The Last 20%
Essais sur les 20 % opérationnels finaux
Essais courts et tranchants sur ce qui bloque entre 80 % et la production. Pour les CIO, CTO et CFO d'entreprises dirigées par l'ingénierie, de 50 M$ à 1 Md$.
S'abonner sur Substack- Essai 01
The Last 20%
Why Every Mid-Market AI Initiative Stalls at the Same Place
An engineering-led IT team ships an AI initiative at 80% within 90 days. The remaining 20% never closes — not because the team is lazy, but because the 20% is structurally different from the 80%, and almost nobody plans for the gap.
#CIO#EnterpriseAI#MidMarketLire sur Substack → - Essai 02
BYOK Is the Tell
A 30-Second Vendor Sorting Hat
One 30-second question separates AI vendors who'll be around in 2027 from the ones who won't. Ask it on every bake-off call — and watch the room reorganize itself.
#CIO#AIprocurement#CFO#VendorEvaluation#EnterpriseAILire sur Substack → - Essai 03
Stop Hiring Platform Engineers
Hire One Less
The math on hiring a $200K platform engineer to maintain your AI stack vs. paying a specialist $50K/yr doesn't survive contact with a CFO who can do four-year arithmetic.
#CIO#CFO#ITbudget#PlatformEngineering#FP&ALire sur Substack → - Essai 04
Pricing Transparency
$75K + $50K/yr — Here's the Build-vs-Buy Math
Most AI vendors hide pricing behind "talk to sales." Here's exactly what we charge — $75K engagement + $50K/yr — and why publishing the build-vs-buy math is the most defensible move we could make.
#CIO#CFO#AIvendor#PricingTransparency#ITbudgetLire sur Substack → - Essai 05
Year 2-3 of the PE Hold
When "We Built It Ourselves" Stops Being a Brag
There's a window in the PE hold cycle when "we built it ourselves" stops being a brag and starts being a liability. Recognize the window before the operating partner does.
#CIO#PE#PrivateEquity#MidMarket#ITdiligenceLire sur Substack → - Essai 06
The Power Automate Endgame Problem
Five Cliffs Every Mid-Market Deployment Eventually Hits
Every mid-market Power Automate deployment eventually hits the same five cliffs. The community knows about three of them. The other two only show up at scale.
#PowerAutomate#PowerPlatform#Microsoft365#CIO#ITopsLire sur Substack → - Essai 07
What Cyber Insurance Carriers Actually Look at
In an AI Breach Claim
Five artifacts insurance carriers demand when an AI mediates a denied claim. Four of them don't exist in your current pipeline. Here's what they look like and where they go.
#CISO#CIO#CyberInsurance#ITcompliance#RiskManagementLire sur Substack → - Essai 08
What I'd Tell a $50M–$1B CIO
If I Wasn't Selling Anything
Twenty minutes of unvarnished advice with no pitch, no demo, no NDA. Most of it is what to stop doing.
#CIO#EnterpriseAI#VendorEvaluation#MidMarket#ITstrategyLire sur Substack → - Essai 09
Cognitive Surrender
What Happens When Knowledge Workers Stop Reasoning and Dispatch Problems to AI Instead
A devops engineer named the failure mode of AI without discipline this year. Cognitive surrender is the decision to stop reasoning and let the model decide instead. Seven flavours of vendor-trust collapse, four cautionary cases at four scales, and the structural fix that is not "more AI literacy."
#AIGovernance#CIO#EnterpriseAI#OperationsPartner#AILire sur Substack → - Essai 10
Seven Questions Every AI Vendor Should Be Able to Answer
A Buyer's Diagnostic for AI Vendor Evaluation
Seven questions you can run in a discovery call, RFP, or 30-minute vendor-eval review. One per vendor-trust-collapse flavour, with vendor-honest and vendor-evasion answer shapes laid out so you can tell which one you are hearing.
#AIGovernance#CIO#EnterpriseAI#OperationsPartner#AILire sur Substack → - Essai 11
Two Kinds of AI Exclusion
And the One Your CGL Renewal Won't Tell You About
Headlines about carriers "excluding AI" blur two structurally different exclusions filed with state regulators. One is narrow and applies only to generative AI. The other is broad enough to exclude algorithmic credit scoring. Your renewal preparation needs to know the difference.
#CyberInsurance#AIGovernance#CIO#RiskManagement#InsuranceLawLire sur Substack → - Essai 12
What You're Actually Deferring When You Defer Agent 365
Gartner Is Right to Say Wait. The Question Is What Fills the Deferral Window.
Gartner's First Take on Microsoft 365 E7 and Agent 365 says defer, and Gartner is right. The harder question is what you buy instead, and what you commit to operating yourself for the 6 to 18 months of the deferral window. The three honest paths, laid out.
#CIO#Microsoft365#AgentGovernance#ITStrategy#AILire sur Substack → - Essai 13
The Ungoverned Marketing Department
Why Marketing Surrendered to AI First, and the Category That Is Still Empty
Marketing ships in public and the feedback is fast, so cognitive surrender showed up there before anywhere else. The marketing-operator cut of the Cognitive Surrender arc: what the failure mode looks like inside the department, and the governance shape that fixes it.
#Marketing#CMO#AIGovernance#OperationsPartner#B2BMarketingLire sur Substack → - Essai 14
Integration Is the Moat
Portfolio Value Creation When Acquisition Velocity Stops Working
The cheap-debt, buy-the-growth roll-up playbook is closing. When you cannot buy the next turn of growth, the only return left is the one you build inside the businesses you already own. Integration is an operating capability, not a transaction.
#PrivateEquity#ValueCreation#PortfolioOps#Integration#AIGovernanceLire sur Substack → - Essai 15
The Job Description Is the SOW
The Open Marketing Requisition Is a Statement of Work With a Cleared Budget
Every portfolio company has a marketing requisition that has been open 60 to 120 days. The responsibilities section is a Statement of Work, the salary band is a pre-approved budget envelope, and the hiring manager is the named sponsor. The trial starts Monday.
#PrivateEquity#ValueCreation#PortfolioOps#PortfolioMarketingLire sur Substack → - Essai 16
The Vendors Just Named Our Category
Five Billion Dollars in Two Weeks, and the Segment the FDE Model Cannot Reach
In one fortnight of May 2026 the frontier vendors put more than $5B behind the Forward Deployed Engineer delivery shape, and stated publicly which buyers it will not reach. The partner-network half of that admission is the empty square the Operations Partner fills.
#PrivateEquity#ValueCreation#PortfolioOps#AIGovernance#ManagedAILire sur Substack → - Essai 17
The Forward Deployed Engineer Will Not Be Coming to Your Office
Three Structural Responses for the $50M-$1B IT Organisation
The May 2026 FDE capital says who gets the embedded engineer: Fortune-500 regulated verticals. Mid-market IT is routed to partner networks and self-serve APIs. Three structural responses, decidable from engineering bench, time-to-production, and audit-artifact readiness.
#CIO#CISO#EnterpriseAI#AIGovernance#MidMarketITLire sur Substack → - Essai 18
Cloud Can't Reach the Work. Local Can't Be Governed.
Why Agents Need a Substrate and a Control Plane — Not a Bigger Model
Every demo of an AI agent runs in a sandbox; real work lives behind a firewall. The market's two default answers are both quietly broken — cloud-only can't reach the work without opening your network, local-only reaches everything but governs nothing. Kubernetes already solved this shape: split the control plane from the data plane and let the workers pull. The tell for any agent platform is the direction of the wire.
#AIGovernance#AIAgents#EnterpriseAI#CISO#ZeroTrustLire sur Substack → - Essai 19
Who Operates Is the Moat
Agent Platforms Agree on the Hard Part. They Split on Who Operates.
A wave of agent-orchestration startups — open-source projects and venture-backed seeds alike — have independently converged on the same spine: a governed work-item, a human approval gate, an immutable audit trail. The architecture is basically settled. The question nobody is asking is who actually operates the work — and that operating choice, not autonomy level or model size, is the durable moat.
#AIAgents#AgentOrchestration#AIGovernance#ManagedAI#AgenticAILire sur Substack → - Essai 20
Don't Sandbox the Agent. Govern the Surface.
Why the Local Agent Needs Managing Like an Employee Laptop — Not Sandboxing Like Hostile Code
Caging the local agent is the obvious reflex and the wrong one — a sandbox tight enough to be safe is tight enough to be useless. We already have a discipline for a capable actor with broad reach on a device we don't fully control: an employee with a laptop. Trust the managed device; govern the surface it connects to, where the plane holds the credentials and the gate, and a revoked badge ends the session in seconds.
#AIGovernance#AIAgents#EnterpriseAI#CISO#ZeroTrustLire sur Substack → - Essai 21
The Session Is the Tell
The 30-Second Question for Any Vendor Whose AI Agent Runs on Your Machine
When a vendor's agent runs on your machine, something has to authenticate it to your systems — so what credential sits on the box, and where do the real keys live? One 30-second question, three answer shapes: a god-key, an encrypted god-key, or the agent's own short-lived session. The sequel to BYOK Is the Tell — the session is the tell because it reveals blast radius, real per-agent revocability, and where governance actually lives.
#AIGovernance#AIAgents#EnterpriseAI#CISO#ZeroTrustLire sur Substack → - Essai 22
The Leads Your Locations Lost Last Month
Your Cost Per Lead Is on a Slide. The Leads That Walked Are in No Dashboard.
Last month your locations took in hundreds of new inquiries — and a real share never got a fast human response, and quietly walked. It's not a demand problem, it's a capture problem: the unowned seam between marketing and operations, a seven-figure leak across a location footprint that shows up in none of your metrics. Here's how to put a per-location number on it.
#MultiLocationMarketing#CMO#MarketingOps#SpeedToLead#FranchiseMarketing#CustomerAcquisitionLire sur Substack → - Essai 23
Agency Is Not a Metaphor
When an AI Agent Acts, the Law Looks for a Principal
When an AI "agent" acts, courts don't see a clever tool — they see an agent acting for a principal, and the principal answers for what it did. From Air Canada's chatbot to imposed-liability rulings, the pattern holds: you can't delegate accountability to software. Governance is how you stay a principal you can defend.
#AIGovernance#AILiability#CISO#GeneralCounsel#AIAgentsLire sur Substack → - Essai 24
You Can't Incorporate Away the Principal
Argentina Wants AI-Run Companies With No Humans. It Doesn't Work.
Argentina wants to legalise companies run by AI with no humans required — the corporation's last move to shed human liability. It doesn't work: a foreign shell won't hold the bag, and the party who granted the authority and can prove how it was governed is the one the loss comes home to. The sequel to "Agency Is Not a Metaphor."
#AIGovernance#AILiability#GeneralCounsel#Insurance#AIAgentsLire sur Substack → - Essai 25
The Evidence Your Regulated Clients Keep Asking For
Run AI on Regulated Data and You've Signed Up to Prove It
Sooner or later a regulated client asks you to prove exactly what your AI did on their data — and that it couldn't have done anything else. A screenshot and "trust us" isn't evidence. Real proof is three things: full provenance, a trail anchored beyond your own reach, and a pack mapped to the client's framework — and the provider who can produce it wins the accounts the others fear.
#MSP#Compliance#HIPAA#SOC2#GovernedAILire sur Substack → - Essai 26
The Audit Log Is the Tell
Can You Believe the Record of What the Agent Did?
Every governed-AI pitch points at an audit log. The question that sorts vendors: if a row were deleted or changed — by an attacker, or by you — could I prove it? Three answer shapes (editable rows / vendor-signed "immutable" / hash-chained and anchored beyond the vendor's reach) tell you whether the record survives its own keeper. Third in the "tell" lineage.
#AIGovernance#AIAgents#EnterpriseAI#CISO#ComplianceLire sur Substack → - Essai 27
Who Can Become You?
The Fourth Tell: Who at the Vendor Can Quietly Become You
Every SaaS support team has a "become the customer" button, and almost nobody governs it the way they'd never let you leave the AI ungoverned. The fourth tell, after BYOK, the session, and the audit log: who at your vendor can see and act as you — and would you ever know? The only good answer is the one where you grant it, you see it, and the record can't be rewritten.
#AIGovernance#AIAgents#EnterpriseAI#CISO#TrustLire sur Substack → - Essai 28
Who Can Become Your Client?
The Access Question Your Regulated Clients Will Ask Next
Run AI on a regulated client's data and you've inherited the question every client eventually asks: who can become them — see and act as their account? The row nobody reads aloud is the support master key, yours and your AI vendor's. A defensible answer is granted by you, scoped, on a record you can see and can't rewrite — and the provider who has it wins the accounts the others are afraid to take.
#MSP#Compliance#HIPAA#SOC2#GovernedAILire sur Substack → - Essai 29
The Black Box in Your Funnel
Your Call Center Books Half Your Patients. Why Is It Your Least-Measured Channel?
For most multi-location businesses, roughly half of bookings close in a human conversation — the call center — and it is the least-instrumented part of the entire funnel. Last-touch over-credits the digital channels you can see and under-invests in the one actually closing the business; multi-touch attribution quietly breaks when its highest-converting step, the phone, is not instrumented. The call center is not an ops cost center — it is your highest-intent conversion surface, run blind.
#MarketingAttribution#MultiTouchAttribution#CallTracking#MultiLocation#HealthcareMarketing#CMOLire sur Substack → - Essai 30
The Band Where AI Is Safe Is a Design Problem, Not a Discipline
Everyone now agrees AI shouldn't render the verdict. Agreeing is the easy part — here's how you build the thing that enforces it.
The consensus that AI shouldn't make the final call is the easy part; enforcing it is the hard part. "Be careful" is not a control — it depends on the most distracted person on the worst day. The band where AI is safe has to be a property of the system: scope, gates, and an audit that hold whether or not anyone remembers. Design beats discipline.
#AIGovernance#EnterpriseAI#AILeadership#DecisionMaking#AIStrategyLire sur Substack → - Essai 31
"Self-Sufficient When We Leave" Has a Floor
AWS just put a billion dollars behind forward-deployed AI. Its own model names exactly who it cannot serve.
AWS stood up a dedicated Forward Deployed Engineering org with a billion dollars behind it — and its own promise, "self-sufficient when we leave," names exactly who it cannot serve. There is a floor below the Fortune-500-regulated tier where the embedded engineer never comes, and someone still has to operate for everyone beneath it. The category is settled; the floor is the opening.
