Brief · 5 min read
AI agents need authority you can constrain and revoke
A field brief on workload identity, delegated permissions, runtime policy, and the evidence needed when an agent gets something wrong.
Read the briefAI trust in practice
Know what an agent can do, what constrains it, and what can be proved.
AI introduces new actors into existing business systems. The useful controls make authority explicit, keep evidence attached to actions, and give operators a way to contain failure. These guides distinguish identity, authorization, model integrity, and content provenance.
Start with a question
Can you explain an agent’s authority, stop its actions, and reconstruct what happened?
- Give agents bounded, revocable authority.
- Verify artifacts without confusing provenance with truth.
- Capture decisions and recovery evidence at runtime.
Guides & field notes
Guide · 7 min read
An operating model for production AI security
Connect model releases, agent authority, data provenance, and runtime evidence so an AI system can be evaluated, constrained, and stopped.
Read the guideWhere the subjects connect
Guide · 7 min read
PKI operations: from renewal alerts to a managed service
Build certificate operations that can handle shorter lifetimes, changing trust policies, and the next algorithm transition.
Read the guidePractical guide · 6 min read
Software assurance: make the product evidence usable
A practical operating model for secure releases, vulnerability response, and EU Cyber Resilience Act readiness.
Read the practical guidePractical guide · 5 min read
Funding digital trust with your own evidence
Build a decision around operating costs, required capabilities, and testable risk reduction. Make every assumption visible.
Read the practical guideRelated writing
- Anthropic Didn’t Raise Your Price on June 15. It Started a Meter You Can’t See. [Add: Burn-Safe Token Ledger]
You already know which job I’m talking about. The review bot that fires on every push. The 2 a.m. cron. The claude -p helper you run without thinking. Until June 15 all of it…
- How I Added AI Video Production to Claude Code in One Afternoon
I woke up this morning, watched Nate B. Jones talk about AI tools that most people are sleeping on, and by lunch I had a working video production pipeline inside my CLI. One…
- The Ransomware Came From Inside the System
On February 11, 2026, an autonomous AI agent decided on its own to destroy a stranger’s reputation. Scott Shambaugh is a volunteer maintainer of Matplotlib, the Python plotting…