next steps instead of invented certainty.
5 min read
Treat model changes as application releases: preserve the tested configuration, check regressions, limit exposure and plan a fallback that remains available.
5 min read
Turn AI policy into task-specific instructions, clear data boundaries and a workable exception route rather than a list of approved brand names.
5 min read
Judge an AI coding tool by verified behaviour, dependencies, security and maintainability, not the volume of code it can generate.
5 min read
Local inference changes one data boundary; storage, tools, backups, access and operational ownership still determine whether the system is well governed.
5 min read
Budget for the ongoing work of source upkeep, access control, evaluation, support and change, not just model calls and application hosting.
5 min read
Keep a diagnostic trail of versions, authorised sources and action outcomes without turning routine AI logs into a sensitive conversation archive.
5 min read
Select models against a fixed business task, data terms and total completion cost, using your own cases rather than an unsupported league table.
5 min read
Treat retrieved text as untrusted input and contain what a manipulated model can disclose or execute through application-level controls.
5 min read
A meaningful approval shows the exact change, evidence and consequences, then binds consent to that operation rather than a vague request to continue.
5 min read
Design narrow action tools and scoped identities so an agent can finish its job without inheriting the whole application’s authority.
5 min read
Classify AI by what it can change, whose authority it uses and where transactions commit, rather than by the agent label.
5 min read
Measure completed work, review effort and attributable outcomes so an impressive AI demonstration does not become an unsupported savings claim.
5 min read
Build evaluation cases around actual decisions, difficult inputs and agreed behaviour, with holdouts and human adjudication that resist demo bias.
5 min read
Apply access rules before restricted passages reach the model, and test what happens when source permissions change after indexing.
5 min read
Retrieval can supply relevant evidence, but source quality, reasoning, permissions and refusal behaviour remain separate design problems.
5 min read
1–20 of 103 articles