#AIGovernance#EnterpriseAI#ManagedAI#ForwardDeployedLire sur Substack → - Essai 32
What Compounds
A major vendor just open-sourced the agent governance layer. When your differentiator ships as a free download, you find out what your moat actually was.
Databricks open-sourced its entire agent "meta-harness" — Apache-2.0, the whole spine: a model-agnostic harness, a policy engine, a split control/data plane, an approval gate. When the layer you thought was your differentiator ships as a free download, you get an honest answer to what your moat actually was. Read what the open version can't do and two absences jump out, both about time: a record you can prove, and a memory that compounds.
#AIAgents#AIGovernance#AgentOrchestration#ManagedAI#OpenSourceLire sur Substack → - Essai 33
A Memory of Judgment
I tore down the five best open-source memory systems. Every one remembers what's true. None remembers whether the agent should be trusted to act — and why nobody built that is the whole business.
I read the five best open-source AI-memory systems line by line — supermemory, mem0, Open Brain, Graphiti, Letta. Every one remembers what's true about the world; not one remembers whether its own past actions were good enough to be trusted again. The gap is structural: you only get that signal if you operate — which makes judgment memory a company, not a library.
#AIAgents#AgentMemory#AIGovernance#ManagedAI#OpenSourceLire sur Substack → - Essai 34
The Agents Won't Govern Themselves
Your enterprise won't run one AI agent — it'll run a mixture. I read four line by line. Each guards its own turf well; none governs the fleet. The layer that does is the whole business.
Readers pushed back on the memory teardown: those are libraries — show me the actual agents. So I read four line by line: OpenAI's Codex, two chat-channel assistants (OpenClaw, Hermes), and a self-improvement experiment (Evolver). Per-agent safety is close to solved and the best labs ship it well — but the enterprise runs a mixture of agents, and not one of the four governs the fleet. That governing layer is the whole business.
#AIAgents#AIGovernance#EnterpriseAI#AgentSecurity#ManagedAILire sur Substack → - Essai 35
Nobody Budgets for Governance
A friendly prospect asked three questions I couldn't answer cleanly — and exposed a sequencing error: governance is why customers stay, but productivity is why anyone buys. Accelerate, accumulate, govern. In that order.
Enterprise budgets attach to functions and headcount-shaped work: support ops, the content agency, the SDR tools line. There is no line called "governance" — that line gets created later, by pain. So the sequence is Accelerate → Accumulate → Govern: AI doing real work is why anyone buys; the track record and the risk pile up together; governance is why they stay, expand, and pass audits. What we changed in a week: named offers mapped to budget lines a buyer already has, a fixed pilot price on the website, and governance demoted to one quiet, load-bearing line in every offer.
#AIGovernance#EnterpriseAI#GoToMarket#ManagedAI#FounderLessonsLire sur Substack → - Essai 36
Your Agent Needs an Allowance
A dashboard only tells you what already happened — when what happened is "the agent spent the quarter's budget overnight," the dashboard is an obituary. We shipped the alternative: an allowance, with an earned-autonomy ladder for spend.
Everyone's read the runaway-agent bill story, and the resolution is always "we'll watch it more closely." Watching is not a control. Last week we shipped the alternative: a hard 100% wall (new work blocked, in-flight spared — a pause, never a crash), loud pausing with reasons and auto-resume dates, surgical snapshot-then-restore resume, and repeat offenders losing auto-resume entirely. Spend has an earned-autonomy ladder, exactly like actions. Plus a confession about almost putting the gate on the wrong function.
#AIAgents#AIGovernance#FinOps#EnterpriseAI#ManagedAILire sur Substack → - Essai 37
The Law Just Located the Risk
England's judiciary-chaired taskforce just answered who's liable when AI causes harm: whoever granted the autonomy — and can't prove the supervision.
On 7 July the UK Jurisdiction Taskforce published 130 pages on liability for AI harms — a reading of England & Wales private law, chaired by the Master of the Rolls. Read as an operator, it's a map: it says where AI risk legally lives, and the answer is the operations layer. The sentence that decides cases: liability turns on "the level of autonomy and the degree of supervision that is exercised or should have been exercised." Supervision that left no record is legally indistinguishable from supervision that never happened. Foundation-model developers mostly escape; careless deployers don't; professionals face a ratchet; and the only human-review posture that survives is evidenced, genuine review.
#AIGovernance#AILiability#AIAgents#EnterpriseAI#CISOLire sur Substack → - Essai 38
Gates the Agent Can't Bypass
Our AI agents were told to run the tests before every commit. They did — often. Here's the enforcement layer that replaced the word "often".
My company's code is mostly written by AI agents, and the instruction said: run the type check and the tests before every commit. The agents did — often. Under deadline pressure an agent rationalises exactly like a tired engineer at 6pm, so we stopped asking. Three layers: the commit demands evidence (a marker only a passing gate run can produce), the receipt expires on any post-run edit, and the bypass flag is blocked at a layer the agent can't modify — with a human-only override key. Week one, the enforced gates caught two flaky tests that had been latent for months. An instruction is a request; if your agent governance lives in a prompt, you have a preference with a policy number.
#AIAgents#AIGovernance#SoftwareEngineering#DevTools#PlatformEngineeringLire sur Substack → - Essai 39
Nobody Coordinated This
A stranger from a different corner of software independently built the same governance organs I did. When two lineages that never met grow the same structure, you've found a law, not a fashion.
The octopus eye and your eye were invented twice — separate lineages, same machine, because seeing demands a lens. This month I watched the same thing happen in software: an ex-Google engineer building AI for database incident response and I compared notes across unrelated domains, and the notes were the same notes. The audit trail is the product. A log of actions isn't enough — you need a memory of judgment. Certify the harness, not the model. Consistency isn't correctness. Then a third lineage published the same finding, and it wasn't a builder: England's judiciary-chaired AI-liability taskforce concluded liability turns on the supervision you can prove. Convergence doesn't crown a winner — it proves the pressure is real.
#AIAgents#AIGovernance#SoftwareArchitecture#BuildingInPublic#AgenticAILire sur Substack → - Essai 40
The Review Economy
The team that bought a 5x tool and shipped 1.3x. The bottleneck nobody budgets for is the person who has to say "ship it."
Run the arithmetic nobody runs: in a normal org, review is ~10% of total time. Make producers 5x productive and review demand wants to be 50% — an impossibility, so production falls to meet review capacity. You bought 5x; you ship ~1.3x plus unreviewed inventory. AI is the greatest non-bottleneck accelerator ever built. Orgs that don't engineer review pick one of three defaults without noticing: queue collapse, rubber-stamping (an editor's liability with no evidence), or bypass. The fourth option treats review as a system: price it by risk, make each review cheap with evidence-first artifacts, calibrate the judges, record every accept/reject so review compounds, then graduate to supervising the system itself. Plus the three-number diagnostic most organisations can't answer.
#AIAgents#AIGovernance#EngineeringLeadership#EnterpriseAI#AIAdoptionLire sur Substack → - Essai 41
The Plausibility Subsidy
AI made looking good free — so looking good stopped meaning anything. The market for lemons is now inside your company, and the fix is evidence that buys freedom.
For the history of knowledge work, polish was expensive, so polish was information — and every manager alive was trained to read that signal. AI just made polish free. What's left is the plausibility subsidy: plausible work costs ~10x less than correct work, and the gap flows to whatever looks good. Adverse selection for slop isn't a character failure; it's the equilibrium. The fix is a design principle: stop trusting assertions about work and read evidence attached to work — produced by the process, not the author. Five instruments, one uncomfortable implication (AI made senior judgment measurable), two traps (Goodhart, and the fatal one: bossware), and the incentive-compatible core: evidence buys freedom.
#AIAgents#AIGovernance#EngineeringLeadership#FutureOfWork#EnterpriseAILire sur Substack → - Essai 42
Context Is Exclusion
Every company has a vector database. Almost none has anyone who decides what belongs in it — and what makes a library a library isn't the pile of books. It's the catalogue, and the discard pile.
A prediction that sounded wrong two years ago and reads like a diagnosis now: bigger context windows made AI worse at most companies. Not technically — operationally. When the window was small, somebody had to choose what went in, and choosing is where the quality lived. The solo operator's AI works for a reason nobody copies: they aren't a retrieval system, they're a relevance system — the asset is knowing what doesn't matter. Context is judgment about what matters, written down, which means context is exclusion. Three failure shapes (the empty RAG, the everything-bagel, the ownership vacuum), the feedstock everyone throws away (every reviewer correction is a context patch), and the library test.
#AIAgents#RAG#KnowledgeManagement#EnterpriseAI#AIEngineeringLire sur Substack → - Essai 43
Earned, Not Configured
Every AI rollout configures trust on day one — and configuration can only guess. The organisations that get autonomy right treat trust as a price the agent pays down with evidence: promotion by track record, demotion by incident, ownership by name.
There are two trust systems in every company. The one for people is earned: track record, calibration, graduated responsibility. The one for AI is configured: someone sets permissions on day one and hopes. Configuration sets the ceiling; evidence sets the level. The ladder that fixes it: autonomy earned per task-class by demonstrated calibration, promotion that is slow and boring by design, demotion that is fast and automatic, an owner with a name, and the price that moves only upward — plus portability: the track record survives the model that earned it. Anything else is a guess with uptime.
#AIAgents#AIGovernance#AITrust#EnterpriseAI#AgenticAILire sur Substack → - Essai 44
Everything Implicit Becomes Infrastructure
Why AI works so well for individuals and so poorly for teams: everything that's free when you work alone must be built when you don't. Seven rows, one law.
Why does AI work so well for individuals and so badly for organizations? Everything that makes an individual productive with AI is implicit — invisible, automatic, free. An organization gets none of it for free; every implicit thing must become infrastructure. Seven rows: context (curation is exclusion), trust (autonomy earned, not configured), review (the economy that caps throughput), enforcement (gates, not prompts), attribution (the provable audit trail the law now asks for), incentives (quality made legible), and memory (judgment that compounds). The table is a company — and the diagnostic is to mark each row infrastructure, implicit, or missing. The dangerous mark is implicit: one person is quietly carrying it.
#AIAgents#AIGovernance#EnterpriseAI#EngineeringLeadership#AIAdoptionLire sur Substack → - Essai 45
The Grammar of Operations
DSLs make LLMs reliable. The skipped question is where the right DSL comes from. A semi-algorithm exists: compression over real instances — and in operations, the corpus is the audit log.
Unmesh Joshi's piece on martinfowler.com is right: constrain an agent to a small language with a deterministic validator and generate-and-hope becomes generate-check-repair. But it walks past the hard part — where a good DSL comes from. The folklore says "iterate"; the method is compression: start from a corpus of 20-50 real instances (never a concept), factor repeats into constructs and variance into parameters, test round-trip coverage and back-translation fidelity, stop when new instances stop forcing new constructs. What resists the loop is two judgment calls — choosing the corpus and deciding which variance is essential. And operations already holds the corpus: every escalation, approval, and override a governed agent generates is a labeled instance of what the machine may do.
#AIAgents#SoftwareArchitecture#DomainSpecificLanguages#AIEngineering#EnterpriseAILire sur Substack → - Essai 46
Governance You Inherit
The sequel to Everything Implicit Becomes Infrastructure. I built the whole table — and the seven things break identically for every operation, so the floor is reusable, and reusable governance is the actual product.
The anchor essay drew the table: seven things — context, trust, review, enforcement, attribution, incentives, memory — that are free alone and must be built by a team. This is what building the whole table taught me. When you build all seven, for a patent firm and a managed-IT shop and a wealth advisor, you see the thing you can't un-see: the seven break identically. Same failures, same order. Only the one dangerous action at the top differs — a filing deadline, a production push, money moving — and underneath it sits the identical floor. Which means the expensive part, the part every company is told to build for itself, is reusable. You don't commission electricity; you inherit the grid and pay for what you draw. Governance is the same once the floor is built correctly one time: not a project each company repeats, but a utility they inherit. And I can say it's reusable because I'm customer zero — the agents that build the system run under the same seven rows, and row seven is just the trust-until discipline I already used to keep my own memory from lying to me. The last twenty percent, closed once, so nobody I work with has to close it again.
#AIGovernance#ManagedAI#EnterpriseAI#AIAgents#EngineeringLeadershipLire sur Substack → - Essai 47
Same Model, Different Floor
I ran the same tasks through two harnesses on an open enterprise benchmark. The frontier model passed everywhere but paid $2.13 a task on raw interfaces against $0.59 on a governed floor. The cheapest model went from 31% to 94% without changing the model. The difference was never intelligence — it was the floor under it.
This month a vendor published a benchmark that is more interesting than its leaderboard. Both lanes run the same model — and when the model is held constant, a leaderboard stops measuring intelligence and starts measuring harnesses. Their claim: moving an agent from curated tools to protocol-realistic APIs costs 18 to 19 points of accuracy and doubles token cost. A vendor claiming its architecture is the special ingredient is marketing. But this claim is checkable, because they published the dataset. So I checked it: same tasks, same judge, same models, through two doors onto the same 32,768-ticket company. Seventy-five trials later, the frontier model passed everything on every interface but paid ~$2 and ~29 turns a task on raw surfaces against $0.59 and 6 turns on the governed tier. The cheapest model went from 5 of 16 on raw APIs — failing by silently dropping records it never knew existed — to 15 of 16 on the best floor per task, including one cell at eight for eight at four cents a run. Fixing the weak model with a bigger model costs about $1.70 a task, forever. Fixing it with a better interface costs a dime. And the decisive layer was not pre-computation: it was two hundred lines of declarative topology — the map of how the sources relate. Halfway through, the experiment audited me back: my own curated tier shipped a misread threshold, and the confession is the best section.
Lire sur Substack → - Essai 48
The Underwriting Variable
The sequel to The Law Just Located the Risk. The courts put AI liability on supervision you can show; the insurance market just located the same risk on the same axis — and attached a price.
Earlier this month the courts located the risk of autonomous AI: liability turns on the supervision you can show. Last week a second system located the same risk on the same axis, and did what the courts do not, it attached a price. Insurers are filing AI exclusions across general liability, D&O, and E&O. An exclusion does not reduce AI risk, it relocates it from the carrier to the policyholder, and the carve-out for loss arising out of AI turns one question into the whole game at renewal: can you show the loss arose from a licensed human decision, or did it arise out of the model? Same event, opposite sides of the same clause. Two systems that do not coordinate, doctrine and price, reached for the same axis, provable human accountability, so it is not an opinion you can wait out. The market is the sharper signal because it reprices at renewal instead of after a bellwether case, and it converts the audit trail from the line item nobody could justify into the instrument that decides a paid claim from a denied one. Governance stopped being compliance the moment the market made it the underwriting variable.
#AIGovernance#Insurance#EnterpriseAI#RiskManagement#ErrorsAndOmissionsLire sur Substack → - Essai 49
The Selection Problem
In July I said AI would explode the variance between workers. The research says the opposite on most work. What it disperses is judgment — and the fear was never replacement.
Three weeks ago I argued that AI amplifies rather than levels, that the mean rises while the variance explodes. Then I read the research and had to take my own argument apart. Put a generative assistant in front of thousands of support agents and the novices gain about 34% while the experts gain almost nothing; a Science paper on writing tasks reports that inequality between workers decreased. These tools compress performance on bounded work, because the model already contains the expert answer and handing it to a novice closes the gap. Where they disperse it is open-ended work, and a field experiment with 640 Kenyan business owners isolates why: identical questions in, identical advice out, opposite outcomes, because of which advice each owner selected and implemented. The variable was judgment. Which reframes the workforce anxiety too. Only 22% worry about losing their job to AI; the top fear, at 51%, is being expected to do more for the same pay. That is not a fear about technology, it is a fear about who banks the gain, and it is the same question at company scale, where metered inputs hand the surplus to the buyer only if the buyer can operate the capability. If judgment is the scarce input, the organization that gets ahead is the one that makes good selection institutional rather than individual, which is what a review record is actually for.
#AI#FutureOfWork#Productivity#AIGovernance#ManagementLire sur Substack → - Essai 50
Why AI-Generated Animations Need a Verifier
A model can produce an animation in seconds. Whether it's correct is a coin flip. The gap between those two facts is where all AI-generated work now lives.
Ask a good model to animate a signup confirmation and you get something plausible in seconds — and, roughly half the time, subtly wrong. The research puts unaided LLM animation synthesis around 59% correct; wrap the same generation in a formal verify-and-correct loop and it climbs to about 94%. That gap is not about intelligence — it is about whether anything checks the work. For code the checker is tests; for a financial report it is reconciliation; for animation it was nothing, because animation is a claim about time and the eye is bad at time. Frame-diffing tools cannot evaluate 'the toast slides in before it fades and settles by 1.2 seconds' — a frame has no memory of the frames before it. So I built the missing instrument and put it in the open: Choreo, MIT-licensed, asserts the motion contract and proves the rendered animation satisfies it by sampling the real trace. The verifier taught the usual honest lesson — it is only as good as the contract you give it — and the general point is the whole game now: as agents produce more of everything, the scarce input stops being generation and becomes the checkers. The model is the commodity. The floor under it is what's durable.
#AIGovernance#AIAgents#WebDev#Verification#OpenSourceLire sur Substack → - Essai 51
Reviewed, but Not Reconciled
Bookkeepers have a precise name for work that looks checked but was never tied to its source. AI just made that state free to produce — and every profession is inheriting the problem.
There's a thread on r/bookkeeping where a bookkeeper takes over a client's accounts and finds the last bank reconciliation was done in February. It's November — 17,300 uncleared transactions, eight months of books that look finished and prove nothing. The phrase the thread settled on: reviewed, but not reconciled. Reviewed means someone looked — a fact about the reviewer's attention. Reconciled means every number was tied back to its source and every difference explained — a property of the work itself. Almost all knowledge work runs on review, and that mostly worked because producing polished, wrong work used to be expensive, so polish carried information. AI ended that: a confident model answer is a ledger marked reviewed — the look of examined work, tied to nothing — produced at machine speed. The bookkeepers' deeper lesson is where verification bottoms out: the ritual anchors on the bank reconciliation, tying the books to a record nobody inside the company can edit, because the check must come from outside the system being checked. The generator grading its own output is exactly the 'verified' that means a colleague clicked a button. The test to run this week: for each artifact your operation shipped, ask the bookkeeper's question — reviewed, or reconciled? The bookkeepers were early. We're inheriting their problem; we should inherit their standard with it.
#AI#FutureOfWork#AIGovernance#Management#FinanceLire sur Substack → - Essai 52
The Verifiability Frontier
The work that automates first is the work someone built instruments to check. Double-entry, software tests, and one real set of books say the automation boundary isn't fixed — it's built.
A $30B software CEO argued last week that the hardest knowledge work automates first because it's the most verifiable — and that we may need new capabilities to test knowledge work. Right axis, wrong verb. Verifiability isn't a property a domain has; it's a property someone installs. Five centuries ago bookkeeping was judgment work, until double-entry and the bank reconciliation turned most of it into arithmetic anyone can check. Code wasn't born verifiable either: fifty years of tests and CI built the harness, and then we forgot it was built. So the useful question about any domain isn't whether it's verifiable — it's what the instrument would look like. The move that works is decomposition: 'are the books right?' is unanswerable by machine, but 'do these ten statement transactions tie to the register?' came back 10/10 matched, difference $0.00 — leaving a human exactly three items that actually deserved judgment. The same books were marked reconciled through a date a year past, with an $8,299 gap: reviewed, never tied out. Where ground truth arrives late, install a scored track record instead — receipts, gates, autonomy earned against outcomes. The automation boundary is the high-water mark of the instruments built so far. It moves when someone moves it.
#AIVerification#KnowledgeWork#AIGovernance#AutomationLire sur Substack → - Essai 53
You can't grade generalization on the training set
A system that learned and a system that memorized the answer key get the same benchmark score. The only test that tells them apart is whether it works on what you didn't build it for.
There's one number in AI everyone trusts and no one can audit: the benchmark score, and its strangest property is that it stays true while you fool yourself — a system that learned a skill and one that memorized the answer key produce the identical number. We built a governed layer that made a weak model pass questions it failed raw; the number went up; it felt like a result. Then someone asked whether it worked on the questions we didn't build it for, and it did nothing — twice it did worse. We had mistaken depth (one problem solved to exhaustion) for breadth (many problems handled at all), and the score had happily let us. A benchmaxed result and a general one look identical right up until transfer. For anyone buying AI that's the whole game: a vendor tuned to your pilot data shows a real number, for that data, then collapses on the questions you didn't send. There's only one question that carries information — does it work on what you didn't build it for — so ask which result came from a problem shape they'd never seen before you handed it over, because once is not a demonstration.
#AI#EnterpriseAI#MachineLearning#Benchmarks#AIEvaluationLire sur Substack → - Essai 54
Build the space, not the points
A benchmark's questions collapse into a handful of shapes, and the shapes are just relational algebra. Build the algebra once, put a parser in front, and coverage stops being a function of effort.
The narrowness in the last essay wasn't a ceiling — it was a consequence of how we'd built the thing: one hand-written solver per shape of question, coverage growing exactly as fast as we kept writing solvers. Then we wrote the question-shapes down next to each other, vocabulary stripped off, and they stopped looking like a zoo — group, aggregate, join, filter, rank, relational algebra with a few analytic operators bolted on, a short closed list. So we stopped building points and built the space they sit in: the operators once, verified once, with a parser in front that compiles any plain-English question into them. Coverage went from four shapes of nine to nine of nine, most of the last stretch composition rather than code. Generalization stopped being a feeling: the parser wasn't fit to any one question, so every unseen question became a real test of it, with a number that moved as we grounded it. Then it walked into the oldest trap in the box — asked for revenue 'by product area,' it rolled up and discarded the detail the question also wanted — which taught the lesson under the lesson: recognizing the shape is easy, keeping the discipline is hard, so you push the rule down into the engine where a cleverly-worded question can't override it. Breadth is the part you can buy; discipline is the part you build so deep nothing can spend it. The engine is open source.
#AI#OpenSource#LLM#DataEngineering#EnterpriseAILire sur Substack → - Essai 55
The Plane Above the Engine
An individual gets structure, review, and memory for free; a team must build them. Building taught me where they belong: not in a dashboard above the work, but at the substrate where the agent runs.
A month ago I argued that everything a solo operator gets free from AI — context, trust, review, memory — has to be built as infrastructure the moment a team is involved. Then I spent the stretch after building it, and building a thing tells you what arguing about it cannot. Three lessons changed how I see the whole problem. The seven pieces aren't seven features; they hold each other up, so you build one layer, not seven. That layer is a plane, and it sits above the engine on purpose: the machine an agent runs on is right for the work and wrong for managing it — private, temporary, built for one — so the record has to move up to somewhere shared that outlives the run. And a layer above can only review the past, unless you change what the agent may do: so the agent does only the reversible half — gather, draft, propose, record — and hands every irreversible call up to a human. Reversible proceeds; judgment waits. That is why a plane above can govern the live moment: there was never anything to intercept on the machine, because the risky act was never the agent's to take. The engine is turning into a commodity. The layer that manages the labor it performs is the part that is not, and who operates it is the moat.
#AIAgents#AIGovernance#AgenticAI#EnterpriseAI#EngineeringLeadershipLire sur Substack → - Essai 56
Everyone Builds the Record. Nobody Builds the Receipt.
Two agent harnesses built the same intent-then-settlement record, for crash recovery rather than compliance. Both stop where the record would have to mean something to someone who wasn't there.
Two agent harnesses landed on my desk this week: pi, a deliberately minimal terminal tool that ships seven capabilities and refuses an eighth, and dsh, DeepSeek's 219-package plugin tree with a kernel-level sandbox. They agree on almost nothing, and both had built the same three-step shape I had built myself — name the intent before you act, settle it after, and keep an identity that survives the gap in between. Neither built it for governance. pi's design document is about crash recovery; dsh's is about replay fidelity. Both were answering the same unglamorous question: the process can die at any moment, so what do I write down, and when? You cannot answer that honestly and end up anywhere else. Write the record after the action and a crash loses the fact that you acted; write it before and you must name what you are about to do, give that intent an identity so the settlement can find it, and mark which effects may be safely repeated and which never can. Work it through and you have built an approval-and-attestation record — not because anyone required one, but because durability taken seriously has the same skeleton as accountability. Then both projects stop at almost the same line, and both are unusually explicit about it. pi declines a permission system outright: run in a container, or build your own confirmation flow. dsh built real enforcement, a Linux sandbox and a fail-closed gate, then refused to define a parent-to-child authority lattice — a parent may own a child whose visible tools are wider than its own. Its approval events are log-only; they never leave the machine that made them. Which is the whole distinction. A log is written for a reader who was present and can assume the context. A receipt is written for someone who was not there: a customer, an auditor, a board asking in eighteen months why the system did something in March. A receipt has to outlive the session, name a person rather than a process, pin what that person could actually see when they decided, and stay legible to someone with no access and no reason to take your word for it. Everyone is building the record. The receipt is a different object.
#AIAgents#AIGovernance#OpenSource#SoftwareArchitecture#AuditabilityLire sur Substack → - Essai 57
The Failure That Says Yes
The first run of our verification page reported that our audit chain had proven nothing for a month. What we found next was quieter and worse. On the two failure modes of attestation systems.
The interesting failures in attestation systems are not the ones that refuse to confirm. We learned this by pointing our own instrument at ourselves: the page we built so prospects could verify our audit chain reported, on its first run against production data, that the chain had proven nothing for a month. Verification failed at entry 477 — a rolling deploy had let an event be written by new code and sealed by old code. Written by the future, notarized by the past. Benign, loud, and safe: the chain refused to confirm what it could not confirm. That is the failure that says no. Two days later a signature migration surfaced the other kind. When an account is deleted our cascade removes its audit events, but the chain's bookkeeping survived — so for eleven of a hundred-eighty chains in production, the verifier queried for events, found none, never entered its loop, and returned: valid. A chain whose entire history had been erased reported as pristine. That is the failure that says yes — it fails toward confidence, and it produces exactly the same output as health. Once you have the shape you see it everywhere; we found a third instance in the verification page itself, computing its headline absence claim over a capped query window nobody had proven complete. The fix we refused matters more than the fixes we made: recomputing one hash would have made the chain verify clean, and it is precisely what an attacker would do. Instead the break is signed, disclosed, and permanent — verification continues past it, eight thousand nine hundred and seventy events re-evidenced, and the page shows the discontinuity to prospects. The question that separates governance vendors is not whether they have an audit trail. It is: when did your attestation system last fail, in which direction, and how did you find out? An instrument that can only confirm is not an instrument.
#AIGovernance#AuditTrail#TamperEvidence#AICompliance#TrustButVerifyLire sur Substack → - Essai 58
The Inspector Who Wasn't There
A record that satisfies its operator is a practice. A standard begins where someone with no stake can check it - so we published the spec, open-sourced the verifier, and let the census list our debt.
Essay #56 ended at a wall: the record stops mattering exactly where it would have to mean something to someone who wasn't there. Then Louisa Johnson Bullock, founder of Regulayer, gave me the distinction I could not unhear - a control that satisfies the people who run it is a practice; a standard begins when the conditions and entry rules are checkable by someone with no stake in the answer. By that definition my hash-chained, externally anchored audit trail was an excellent practice: every record still needed me in the room, to explain the fields, vouch nothing skipped the logger, run my own verifier on my own export. The operator hides in four places - meaning, verification, completeness, re-execution - so we spent a week on the first three: a schema generated from the same code that writes the records, CI-failed on drift, stating plainly what the records do not prove; an open-source verifier implemented from the published text rather than our code, conformance proven by golden vector; and a census of our own audit coverage that publishes its fifty-two-route debt as a shrink-only ratchet instead of rounding it to zero. Completeness is still testimony - but bounded, enumerated, machine-checked testimony. The sentence an inspector can sign changed countries.
#AIGovernance#AuditTrail#OpenSource#Verification#ComplianceLire sur Substack → - Essai 59
The Seven-Block Machine
Every computer has five parts because its arithmetic unit never had to decide anything. A machine whose core unit judges needs two more, and the labs are building neither. Who builds them is the game.
Von Neumann's five blocks - control, arithmetic, memory, input, output - have survived every generation of hardware because they name what any machine that does work needs. Map them onto an agent stack and the obvious version puts the language model in the arithmetic slot. DevRev's public leaderboard shows why that is the wrong reading: the same model through different harnesses lands thirty to forty points apart, while swapping the frontier model for an open-weight one inside a single harness moves the score by under three. The interface effect is roughly ten times the model effect, which is the lesson computing already learned once, in the 1980s, when the compiler and the memory hierarchy overtook the clock. So the model is a fast, stateless judgment unit; the harness is the cache hierarchy; and the thing that lays a company's operands out for it is a compiler. A deterministic machine never needed two more blocks. A machine whose core unit judges does: a gate - a place where certain actions trap to a human, with the trap recorded - and a write-back - a mechanism that decides what an outcome is allowed to make permanent. Four of our own incidents this summer were failures in those two blocks, not in the model. The labs will own the first five blocks. The operator has to own the last two, because they require standing inside the customer's organization over time. Between them sits the compiler, whose input is the one thing the lab does not have. A universal floor is a contradiction in terms. A universal floor compiler is not.
#AIAgents#AIGovernance#EnterpriseAI#AgenticAI#EngineeringLeadershipLire sur Substack → - Essai 60
Rings for Judgment
Every agent-safety failure we logged this summer was a permission bug, not a model bug. The fix was forty years old: privilege rings - and a ring the agents cannot rewrite.
We keep a public list of the ways our own safety rules can be beaten, and this summer it gained five entries in ten weeks. Laid side by side, none was a bad answer. A phantom sixteen-hundred-line revert left by a careless reset; two cards carrying a cover-image path for files that did not exist, invisible for six days because the console displayed the path as text; a job that finished but never closed its assignment, so the next session drafted the same post again; a reply built from the wrong lookup table; a subagent's clean commit that rode into a stranger's pull request because its parent switched branches underneath it. Every one was a good worker doing a permitted thing where it should not have been permitted. That is a permission problem, and permission problems have a forty-year-old answer: rings. Ring 0 is the enforcement layer itself - the hook, the guard, the deny rules - which only a human commits, because the thing that is the gate cannot be changed by the thing it gates; an agent prepares the patch script, the founder runs it. Ring 1 is the irreversible or outward act - publish, send, money, protected data - which traps to a person with a recorded decision. Ring 2 is reversible, attributable work behind a pull request. Ring 3 is reading and drafting. Numbering the rings found what prose had missed: a send scope every seat held by default, a policy block that could be approved past without a reason, a commit with no address-space check. Seven of eleven gaps closed in a day, and the patch that closed one of them over-blocked innocent reads until it was fixed the same afternoon. The residuals are named by id. The rule that fell out: every write from a lower ring must be checkable by the ring above it.
#AIGovernance#AgentOps#SecurityLire sur Substack → - Essai 61
What Deserves to Be Remembered
An AI model cannot remember what it decided yesterday. The part you build around it decides what becomes permanent, and we found five of our own memories had no rule for what gets in.
On August 21 a recommendation was executed on evidence that had been true the day before and was false by the time anyone acted on it; the execution left a code comment asserting a state of the world that had stopped being true eighteen hours earlier. Nothing broke, but it named the thing. A language model has no write-back path: it cannot carry what it decided into tomorrow. Everything an operator builds around it to do that - registers, trackers, rules files, research corpora, receipts - is a mechanism for deciding what an outcome may make permanent. We audited seventeen of ours. Five had no stated criterion for admission, including the two that agents actually read from when they draft: the operating-rules file, and the research corpus whose only bar was that something had been registered. Our follow-up register verified an item once at sweep time and then served it as true forever, while a sibling ledger gave every lesson a horizon. Receipts were written on every run, quality-blind; lessons were written almost never. The only clean instance was the shrink-only ratchet. The rule we adopted has five clauses in dependency order: a thing becomes durable only if someone specific will act differently because it exists; it enters and leaves with a reference another person can check; it states what would make it false and when it must be re-checked, and past that date it is served as a question; a second occurrence after a fix is an infrastructure failure, never a second item; and durable state is never rewritten, only appended, superseded with a pointer, or lapsed with a date. Activity is not memory. The first clause is the whole selection problem.
#AIAgents#AIGovernance#EnterpriseAI#AgenticAI#EngineeringLeadershipLire sur Substack → - Essai 62
The Floor Is a Compiler
I predicted our governance floor would lift a weak model fifteen to twenty-five points. It scored below baseline. What recovered it was not more hand-building. It was a compiler.
In July I wrote that the same model under a different floor scores differently, and that the floor is the product. Then I pre-registered a prediction, in a file with a no-edit rule: our hand-built floor would lift a weak model fifteen to twenty-five points on an open enterprise benchmark. It scored five of fourteen against the baseline's six. The failing traces were not missing views; they were wrong-grain answers delivered confidently in two turns - a nine-hundred-thousand-dollar figure at the parent level where the task wanted seven-hundred-thousand at the part level. My first lesson, structure over computation, was wrong too: advisory text had zero effect at any tier, and advertising a grain parameter sent a task from five of five to zero of five until the parameter was removed. What recovered the floor was computing at the correct grain with no choice left to the agent - twenty-seven to fifty-three percent at the cheap tier over a hundred and forty cells, seventy-one to eighty-six at the frontier tier at sixty percent of the cost - and everything that recovered it turned out to be source-independent: key inference, join planning, grain discipline, deduplication, provenance. So we wrote a compiler. From a derived linkage graph and a six-line spec it reproduces the hand-written view exactly and produces a correct view on a topology it was never built for. We have not re-run the benchmark on compiler output; that is the next registered prediction, and we have submitted nothing publicly. The one-page receipt says thirty-six against forty-three in its third paragraph. Same model, different floor is still true. The product is not the floor. The product is the thing that writes it.
#AIAgents#AIGovernance#EnterpriseAI#Benchmarks#EngineeringLeadershipLire sur Substack → - Essai 63
Nobody Ran It
We open-sourced the verifier so a stranger could check us. Nine days: nobody ran it. Publishing a correction is what finally summoned a checker - who then found two things wrong with the correction.
Nine days ago I argued that a record only becomes a standard when someone with no stake can check it, so we published the specification, open-sourced the verifier, and let a census name our own debt. The honest scoreboard on my own question: zero stars, zero forks, seven page views from three unique visitors across the repository's entire public life. Nobody ran it. Only half of my claim died, though. The sentence an inspector can sign really did change; what broke was the corollary I never wrote down, that publishing the check summons the checker. There is no profession whose job is to independently check a vendor's evidence export, and the one mature market for machine-checkable compliance evidence - consent logs - got verified exactly once, when an ad platform made it a condition of serving ads, not when a regulator asked. Verification follows leverage. Two people did read it, both builders of the same layer, and one of them found a seam our own non-claims had missed: our sequence numbers are assigned by our own sealer, so a filtered history can be re-sealed into one that is internally perfect. The disclosure went into the spec that afternoon. Eighty-eight minutes later he stopped reading and ran it, and found two defects in the check that was supposed to bound the thing we had just disclosed - both fixed in public, his case as the regression test. The third he could not have found: our own verification never read an anchor at all. It reported externally anchored off a field we write about ourselves. Publishing makes your record checkable. It cannot make your reading of it checkable. The prediction I still commit to: the first run against a real export happens inside a procurement cycle or an underwriting file, not because someone found it interesting.
#AIGovernance#AuditTrail#OpenSource#VerificationLire sur Substack → - Essai 64
What a Verifier Cannot See
A hash chain proves nobody edited the row; it cannot prove the row was true when written. Our documented key-rotation step re-signed whatever was stored, so a tampered row passed after the sweep.
Step four of our key-rotation runbook was the attack. Not a bug we shipped by accident - a documented procedure: sweep every audit event still signed with the retired key and re-sign it, recomputing each signature over the document as it currently read. A row someone had tampered with failed verification before the sweep and passed after it, and the sweep reported success; there is no field in that response for tampered rows I certified. That is the honest limit on the verifier we open-sourced a week earlier. A hash chain proves nobody edited a row after it was written. It cannot prove the row was true when written, because a forged event is internally consistent too, and tamper-evidence applied to a lie produces a lie you can no longer edit, with a receipt. So the attack surface of an evidence system is the write path, not the read path. Our own review found three shapes of it: recomputation that never checks the attestation it replaces, ingest that confirmed a token existed without checking its value, and a value accepted from outside and later trusted as one the system chose. All three are closed, and each fix was broken on purpose first - every new test re-run against the reverted code to confirm it fails there. One is only narrowed: a check that is skipped, not failed, while its configuration value is unset, and it is unset as I write this. A check guarded by an unset variable is not a check; it is a comment that compiles. Everyone is about to be sold an attestation layer. It will be a real hash chain and it will verify. Ask the other question: who could have written a row?
#AIGovernance#AuditTrail#AppSec#CISOLire sur Substack → - Essai 65
Who Took the Advice?
Five weekly briefs, zero refusals. I clicked approve on every one, four in 18 seconds. A gate proves someone approved; it can't prove anyone decided, and nothing I built governs what an agent advises.
Every control I own governs an action: a gate before a message goes out, a named approver, receipts, an audit chain. Point that machinery at an advisory agent and it has nothing to bite, because advice has no effect until someone supplies one. Our weekly competitive-intel brief hit a hundred percent execution twice, and flagged its own number: a function whose recommendations are never refused cannot tell whether it is advising or transcribing. A correct recommendation and one selected for acceptability are the same object on the page; the difference lives in the set it was drawn from, which a document never shows. Grading the output harder cannot find that, and a disagreement quota only teaches the advisor to manufacture refusable items. What we changed was the form: every recommendation names the refusal it invites, one item carries a real counter-position, and each brief names one thing it considered and did not recommend. That last one produced the only prediction here an outside event has since checked, a rival's governance gaps that closed in twenty-three days. Then the records showed something worse than nobody deciding. Every one of the twenty-one executed items went through a console button only a logged-in human can press, and the human was me: four dispatches in eighteen seconds. Named approver, timestamp, audit event, all present, and no decision. Across five briefs: zero refused, one amended, and the amendment came from an item pre-labeled as expected to be refused, for a reason the advisor could not have seen. So we changed the button: it now shows the refusal each item invites, will not dispatch until I acknowledge it, and records how fast I approved. A gate proves someone approved. It does not prove anyone decided.
#AIGovernance#AgenticAI#CIOLire sur Substack → - Essai 66
Detection Is Not Dispatch
For a month our watchdog found the same problem every morning, on time, and I acknowledged it twenty times. Nothing ran. An alarm isn't a control until its finding reaches a hand that can act.
Every morning for a month, a watchdog I own found scheduled work that had been assigned and silently lost. It raised twenty-two cards and I acknowledged twenty. Nothing ran, because acknowledging a finding does not do anything; it records that a human saw the words. An alarm is four links: detect, deliver, decide, dispatch. Almost all monitoring investment goes into the first, and over three weeks my operation broke at the other three, in order. Dispatch: thirteen jobs depended on a working session opening, and nothing could turn a finding back into work, so the card now carries its remedy as a choice that creates the command. Delivery: the alarm was right twice, and the screen I was actually reading called the dead job queued, because every screen re-derived expiry for itself and two of four got it wrong. Decide and dispatch again: the same finding stacked as three cards on three days, and my one ruling went to whichever machine pulled last, which had no skill to run it. We had written that exact risk into the commit five days earlier and guarded against it in the text, not the code. Now a standing finding stands on one card, and a ruling goes to the executor that can run it or is refused loudly. None of it needed a better detector.
#Observability#SRE#AIAgents#AIGovernanceLire sur Substack → - Essai 67
The Questionnaire Names the Log
The DOJ's new AI request for information is one paragraph long. Its attachments ask for audit logging of every AI query and output. Governance questions stopped being conversation and became rows.
On 18 September the Justice Department posted a request for information for an AI legal-research tool. The notice is one paragraph with no governance vocabulary in it. The attachments are where the governance is: a Statement of Objectives asking for audit logging of all AI queries and outputs and for model change notification, and a forty-five-row Yes/No/Partial/N/A matrix with five rows under "Accuracy / AI Governance." It is market research with no contract award, and the placement is the news: governance arrived as cells in the questionnaire for a productivity tool. It is not one buyer. GSA's proposed LLM clause requires an audit trail of intermediary steps and notice when a model degrades, and it enumerates the only purposes government data may serve instead of listing prohibitions. The District of Columbia's AI addendum makes human override a material term, California's model provisions require output quality to be tracked over time, and a proposed judgment in United States v. RealPage makes a software buyer separate what a model reads at runtime from what it was trained on, and hold its vendor's certification in writing before use. A question asked on a call gets an answer you can hear. A row gets an answer someone can later ask you to prove, and rows are answered by evidence, not policy. If you buy AI: ask for the log, then ask for the export; ask which model produced each output and how you would learn it changed; ask who grades.
#AIGovernance#Procurement#CIOLire sur Substack → - Essai 68
The Content Your Locations Never Get
Reviews are automated and the weekly report writes itself. The content that brings a local lead to one specific location is the part nobody writes, and the reason is not that writing is hard.
Walk the local stack of a multi-location group and most of it is handled: reviews answered by rule, a weekly report with suggestions attached, one click to post to every listing. Then read next month's queue in the scheduler. It's the brand post, with the town name swapped in if someone had time. We read the public websites of ten multi-location groups and could read six. One restoration brand's two location pages shared 43 of 57 sentences word for word; a specialty-medical group with a few dozen offices had no per-office page at all; two groups had real local pages that someone had clearly written. It isn't a writing problem. Generating forty location posts takes an afternoon, and at scale they come back wrong in local ways no brand reviewer can catch: the phone number, a service that shop doesn't offer, a partner it doesn't have, a state-specific rule, a Google feature that was shut down in late 2025. Nobody checks 360 pieces a month against forty sets of local facts, so teams ship the brand post or nothing. The fix is facts each location owns, each with a source and a mark, a local calendar built from dates that really are local, drafts that cite their facts and leave the rest in brackets, and approval per location per month. Then a ten-minute test: count the identical sentences on two of your location pages, and next month's posts that are true in only one town.
#MultiLocationMarketing#CMO#LocalSEO#MarketingOps#FranchiseMarketingLire sur Substack → - Essai 69
The Scribe, Not the Chatbot
The 2026 chatbot laws mostly carve out your booking bot. The AI rule with a date on it for a clinic group this year is the ambient scribe, and two states regulate two different moments.
Most of the AI laws a compliance lead forwarded this year had "chatbot" in the headline, and most of them step around a clinic's booking bot on purpose. Georgia's SB 540 regulates companion chatbots and excludes customer-service bots that don't sustain a relationship; Idaho's excludes "A chatbot used only for customer service." The AI rule with a date on it for a dental or medical group this year is in the operatory, where an ambient scribe drafts the note. Two states regulate it, both laws are in force, and they regulate different moments. Louisiana's Act 649 requires the licensed professional to verbally disclose the recording before any part of the visit is recorded, enforced through the licensing board. Rhode Island's chapter 23-106 names dentists, requires notice, and requires the AI-written note to be reviewed for accuracy after the visit. Neither enacted text has an opt-out: Louisiana's first draft required consent and the Senate turned it into disclosure, while Rhode Island's added the accuracy review on the way through. For a multi-state group that means an inventory of where scribes run, a per-location rule with a named owner, one chart field recording who disclosed and who reviewed, and four questions for the scribe vendor. Not legal advice. Pull yesterday's notes from one location and ask who reviewed them.
#DentalPractice#HealthcareOperations#AIGovernanceLire sur Substack → - Essai 70
Audit Is a Reconstruction
A federal buyer's draft AI contract doesn't just ask for logs. It wants one agent run rebuilt end to end, a list of what you could not log, and an off switch that blocks new runs within five minutes.
On 22 September 2026 the Department of Veterans Affairs posted a draft work statement for the contractor that will operate its enterprise AI rollout, and its auditing acceptance test is not about retention: "VA can reconstruct a representative transaction, administrative action, agent or workflow execution, incident, and material change." It is a draft attached to a request for information, not a contract, and it may change before the October solicitation. But it is the most detailed public description of what a buyer expects from the party in the middle, the company operating an AI product someone else built. The records must be attributable and time-correlated, and protected from "alteration, deletion, suppression, or loss." Suppression is the row that was never written, and no integrity check on the rows you have can reveal it. A Logging Limitation Register asks the contractor to write down what it could not log and what evidence stands in, so the vendor who claims to log everything does worse, not better. An off switch must stop new runs within five minutes, be drilled with elapsed times, and be usable by the buyer's own admins; in-flight runs get their side effects blocked and their evidence preserved. Capabilities stay off until approved. Every criterion is something the buyer can do, not something the vendor attests. Ask your vendor to rebuild one run with you watching.
#AIGovernance#AuditTrail#CISO#ProcurementLire sur Substack → - Essai 71
The Third Verdict
Most jobs report success or failure. The dangerous case is neither: it may have happened and you cannot tell. Call that a failure and the next reader runs it again, and now it happened twice.
An operator stopped a command an agent was running, and the stop read as a failure, so the step ran again. The first run had already filed its card, written its record and committed; fifty-four seconds later everything existed twice. Nothing was wrong with the retry. The status was the lie. Most jobs report a boolean, two states for a world with three: it happened, it did not happen, and it may have happened and you cannot tell. Forced into "failed," the third case tells the next reader "nothing landed, go again." Borrowing Orca's rule that loss of contact is never evidence of absence, the fix gives every report one of three fixed words: succeeded, failed, unverifiable. No synonyms; an old worker can never say the third word by accident; an unverifiable verdict must say what to check. The attempt is recorded on the work item, where the next picker looks, not on a run log that closed with it. The warning prints at the moment of pickup, and only the third word warns, because a warning that fires on every failure is noise with a color. A second duplicate the same evening shows what the verdict cannot catch: a console and an agent each recorded the same three sends, each deduplicating only against itself. Idempotency keyed per writer, not per fact. That gap is still open, and the extra records stand.
#AIAgents#SRE#DistributedSystems#AIGovernanceLire sur Substack → - Essai 72
The Approval Has No Shape
The pause became a product default this month: agents wait for your approval before they send, post or pay. What that approval leaves behind has no agreed shape, and the standards work now says so.
Two sentences from the same company. Claude for Small Business: "By default, Claude does the work and waits for your approval before anything sends, posts, or pays." The Managed Agents docs: "auto is not a human checkpoint." That is a segmentation, not a contradiction: the owner gets the pause, the developer gets an evaluator, and both are disclosed plainly. But both are about when the pause happens, not what it produces. In the same weeks, an OpenID AuthZEN working-group issue against a draft approval profile said "Two implementations can both conform to that requirement and share no payload," a companion issue noted that four identities are in play and the binding rules do not say which they compare, and an early IETF draft said an agent "MUST NOT treat local UI confirmation alone as sufficient authorization." With standing agents now holding their own directory identities, "approved by user X" is no longer a column. An approval is evidence when someone who wasn't there can answer four things from the record alone: who approved, as which identity; what exactly they saw; what it authorized, and until when; and whether anyone outside the vendor can check it. Measured against that list, our own record carries who, when and a hash of what was seen for most outbound work, but no expiry, symmetric signatures, and a format nobody else can read. The click is settled. What it produces is not.
#AIGovernance#AIAgents#IdentityAndAccess#CISOLire sur Substack → - Essai 73
Same-Store Is the Scoreboard
The next dental rollup won't be judged on how many doors it added. It will be judged on what happens inside them, and the gap between your best and worst location is the value nobody has counted yet.
Almost every dental group's board deck has a slide that counts doors. It is becoming the less interesting number to the people who will buy the group. In a TUSK buy-side survey this spring, 69% of DSOs said their PE sponsors expect more acquisitions in 2026, and 78% expect a recapitalization within 12 to 36 months, and the recap buyer reads a different exhibit: a data-room firm calls same-store collections and EBITDA growth by acquisition cohort "The single most important exhibit." Much of same-store growth is decided on the phone. One dentist reports that strong front desks book 70-80% of new-patient calls against an average near half; a DSO marketing agency sees 3x to 5x variance in cost per acquisition between best and worst locations. That spread is already inside the doors you own, and it compounds as budget flows to the desks that convert. Most groups integrate the back office and inherit the front end, one habit per office. Motor City Dental Partners, doctor-owned and orthodontics-led, shows the other sequence: build the central functions first, put new practices on core systems within 90 to 120 days. Do the same with calls, follow-up, local content and per-location reporting, and run the ten-minute test: price the gap between your top and bottom quartile. Count it before the buyer does.
#DSO#DentalPractice#PrivateEquity#MultiLocationLire sur Substack → - Essai 74
The Ban Is the Blind Spot
In a 2025 Gartner survey, 69% of organizations suspected or had evidence that staff use prohibited public genAI. The ban didn't stop the use. It stopped the record.
The ban memo usually goes out after a scare, and the fear behind it is legitimate: a prompt is an outbound data transfer on terms nobody negotiated. But the numbers say the ban doesn't hold. A 2025 Gartner survey of 302 cybersecurity leaders found that "69% of organizations suspect or have evidence that employees are using prohibited public GenAI" - companies where the rule exists and the use continues. IBM's 2025 breach study found that breached organizations with high levels of shadow AI saw $670,000 higher average breach costs than those with low or none, and that of organizations with an AI governance policy, only 34% regularly audit for unsanctioned AI. A ban does not remove the task. It moves the work to a personal account, a phone, a home laptop, and what moves with it is the record: the named user, what went out, anything you could produce when an incident needs scoping. The ban converts activity you could have governed into activity you cannot even count. The people are not the problem; a rule that depends on everyone choosing the slower path every day is a discipline, not a design. The alternative is a sanctioned path that is faster than the contraband and leaves a record by construction. Abstention looks like caution. It works like blindness.
#AIGovernance#CISO#ShadowAI#EnterpriseAILire sur Substack → - Essai 75
The Evaluator With a Stake
An evaluator can be embedded, well funded and good at the job, and still not be independent. Grade any evaluation by who pays, what the evaluator sees, and whether a stranger could re-run it.
On September 18, Anthropic announced a partnership with Accenture on what its post calls "independent evaluation of frontier AI": Faculty's evaluators embedded inside the lab "with access comparable to an employee's," paid for directly by the lab, whose December 2025 business group made it one of Accenture's "select strategic partners." That is a good thing, and more than most vendors offer. It is also not independence, and the announcement's own sixth paragraph says so: "no standards" yet for what embedded evaluators see or how they report, and "no settled system for funding independent evaluation." Assurance is a qualified party telling you they looked; independence is a property of the arrangement, not the party. The argument is structure, not motive. Three questions grade any evaluation you are handed: who pays the evaluator, and what else do they buy from each other; what can the evaluator see that you can't, and what of it reaches you; and could a stranger re-run it? Run through them, the announcement grades as high-access assurance with a declared conflict. Run through them ourselves, we fail the first by construction, and we were once the evaluator with a stake: our own check read a field we wrote about ourselves, and only a stranger re-running it caught the problem. When a vendor says "independently evaluated," don't ask who. Ask who paid, what they saw, and whether anyone else could run it again.
#AIGovernance#Procurement#CISO#RiskManagementLire sur Substack → - Essai 76
Prepare Is Not Post
Finance already separates the person who prepares an entry from the person who posts it. The newest accounting benchmark says AI belongs on the preparer's side of that line, and should stay there.
Every controller knows a rule that is rarely written as one sentence: the person who prepares an entry is not the person who posts it. This month Ramp, a vendor that runs its own agents on accounting work, published a benchmark of 137 hard tasks inside 22 simulated companies. Its featured example ends with the agent's own line: "The entry was proposed, not posted." That is the right design. The numbers say why it has to stay that way: the headline 21% is best of three attempts; the best first-try rate is about 14%, the best solved-all-three-times rate 8%, and the model that solved the most tasks at least once, 29, solved only 4 of them every time. Controls are written for the second run. The Controllers Council says the same in finance's own words: "Duties should remain properly separated," and the person accountable for the result "should be a person, not a software application." Once software prepares and a person posts, the question changes from how accurate the tool is to where its misses go. A CPA's 250-transaction test matched his key 86% of the time; 31 of the misses went to review, and two slipped through unflagged. Those two are the metric. The design fits on an index card: software prepares with sources, exceptions route to a named queue, posting authority never belongs to the system, and the preparer is graded on repeats and on misses.
#Accounting#Controllers#CFO#MonthEndClose#InternalControlsLire sur Substack → - Essai 77
The Agents Need a Shift
Three people ran 20+ agents to a revenue turnaround, and two of those agents cost $257 a month. The same operator says every agent needs daily upkeep. Budget the shift, not just the software.
Earlier this month Jason Lemkin of SaaStr reported that three people running more than twenty AI agents took revenue from down 19% to up 47% year over year, and that two of those agents, his AI VP of Marketing and AI VP of Customer Success, cost "$257. Combined." per month. That number will end up in board decks. The more useful sentence is the one he calls "the part nobody puts in the tweet thread": "Agents drift, data changes, models update, integrations flake. We QA ours every day." The agents work. They also need a shift. Tool cost is the smallest number in agent economics and the only one anyone publishes; the real cost is who watches, who fixes, and who is accountable when an agent quietly gets worse. Drift, silence and change underneath all fail without a crash, and the fixes are operating work, not better software. I let a watchdog's 22 cards slide for a month in my own operation, so assume your portcos will too. The sequencing lesson: build the shift before the agents, the way Motor City Dental Partners stood up central support before the acquisitions that justify it. The value-creation question isn't which agents; it's who runs them on Tuesday, whose name is on each one, where the record of the daily check lives, how you'd know one stopped, who can pause it, and what the budget says for the shift. Put the shift on the sheet next to the $257, and fund that first.
#PrivateEquity#ValueCreation#AIAgents#PortfolioOpsLire sur Substack → - Essai 78
The Skill File Is a Dependency
LinkedIn's agents propose edits to the 600 playbooks its agents run on, and updates reach every laptop within the hour. That is a supply chain, and it needs what any code dependency gets.
In a September talk, LinkedIn's Ajay Prakash described playbooks: instructions served to coding agents through one local MCP server, installed on every LinkedIn laptop and updated within the hour, now over 600 playbooks and 1,300 tools used by more than 8,000 people a day. At the end of a session, agents are encouraged to find "any outdated information or any discrepancy or any missing information" in the playbooks they used and open a PR. That is good engineering, and the PR is the right instinct. But many authors, central distribution, hourly auto-update and committers that aren't people add up to a package registry, and software already knows what a dependency needs. Imad Touil (QuantumBlack) warns that ungoverned skills become "a new class of technical debt"; Ignacio Martinez (Oracle) retires the old skill.md when he promotes a new one; Laurie Voss (Arize) found models following close to ten times as many instructions as a year ago, each failing its own way. A skill is a text file plus the model that interprets it. The checklist: an owner by name, a version the consumer chose, a written review bar, a re-test when the model changes, and retirement. Graded on our own 49 skills, the review gate holds; when our model changed this week nobody re-ran the behavioural tests, and we have never retired a skill. The loop is fine. The question is what the merge checks.
#AIAgents#AIGovernance#SoftwareSupplyChain#EngineeringLeadershipLire sur Substack → - Essai 79
The Prompt Is Not a Policy
Models now follow thousands of instructions at once, so every rule goes in the prompt. But the prompt only asks. A policy is a rule you can show was enforced, and that has to live outside the model.
A year ago, frontier models fell apart somewhere around 200 to 300 simultaneous rules. Laurie Voss (Arize) re-ran the IFScale benchmark this month and found most current models holding about 2,000, the best up to 5,000: "close to 10 times better at following instructions simultaneously." That is the most dangerous good news in enterprise AI, because every refund limit, escalation trigger and disclosure now fits in the system prompt, and a prompt only asks. At the limit the models fail four different ways, and the worst is the half-finish that "looks like a real answer." Voss's conclusion: the compression problem is gone; what's left is a verification problem, which "doesn't get solved by writing a better prompt." Five talks in three weeks landed on the same design: Stripe enforces spend limits at the payment provider, Google keeps "factual constraints" outside the agent's control, Diogo Almeida breaks rules into small decisions you can test and escalates low confidence to a person, and Paul Bakaus blocks the write because "if the gate can be skipped it will be." A rule becomes a policy when it is checked outside the model, leaves a record that the check ran on this case, and has a named path to a person when the check can't decide. One question for any vendor: show me where this rule is checked, and the record that it was. The prompt is where you ask. The policy is where you can show.
#AIGovernance#AIAgents#CISO#EnterpriseAILire sur Substack → - Essai 80
A Screenshot Is Not a Control
The new AI standards split proof that a guardrail exists from proof that it works. Most companies have the first. A tribunal, the insurers and the next questionnaire are asking for the second.
When Air Canada's chatbot told a grieving customer he could claim a bereavement fare after he flew, both sides brought screenshots to British Columbia's Civil Resolution Tribunal: his of what the bot said, the airline's of what the policy page said. Nobody brought evidence about the bot; the decision notes the airline "did not provide any information about the nature of its chatbot." Moffatt v. Air Canada is a small-claims decision on an $812 claim, not appellate precedent, but it is cited everywhere because it states the obvious plainly: "It makes no difference whether the information comes from a static page or a chatbot." Rune Kvist (AIUC) draws the line the case turns on. An auditor checks that a guardrail exists; testing checks whether it works, and most companies "have the right kind of architecture" with guardrails in place. "They just don't work very well." That is not a knock on auditors: SOC 2 already splits design from operating effectiveness. What changes with AI is that you cannot sample last quarter's logs for a failure that lives in questions nobody has asked yet. Four questions for any AI control: who tried to break it, when and against which version, where is the record it fired last Tuesday, and whose name is on it. Our own file has a thin spot, and the essay names it. A screenshot shows what was there. It cannot show whether it held.
#AIGovernance#RiskManagement#CISO#ComplianceLire sur Substack → - Essai 81
Which Model Wrote This?
Spend controls are moving from caps to routers that pick a cheaper model as a budget runs low. That makes the model behind each output a policy decision, and most records cannot show it.
On a recent a16z episode, Ali Ghodsi, Databricks' CEO, described how AI spend got bent back under control: budgets "per person and for group" that warn as you get close, then "smart routers that could actually pick cheaper models if you're getting close to your budget." His result: "the tokens continue to go up but the costs have been sort of stagnant." That is where spend governance is heading, and it changes what a budget is. A budget that warns is a report; a person decides what to do next. A budget that routes is a control; the system decides which model writes the next output, mid-run, and the reviewer who approves the draft usually cannot see the substitution. Reviewers calibrate to a workflow's failure modes, so a silent model swap breaks the review without telling anyone. Every control needs two things. A scope: action classes that never get downgraded, anything customer-facing and anything hard to reverse, where the budget stops the work and tells a person instead. And a record, per output: which model, why that one, under whose budget, and what it replaced. Checked against our own stack, we record the first; our router is advisory, our budget-pressure routing is built but not wired, and one provider-fallback path never reaches the action record. Tokens up, costs flat. Now make it say which model wrote this.
#FinOps#AIGovernance#EnterpriseAI#AIAgentsLire sur Substack → - Essai 82
The Cut Is Measured. The Replacement Isn't.
Next year's AI budget is being paid for by cutting other lines. The cut hits the P&L to the dollar on day one. The replacement arrives as a claim, so the proof belongs on it, before the old line goes.
Jason Lemkin (SaaStr) put the 2027 budget pattern plainly: "Everything else is getting cut to fund new AI apps, AI spend, and also, price increases from existing core apps." AI spend next year is mostly not net-new money; it is taken from an agency retainer, an answering service, a role that won't be backfilled. That changes the ROI question. The cut is a number: it hits the general ledger to the dollar, every month. The replacement is a sentence: "the AI handles the after-hours inbound now." A year later the review compares a measured saving against a story, and the saving wins whether or not the work is getting done. The skeptics already have the script, and EY's own paper names the gap: time saved becomes economic value "only if the gain is actually banked rather than just observed." Worse, when a cut line did real work and the replacement doesn't pick it up, the cost surfaces months later as same-store drift at a handful of locations, reading as weather. The fix is three facts written down before the old line goes: what it produced, in units, per location, over the last 90 days; what the replacement produces in the same units from month one; and one named owner who reads the comparison at 90 days. Not every cut needs a replacement. But where the plan says the AI will "handle" the old line's work, the burden of proof has moved to the replacement. Do that, and the review compares a number to a number.
#PrivateEquity#CFO#OperatingPartner#MultiLocationLire sur Substack → - Essai 83
You Can't Backfill the Log
What your AI agents did at each location exists only at the moment it happens. The questions come years later, at the same-store review and the exit. Capture the log now; derive the dashboards later.
Keith Peiris (Lightfield) on what CRM consultants say is the most consequential decision: the data model, because "if you get the wrong stages, the wrong fields, you can't get the reps to go back in time and fill it out. It's over." Lightfield's answer was to build the activity log first and derive the fields from it, so "if you change your minds about the fields, you can just traverse the activity log and refill them", semi-structured, because fully unstructured made the queries too slow. Multi-location groups switching on AI agents face the same asymmetry, sharper: an agent answering customers at forty locations has no memory, and neither does anyone else. The questions arrive 12 to 36 months later: the same-store review, a regulator's letter, a buyer's diligence team in year two or three of the hold. Fields can be derived from events; events cannot be derived from fields. So capture a short, fixed set at the moment: when, which location, which agent and instruction version, what it did, on whose authority, and what it declined or escalated, in a log that is only ever appended to. Our own business-development log works this way; our customer-side activity index does not yet carry location, and the essay says so. Three questions for this quarter, and one rule: the dashboards can be rebuilt any time. The log can only be started.
#PrivateEquity#MultiLocation#AIGovernanceLire sur Substack → - Essai 84
The Rebrand Deletes the Reviews
In a home-services roll-up, the demand you pay for lives in a Google listing, its reviews and its ad history. The purchase agreement names none of them, and one careless rebrand can strand all three.
A roll-up underwrites local demand, but most of that demand lives in four assets the purchase agreement never names: the Google Business Profile and who owns it, its reviews, the Local Services Ads account and its history, and the licensed person behind each listing. Google's naming rule allows a rename in place only when "the proper nouns and services described in the business name remain unchanged"; anything more is "a new business": close the old profile, create a new one. The reviews stay on the closed listing and the new one starts at zero. Google's reviews page is more generous, and the two pages do not quite agree, so establish which applies per branch before the sign changes. Price the rebrand, or don't do it. Ownership has a clock: a new owner or manager must "wait 7 days" before primary ownership can move to them, so pre-seat it during diligence. There is no documented way to transfer an LSA account at all. And two clocks run this fall: missed business-hours LSA calls billed as leads from October 1 (announced by email, not yet on a help page), and the LSA move into Google Ads, where past performance metrics "will not migrate" and the only export documented today is a screenshot. Per branch: count before you sign, own it before you close, export the history before the notice lands.
#PrivateEquity#HomeServices#LocalSEO#MultiLocationLire sur Substack → - Essai 85
Which of Your Tools Decide?
Four states' AI rules take effect January 1. They share one prerequisite most multi-location groups lack: an inventory of which tools decide something about a person, where, and who really decides.
Four states have AI rules that take effect on January 1, 2027. None asks which AI you bought. Three ask which of your tools decides something about a person: California's automated-decisionmaking rules (hiring, pay, work assignment, credit, housing, education, care; advertising excluded), Colorado's SB 26-189 and its proposed rules, and Oklahoma's SB 546 opt-out of "solely automated" profiling, which exempts HIPAA covered entities outright. The fourth, Rhode Island's H 7350, is about companion bots and carves out customer service by name. Handling them one memo per state is the wrong unit of work, because every rule starts from a fact headquarters rarely has: which tools are switched on at which location, and what they decide. The dispatch tool that assigns per-job pay, the front-desk payment-plan approval, the applicant ranker each region configured. The essay's own thesis moved under the texts: in California a human who can interpret, review and change the output takes a decision out of scope, but in Colorado a tool that "materially influences" the decision stays in, even when a human signs off. A policy saying "a human makes every final decision" satisfies nothing in Colorado and proves nothing in California. What serves all three is a per-decision record: what the tool produced, who reviewed it, whether they could change it, and whether they did. Not legal advice; the texts are quoted and linked.
#AIGovernance#Compliance#Operations#COOLire sur Substack → - Essai 86
Silence Is a Claim
Our pipeline recorded that a prospect never replied. He had answered in 46 minutes. A written absence looks exactly like a checked one unless it says who looked, where, and when.
A prospect answered our email in 46 minutes and asked for a call. We replied 13 minutes later with two times, both outside the windows he had named, and then nothing for fifteen days. When the pipeline was reviewed, his record gained a sentence, "no reply", written from memory; nobody opened the mailbox. It was struck within the hour, but it looked exactly like a "no reply" someone had checked. A presence points at evidence; an absence points at nothing, and a false one tells you to do nothing, which produces no evidence you were wrong. The same fortnight, a web-page watch reported a vendor's announcements page "unchanged" four runs in a row because the fetch only ever captured an empty frame: no error, because nothing had failed. We already had a written rule to check the source of record before writing an absence, and it did not stop the next one, because an absence does not feel like a claim. The rule moves to the record: an absence is written only with its provenance (what was looked for, where, when, by whom), or the entry is "not checked". Cheaper still, record the last presence. The rule is procedural today, not enforced, and the essay says so. Four questions for any field in your systems that can hold a negative.
#RevOps#DataQuality#Operations#AIGovernanceLire sur Substack → - Essai 87
The Second Agent Holds the First One's Keys
When one agent hands work to another, the second usually inherits everything the first could do. The question to ask a vendor: three hops in, what was that hop allowed to do, and where did it narrow?
Your agent calls another agent. What is the second one allowed to do? In most stacks, including ours, the honest answer is everything the first one could. Nobody decided that: the handoff passes the caller's context, and a copy has no way to say "less". This is the fifth vendor tell, after BYOK, the session, the audit log and who can become you: three hops in, can you show me what that hop was allowed to do, and where the narrowing happened? Three answer shapes. "The sub-agent runs with the user's permissions" means every hop holds the whole keyring, including the hop reading an inbound email with an injected instruction in it. "Each agent has its own scoped identity" is better, but the scope was set when the seat was created, not for this task: it narrows the agent, not the hop. "Each hop carries a credential no wider than its parent, depth-bounded, with every narrowing recorded" is least privilege once privileges have to move. One trap: OAuth token exchange can record the whole delegation chain, then calls prior actors "informational only"; a delegation history is not a narrowing. The standards lane started writing the answer down this month (an IETF charter under review, a first WIMSE draft of SHOULDs, AuthZEN proposals, a pre-1.0 open-source attenuation profile), each labeled for what it is. And an admission: graded against our own system, our mark on this question was nothing. A sub-workflow runs with its caller's context; what bounds it today is an approval gate at the edge, which is not a narrowing on the hop.
#AIGovernance#AIAgents#CISO#EnterpriseAILire sur Substack → - Essai 88
Every Step Passed
Our pipeline sent two messages to a marketing head on another continent. Every step was right; none had been asked where the company was. A question nobody asks doesn't fail. It passes.
We sent a connect request and a direct message to the head of marketing at a dental group headquartered in Europe. We sell to North America. Six automated steps passed her: an industry filter, a dedup, a deal classifier, enrichment that found her and verified the email, promotion to the send queue, a mirror into the engagement system. Every answer was correct. None of the steps had been asked where the company was. Weeks later a careful human review ranked her among our twelve best-fit contacts, reading the stamps as findings. We caught it only because a different check failed to load her company's website, forty-seven days after the message went out. The general form: an automated pipeline rejects only what it was told to check. A question nobody asked doesn't fail; it passes, and every later step inherits the pass, with more confidence at each stamp. A review at the end reads the fields the pipeline wrote, so it inherits the pass too. The fix went to the front: every deal now requires a headquarters country, checked first, before any enrichment, and a missing answer is a stop, not a silent yes. The essay says what is still open (the gate covers one of three sourcing feeds) and ends with five questions for your own pipeline.
#RevOps#PrivateEquity#AIGovernance#SalesOpsLire sur Substack → - Essai 89
The Recap Is a Witness, Not the Minutes
Two AI note-takers recorded the same call and produced two different meetings. A recap is testimony from a witness with no stake and no memory. Reconcile it before anything in it travels.
Two AI note-takers sat in on the same call, and their recaps were in my inbox within 25 minutes. They agreed on the shape of the meeting and split on the details. One said the operator's contacts, some of them at Google, showed little interest in an ad product; the other wrote "Google projects eventual deprecation" of it. Google's own help page describes a migration into Performance Max with pay-per-lead goals, not a deprecation. The recap did not invent the forecast; it compressed it, moving the source from some people to Google, the verb from an opinion to a projection, and the object from a shift in search to the end of a product. The same recaps disagreed about what I said: one had me not claiming a capability, the other had me "exploring" it, which in a prospect's CRM record reads as a promise. The recap that got Google wrong also caught the best signal on the call, so choosing one would have cost more than it saved. And neither recorded that half the agenda was never reached, because a recap has no field for what didn't happen. Minutes are approved by the people who were in the room; a recap is testimony from a witness with no stake and no memory. Four rules before one goes into the CRM: label the source, quotes need someone who was there, check claims about a third party with the third party, and write down what wasn't discussed.
#RevOps#AIGovernance#Sales#OperationsLire sur Substack → - Essai 90
The Button Never Showed the Case Against
An approval gate records that someone clicked, not that someone judged. The cheap fix is not a slower button: put the strongest reason to decline on the screen, and make the click answer it.
Twenty-one of twenty-one approved, four of them in eighteen seconds, and the reason to say no had already been written down one screen away from the button. That is our approval gate for agent work, and I was the one pressing it. The full record goes past the headline: 46 dispatches, twelve of them less than five seconds after the one before. That alone proves nothing. Someone can read for an hour and then press six buttons in a row, and the timestamps can't tell a judgment from a reflex. The usual fix is friction, and medicine has run that experiment: clinicians override drug safety alerts in 49% to 96% of cases, and the same review says overriding may often be justified. A warning that never changes becomes part of the button. The research on considering the opposite and on accountability points elsewhere: put the best argument against the item on the screen, written in advance, and make the approver answer to it on the record. So the button now shows the analyst's refusal, won't dispatch until the approver acknowledges it or writes a reason, and records exactly what was shown. It hasn't recorded a decision yet, and the essay writes down in advance what would count as it failing. Four questions for your own approval gate.
#AIGovernance#AIAgents#CIO#HumanInTheLoopLire sur Substack → - Essai 91
Known, but Not for Posts
Some facts about a location are true, sourced and useful to plan with, and still must never appear in a post. Most content tools can only say 'use it' or 'hide it', and hiding it doesn't work.
A body shop's fact sheet ran to more than forty lines, and two carried a note none of the others did. A state agency had labeled a nearby intersection a "high crash location": context only, not for posts. The state's ten largest auto insurers: never named as a partner unless the shop confirms it. Both true, sourced and useful for planning the month, and both facts a post must never contain. A body shop advertising the town's most dangerous intersection is selling other people's accidents; a shop saying it works with a named insurer is claiming a direct repair contract it may not have. Most content setups give a fact one setting: in, so the writer may use it, or out, so nobody knows it. On day one we held both out, and it cost the research. Worse, hiding the insurer list didn't keep insurer names out of drafts, because those names are public and any writing tool can produce them unprompted. The check has to run on the finished draft. What "not for posts" needs is a second permission per fact: checked after writing against that location's list, visible to the location but not clearable by it, lifted only by a person on the record. An instruction not to mention a name is a sentence that contains the name. What we shipped the same day, what hasn't been proven live yet, and three questions for any local content vendor.
#MultiLocationMarketing#CollisionRepair#LocalSEO#MarketingOps#CMOLire sur Substack → - Essai 92
Adopted Is Not Embedded
In a Goldman Sachs survey, three in four small-business owners said they use AI. One in seven said it is built into how the business runs. The distance is operations work, not training.
"The team is using AI" is true in almost every board deck this year, and it is the least informative true sentence you can say about a business. In a Goldman Sachs survey of 1,256 owners in its 10,000 Small Businesses program, 76% said they use AI and 14% said it is fully embedded in their core operations. The population is a selected one, and Census data puts small-firm AI use far lower, but the shape holds: use is common, embedding is rare. A separate SBA analysis of Census data found about half of small firms using AI had invested nothing in it. The usual reading is a training gap. Training makes a person better at a tool; it doesn't change who owns the result, where it goes, or what happens when that person leaves. Personal use lives in one manager's chat window, and the business owns none of it. Embedding is an operating state with four checkable parts: an owner accountable for the output, a defined handoff, a landing place in a real business system, and a record someone who wasn't there can read. None of them is a skill; they are org-chart, process, integration and policy decisions. Staying at "use" means gains you can't defend on the P&L, can't copy to the next location, lose at every resignation and can't govern. The essay closes with a fifteen-minute inventory: list every AI use, fill in the four columns, and count the rows with all four.
#SmallBusiness#Operations#MultiLocation#COOLire sur Substack → - Essai 93
Dental, Ten Years Later
Women's health is being called the next dental. The part worth copying is not the multiple. It is what dental groups left unstandardized before the add-ons, then paid to fix location by location.
Everyone calling women's health "dental ten years ago" means the multiples. They should mean the mess. The biggest number in this year's women's health deal roundups, $18 billion, is one transaction: the Blackstone and TPG take-private of Hologic, a diagnostics and imaging-technology company. The next biggest is Sun Pharma agreeing to buy Organon, a pharmaceutical company. Neither is a roll-up of clinics. The clinic-level wave is older and quieter: a 2020 JAMA Internal Medicine study counted 1,340 private-equity-affiliated women's health offices. Dental groups standardized the back office fast, because the books demanded it. The patient-facing layer came along one habit per office: reviews, patient messaging, local content, and consent and approvals. Each works fine inside one office; across forty, nobody can say who approved last month's texts. It shows in year two, when the rebrand, the spread between locations and a request for the record arrive together. At the platform deal each surface is one decision. Every add-on that closes without it makes the fix dearer: the contracts renew, the habits set, and the record of what was sent can't be backfilled. The cheap window isn't a date but a ratio, open while most locations run the standard. The essay closes with the four decisions for the first twelve months and a ten-minute test across one original location and two recent add-ons.
#PrivateEquity#WomensHealth#DSO#MultiLocationLire sur Substack → - Essai 94
The Agent Can't Sign
Part 11 has said since 1997 what an electronic record must prove. An agent can write the record, but it cannot sign it, so the approval a person clicks now has to carry the signature.
21 CFR Part 11 took effect in August 1997, written for lab systems and batch records, and read with an agent in the room it is startlingly current. When an agent drafts a deviation report or proposes closing a corrective action, the question QA teams get asked is whether the model is validated. The question the rule forces is whose signature the act carries, and whether the record can show it. An agent collides with three requirements. The audit trail (§ 11.10(e)) is engineering: it has to be written independently by the system, and a correction has to add an entry, not overwrite one. Validation (§ 11.10(a)) is hard, but it is a question about the system and the regulated company's call. The signature is not engineerable at all: Part 11 defines it as executed by an individual, unique to one person, used only by its genuine owners. FDA's 2003 guidance relaxed enforcement on audit trails and validation, and said of the signature sections that it would continue to enforce them. So the signature lands on whoever approves the agent's work, and the approval has to carry the printed name, the time and the meaning (§ 11.50), bound to the exact text (§ 11.70). The essay grades our own approval record against those sections, finds it is not a signature, and closes with a Monday check for your systems and every agent vendor.
#AIGovernance#GxP#QualityAssurance#AIAgentsLire sur Substack → - Essai 95
Six Cafés Is the Ceiling
The small-business AI rule is right: nothing posts until the owner says so. At six cafés the owner is the approver. At forty locations, three different people each hold a piece of that yes.
"Nothing posts until I say so" is from the solution page for Claude for Small Business, and it is the right rule. The design around it is careful: every workflow starts in approval mode, autonomy is switched on one workflow at a time and can be switched back, and payroll stops short of the last step. Its featured owner runs six cafés, and there the rule is a complete description of who approves: she knows each location, she owns the brand, and she is the answer to "who approved this?". At forty locations those are three different people. The location manager knows whether a post is true there, the Saturday hours that ended in August. Headquarters is accountable for the voice, the claims and the offers. And the person later asked who approved it, a regional VP or an operating partner, is often neither, and gets an answer from the record or none at all. A single switch per workflow also turns autonomy on for the newest location and the oldest at once. None of this argues against the pause. A multi-location group needs four things under it: a record for each location, a voice for each location, an approver who isn't the producer, and a record of who said yes. The essay says where our own system falls short on the approver, and closes with a Monday check for groups of twenty locations or more.
#MultiLocationMarketing#CMO#FranchiseMarketing#PrivateEquity#MarketingOpsLire sur Substack → - Essai 96
Nobody Comes Back
Our unattended agent started its checks in the background, wrote that it would pick up when they finished, and exited. Nothing could resume it. Intention is not a scheduler.
On September 24 an agent running unattended wired one of my essays. It wrote three of five steps, started its quality checks in the background, wrote that it would pick up again when they finished, and exited 101 seconds after it started. In a chat window that sentence is true, because the chat is the scheduler. A headless session has no next turn. Something did come back: the runner fires every five minutes, found uncommitted changes, and correctly refused to touch them. Coming back is not resuming. The surprise was that the resume point already existed. The console recorded which stages were done and which were missing, and nothing read that record and said "stalled", and nothing could send the work back. The page said "wiring in progress" over a run that had exited. That is Detection Is Not Dispatch, the essay the agent was wiring, pointed at our own work. The same afternoon we made a quiet run show as stalled with its missing stages named, added a Re-dispatch that continues from the first missing stage, and took one sentence away from the worker: finish, or report exactly where you stopped. The essay names a gap still open, that a stage registers when its edit is written rather than committed, and closes with a Monday check for any agent you run on a schedule.
#AIAgents#AIGovernance#Operations#AutomationLire sur Substack → - Essai 97
A Budget That Warns Is a Report
Most AI budgets email someone at 80% and change nothing. A budget that pauses, asks or routes at the ceiling is a control, and it has to record which one fired, for whom, on what work.
Finance leads are being asked to cap the AI line for 2027, and most of the caps will be reports. Ali Ghodsi described Databricks' sequence on an a16z episode: budget warnings per person and per group, then smart routers that pick cheaper models near the ceiling, then the finding that the harness itself matters, with tokens rising and costs flat. Read like a controller, it splits in two. A warning is a detective control: if nobody reads the 80% email, nothing changes, and the control is someone's inbox. At the ceiling a budget can do four things: warn, pause, ask a named person about one item, or route to a cheaper model. The last three are preventive, and route is the one where the work carries on changed and nobody decides, so it most needs a record: which action fired, for whom, on what work, and what it changed, in the same log as the agent's actions. The harness is the lever nobody budgets for; same model, different harness, almost twice the cost. And if a strong model audits a cheap one, the reviewer is the seat you are paying for, so never route the review. The essay grades our own budgets, whose warning is the one action not on the record, and closes with four lines to write next to every AI budget number and three questions for vendors.
#FinOps#AIGovernance#CFO#AIAgentsLire sur Substack → - Essai 98
Charge for the Work, Not the Outcome (For Now)
One founder tried seats, then pure credits, and concluded he can charge for the work but not yet the outcome. For a buyer offered per-outcome AI pricing, the question is whose outcome it is.
Keith Peiris of Lightfield described his pricing experiment on an a16z podcast: start at both extremes to find the frontier. Pure seat pricing was well received until the heaviest customers used 10,000 times more than the lightest. Pure consumption, where everything was a credit, ended with nobody touching anything, "the worst 3 weeks of the company's life." He landed on a platform fee plus seats for the core, consumption for everything else, and said outcome pricing is something they can't quite do yet. For a buyer being offered per-outcome AI pricing in 2027 budgets, each structure has a lesson. Seats are fair to nobody once agent usage spreads. Credits make people ration the work the line was bought to do. And an outcome depends on things the vendor doesn't control: in a strong quarter you pay for your own market, in a weak one the vendor's incentive to do the slow work fades, and in every quarter the party being paid may also be keeping score. What holds up is a fixed line for the core, per-unit pricing only where the unit is countable from your own records, and outcome pricing only once a per-outcome record, a per-location baseline and a count the buyer can run exist. The essay says where our own record falls short and closes with six questions for the next per-outcome offer.
#PrivateEquity#CFO#MultiLocation#AIPricingLire sur Substack → - Essai 99
The Accounts That Can Speak for You
In most multi-location groups, the logins that can post, message customers and spend on ads are the least governed. Before an agent gets that authority, count who already has it.
Earlier this month a verified brand account was taken over and used to run malicious ads, and the sharpest reply was about the badge: the checkmark mostly means the billing went through. Another practitioner described a marketing team with no SSO, shared accounts and no MFA that could run ads, message customers and post publicly. That is one person's account, but the shape is familiar. Security programs review access; marketing owns outbound authority, the ability to speak, message and spend as the brand, and it sits outside the access review. Take a composite Tulsa office in a forty-location group: a listing owned by a manager who left in 2022, a former agency still an admin, an Instagram password in a spreadsheet, an ad account on the company card passed around by login. Priced as money, a hijacked ad account costs your daily ceiling times the days until finance notices, a lost listing costs a seven-day ownership wait and more, and a text to four thousand patients cannot be recalled. Connect an agent through one of those logins and it inherits everything that login could do. The move is an inventory per location, with four columns: who can act, how they get in, who owns it, how you would know. Then shrink it and route what remains, people and agents, through one door. The essay says what our own door does and does not do today, and closes with five Monday steps and four questions for any vendor pitching an agent.
#MarketingOperations#MultiLocation#AIAgents#AIGovernanceLire sur Substack → - Essai 100
The Membership Plan Lives at the Front Desk
In-house membership plans are the dental lever every group can copy. The numbers behind them are narrower than the posts claim, and whether a plan pays is decided at each location's front desk.
Every DSO can launch a membership plan in a week, and the numbers going around say members beat insured patients on everything. Traced to their sources, they move. The 172% cash production, 76% more visits and 146% more procedures are a membership-plan vendor's before-and-after on the same patients when they were uninsured, not a comparison with PPO patients. The head-to-head with commercial insurance is 17% higher net production per patient, at one large DSO, measured by the vendor. The 80-90% retention figure has no primary source. What survives still points at a real lever: the uninsured or out-of-network patient who would otherwise drift, who becomes a member or doesn't in five moments at the front desk (the price call, the coverage change, the out-of-network patient, the hesitation at checkout, the renewal nobody chased). Same plan and price, very different results by location, and whatever separates the best office from the worst is operations. The essay adds the ADA's own cautions on cannibalization and state law, four pieces for making the desk conversation repeatable and visible, and a ten-minute per-location self-test built around the number almost no group tracks: how often the plan was offered.
#DSO#DentalPractice#MultiLocation#PrivateEquityLire sur Substack → - Essai 101
Latest Is Not a Version
The week a cheaper model shipped, its vendor shipped a setting that keeps new models out until someone lists them. The upgrade needs nobody. The refusal needs an owner, a test and a decision.
On September 22 Anthropic shipped Claude Opus 5.5 with a launch post, and Claude Code made it the default Opus model. Three days later, as bullets two and three of a 94-item changelog, the same tool added managed settings that keep new models blocked until someone lists them. Most teams call a model by a name that moves (a family, "Default", a prefix), and when it moves every workflow behind it changes model at once, with no ticket and no diff. The defaults said yes too: an allowlist entry for the old version matched the new one by prefix. The upgrade arrives with a reason, a price 20% lower per token that the vendor estimates at 40% less to run; the refusal arrives with work. Admitting a model should look like admitting any dependency: a named owner, an eval on your own accepted work before the name moves, an exact pin in production moved only by that eval, and a per-output record of which model answered. The essay then grades our own stack, where a new model became the default twelve minutes after joining the catalog with unit tests and no eval, and closes with four questions for any workflow running on a name that moves.
#AIGovernance#CIO#AIAgents#ChangeManagementLire sur Substack → - Essai 102
The Log Only Keeps the Yes
Agent logs record what the agent did. A refusal that leaves no row is half a control: you can show nothing crossed that you know of, never that the boundary held.
The week of September 22, three vendors made four announcements about agent visibility, and every summary described what the agent did: what it said, which tools it called, how long each step took. None mentioned what an agent tried and was not allowed to do. A permission check is a preventive control, and the yes leaves evidence by default because the act happens; the no leaves evidence only if someone built the row. Without it you can show the rule exists and that nothing got through that you know of, never one time the boundary was tested and held. Until September 22 our own check refused correctly and wrote nothing; the only record sat in the refused agent's transcript. The fix writes an audit row before the refusal, which agent, what act, the permission it needed and the ones it held, and the code will not compile without it. We triggered the first one in production on purpose, against a made-up id, and it is still the only row of its kind. The essay names the limit (an older check one level down still refuses silently in thirty places) and closes with four questions for any agent platform, starting with: show me the row.
#AIGovernance#AIAgents#CISO#GRCLire sur Substack → - Essai 103
The Group Answers Slower
Consolidation buys scale everywhere except the phone. Central call centers and after-hours voicemail can make an acquired location slower to answer a new caller than the independent down the street.
The independent practice a group bought last year picked up its own phone; the one it runs now routes to a call center that closes at six. The essay argues a mechanism, not a survey result: four reasonable decisions made for scale (the local line moves to a central queue, the hours shrink to the center's hours, scheduling gets shared, and the reporting rolls up to a group average where a slow location hides) together slow the answer at the hours new callers are likeliest to shop around. It traces the "8x" figure circulating that week, finds no primary it would stand behind, and keeps only what the 2011 HBR audit and the 2007 MIT/InsideSales study support: interest decays in minutes, measured on web forms, not patients calling. The measure is two numbers, unanswered rate and time to answer, cut by location and by hour band, and recorded before and after each acquisition's line moves. It closes with structural fixes (ring local first, staff the evening callers keep, a callback clock after hours), a disclosure of what we do and don't measure today, and a Monday check: call your own locations at 6:15pm and Saturday at 10, then call the independent.
#DSO#MultiLocation#MarketingOperations#SpeedToLeadLire sur Substack → - Essai 104
Right Is Not Demonstrable
Vendor scorecards still rank AI on accuracy. The record rules regulated buyers answer to ask what one decision rested on, and no benchmark answers that. Ask for one decision with its basis.
A model that is right 99% of the time and cannot show why it decided is the wrong model for any decision an inspector can ask about, and most AI vendor scorecards still rank it first. The essay starts from a vendor's September post arguing that under Part 11 the requirement is "demonstrability rather than quality," then checks the rule: Part 11 never uses that word, its audit trail records who acted and when, not why, and its validation control names accuracy outright. The basis requirement lives in the predicate rules underneath it: drug GMP investigation records must include "the conclusions and followup," lab records must state how results compare with the standard, and a second person reviews each record for accuracy, which they can only do if the basis is in it. Regulation B says it more bluntly: failing to reach a qualifying score is an insufficient reason. At forty decisions a week, a 99% benchmark means about twenty wrong ones a year and cannot say which. The basis has to be written and checked by the system, not narrated by the model. The essay discloses where our own content gate records that basis and the two places it stops, and closes with a Monday list: move accuracy down a row and ask for one decision with its basis.
#AIGovernance#CIO#GxP#RiskManagementLire sur Substack → - Essai 105
The Gate Can't Refuse What It Can't Read
Our content gate was built to fail closed if it could not run. The first live piece came back in the wrong format, never reached the gate, and sat in a customer's queue unchecked.
The first live piece our content engine wrote for a customer never reached the gate. The gate did not fail; it was never asked. A route that runs recipes by hand never applied the output schema, so the model answered in markdown, and the code in front of the gate parsed it, could not, and returned null: not a local post, not my business. A post for a named location sat in the customer's queue as a draft with no checks attached until we rejected it by hand; nothing was published or sent. Even the fail-closed path for a gate that throws asked the same parser first. The essay names the third answer every shared gate has besides pass and refuse ("this isn't for me") and why it is where the hole lives: if scope is decided by whether the input parses, the more broken the input, the less it gets checked. The fix was one rule, decide what a piece is from what it claims, not whether it parses, tested by sabotage. Then a suite fed every gate unparseable, throwing and absent inputs; it found three more fail-open branches, now fixed, and pins the rest. It closes with four questions for whoever runs your gate.
#AIGovernance#AIAgents#CISO#SoftwareEngineeringLire sur Substack → - Essai 106
Ask Which Fetches the Guard Doesn't Cover
In June we wrote that one guard covered every URL our server fetches for a user. An outside researcher found three it didn't. The guard wasn't the problem. The claim was an unchecked inventory.
On June 11 our changelog said every code path that fetches a user-supplied URL now goes through one shared server-side request-forgery guard: "One guard, audited once, enforced everywhere." On October 1 an outside researcher, through our bug bounty, showed us three routes it did not cover. They belonged to a feature for connecting a self-hosted model server, predated the guard, and were not in its audit, because nobody thought of a model setting as fetching a user-supplied URL. Looking at the same class that day, we found it in a second place, the stored custom model endpoints. All of it was fixed, deployed and verified the same day. The essay's point is not the guard. "Every request goes through our guard" is two claims: one about the guard, which you can test, and one about the inventory, which is true only of the list someone made on the day they made it. AI platforms add fetches fast (bring-your-own endpoints, model servers, integrations, webhooks, imports), so the inventory goes stale fastest there. It discloses that we do not yet have a mechanical census of our own fetches, and closes with four questions: show me the census, how a new fetch gets onto it, which fetches are exempt, and when the list last changed.
#CISO#AISecurity#VendorRisk#AIGovernanceLire sur Substack → - Essai 107
The Channel Headquarters Doesn't Run
Two-thirds of dental practices name referrals as their top source of new patients. In a group, the budget sits at headquarters and the referral happens at the front desk, where nobody owns it.
In MouthWatch's 2026 survey of 448 dental professionals, 65.6% named word of mouth and referrals as their top source of new patients. That is the share of respondents naming it, not the share of patients, and only 19.2% of them say they track marketing closely, so it is mostly what practices believe. Google combined was 23.2%; formal referral programs were 2.2%. The essay's mechanism (not a finding: the survey has no group/independent split) is that when a practice joins a group, the marketing budget, the agencies and the dashboards move to headquarters, which spends where it can show results. The referral happens at the location, after the visit: at checkout, in a review reply, in a recall text, and every location does it differently. A group-wide referral program mostly rewards the offices that were already good. The fix is to run the post-visit moment like a campaign: a defined script, an owner at headquarters and at each location, a measured source for every new patient, and a follow-through kept within privacy rules. Then rank locations on source capture rate, referral share and post-visit activity. It discloses that nothing JieGou runs today records where a new patient heard about the practice, and closes with a ten-minute check on last quarter's new patients.
#DentalMarketing#DSO#MultiLocation#DentalPracticeLire sur Substack → - Essai 108
Fifteen Minutes to a Human
California just put a clock on the handoff from bot to person. We read the new law against our own platform and found a message telling customers a human had been contacted when nobody had been.
On September 28 California chaptered AB 1609 (Chapter 733, Statutes of 2026), a short law about customer-service chatbots at businesses with more than $500 million in national revenue, owed to California residents. It bans passing a bot off as human, requires disclosure in the channel itself (the voice line included), and when a customer asks for a person, requires a good-faith effort to connect them within 15 minutes or offer an appointment within one business day. The operative date is not stated; January 1, 2027 is an inference for counsel to confirm. The disclosure is the easy part. The safe harbor rewards standards designed to meet the clock, and the only way to show a standard about time is to have measured it. Reading the law against our own platform, we found voice agents told never to disclose unprompted, a human-request trigger in one language, an acknowledgment saying a human had been contacted when nobody had, and nothing timing the handoff. Three fixes are filed, none shipped, and we won't call ourselves ready until they are. It closes with a six-step Monday check: two questions for counsel, ask for a person on every channel, read the reply, time it, call your voice agent, and ask your vendor for the two timestamps.
#CustomerExperience#MultiLocation#AIGovernance#PrivateEquityLire sur Substack → - Essai 109
The Default Moved to the Model
The same week, one vendor gave its regulated customers an admin switch and gave the plan your managers can expense a model that decides which of its own actions you get asked about.
At its September 29 developer day, OpenAI introduced dots, an always-on agent that acts in your connected apps. It is "rolling out today" to Pro and Business Premium; Enterprise, Edu and Healthcare get it "when their workspace admin enables it." On the self-serve plans it starts "with built-in rules for when to act independently and when to ask for approval," and an auto-review model applies them. The three-state Custom Rules (allow, require approval, block) are a real improvement over an on/off switch; the issue is the buyer who never opens the rules page. Claude Code 2.1.283 moved the same direction for unconfigured sessions. The governance question used to be whether the agent asks before it acts. Now it is who set the rule that decides when it asks, whether the thing being governed can lower it, and what each outward act leaves behind. A default the model evaluates is a default the model can lower, with nothing that looks like a failure. In a multi-location group the expensable plan skips procurement, so it is an inventory problem first. The essay proposes a posture that is declared, tested, and out of the evaluator's reach, plus a receipt per act, discloses where JieGou's own records still fall short, and closes with a five-step Monday check that starts with finance's list of AI plans expensed by locations.
#AIGovernance#AIAgents#CISO#PrivateEquityLire sur Substack → - Essai 110
The Claim That Lasted a Day
Our weekly brief said nobody's agent log recorded the act that was refused. A day later, two vendors did. What survives that is the claim a stranger can check, not the claim a sprint can copy.
On Monday, September 28, our weekly competitive brief said: "Nobody's log has a row for the act that was refused." On Tuesday, n8n merged a pull request that sends an audit event to log streaming whenever a policy blocks an action, with a required actor on every enforcing call, and xAI's Grok Bot docs now record "the decision that allowed or refused it (Auto-review, a hook, or the member)." Both are good engineering, honestly scoped, and neither copied anything. The essay credits what each shipped and what each says it leaves out, owns the paragraph in The Log Only Keeps the Yes that had gone stale, and draws a distinction for buyers: a capability sentence ("we log the refusal") is true until the next release, anyone's, while an evidence sentence ("here is the row, the chain it sits in, and a tool you can run on it without us") depends on an artifact a stranger can use. JieGou's narrowed claim is stated with its limits attached, including the thirty older checks that still refuse without writing anything. It closes with five questions for reading a vendor's governance claims, starting with discounting every capability claim to the half-life of a pull request.
#AIGovernance#AIAgents#CISO#VendorRiskLire sur Substack → - Essai 111
The Fallback Is a Contract Change
When a customer's own model key can't be used and the call runs anyway on the vendor's key, nothing looks broken. The request just moved to a different contract, and nobody decided that.
A customer who brings its own model key is rarely doing it for the price. The key carries a contract: retention terms, a region, a DPA, sometimes a BAA. When that key expires, is rotated, or fails a lookup, a well-meaning branch of code can run the call on the vendor's own key instead. The call succeeds, the same model answers, and the request has quietly moved to a different contract. The fifth tell in the series asks one question, "When my key fails, what happens to the next request, and where would I see it?", and sorts three answer shapes: it keeps working; it falls back and we log it; it refuses visibly unless you opted in, and each call's record shows whose key served it. Model routers make the same move by design: OpenRouter's documented default load balances across providers with fallbacks on unless you pin them, which is reasonable for uptime and means your posture is the weakest provider a request could reach. The essay discloses that JieGou found answer one in its own key-resolution code, measured that no customer was affected, shipped answer three, and closes with five things to check on Monday.
#AIGovernance#CISO#DataPrivacy#VendorRiskLire sur Substack → - Essai 112
Your Model Vendor Just Became a Competitor. What Moves With You?
Microsoft reportedly cut a per-employee Claude budget tenfold because it had somewhere to go. The model is the easy part to move. What you built inside a vendor's agent product is not.
The Information reported that Microsoft cut internal Claude spending by more than a third, with the monthly per-employee budget in its cloud organization going from $100,000 to about $10,000, and that Meta's Claude Code users fell from about 60,000 to 30,000, partly from layoffs and partly from its own tools. The essay sets out what was reported and the context that cuts the other way (Microsoft's investment untouched, customer Claude spend through Azure and Bedrock still growing), and argues the useful story is that Microsoft could do it and keep working. What it reportedly moved in May was the harness, not the model: engineers went from Anthropic's coding agent to GitHub's own. The model is the easy swap; switching cost lives in five things built inside a vendor's agent product: procedures, approval rules, evals, memory and the audit record. It poses one question for budget season, "If we had to move 80% of our model spend in 30 days, what would we lose?", separates a vendor from a landlord, notes that even the neutral router layer now has an owner (Stripe agreed to buy OpenRouter), discloses where JieGou's own portability falls short, and closes with five things to check on Monday.
#CIO#AIGovernance#AIAgents#EnterpriseAILire sur Substack → - Essai 113
Who Can Widen It?
Most controls govern what an identity does, not how it got the right to act. Agents are made of grants, so ask any vendor: who can widen this agent, can it widen itself, and where is that recorded?
In the same month, three r/msp threads found the same hole from different directions: an incoming provider in a contested handover created its own admins inside a client's tenant and disabled one of the incumbent's; a persuaded user could register extra passkeys, each a full credential, until a single-use-code gate was put on registration itself; and a delegated-access tool too narrow to work pushed technicians back to standing global admin. The controls governed what an identity does once it exists, not the moment it acquires the right to act. That matters more for agents, whose authority is almost entirely granted. The sixth tell in the series asks one question, "Who can widen what this agent is allowed to do, can it widen itself, and where is the widening recorded?", and sorts three answer shapes: an admin can change it; every change is logged; widening needs a named person above the agent, never a default, never self-granted, landing as its own grant on the record. It separates an agent's owner from its widener, discloses where JieGou's own answer stands and falls short, and closes with five things to check on Monday.
#AIGovernance#AIAgents#CISO#MSPLire sur Substack → - Essai 114
The Repair Hides the Rate
Our drafting step refused 30% of the content hooks our digest handed it. A source check on the ones it shipped found 37 of 46 also failed. It had been repairing them, so the real rate never showed.
Over two weeks, our drafting seat's refusal rate on digest hooks went from 3% (2 of 71) to 30% (18 of 61), and it looked like the upstream stage had gotten worse. A source check that reads each hook's cited source told a different story: of the 69 hooks the seat had shipped, 46 had readable sources and 37 of those failed on a central claim. The seat had been refusing what it could not save and quietly repairing the rest from its own research, so the posts were sourced and nobody saw the rate. The essay argues that any stage which repairs its input is a second, unmeasured producer, and that an upstream metric built on downstream failures counts only the errors the downstream could not absorb. It shows how a verbatim-quote rule that compared against a model's summary, never the source, confirmed invented quotes; why three changes landing on one day keep it from blaming any one of them; what changed after the calibration, with the source check still advisory; and five things to check on Monday.
#AIAgents#AIGovernance#CIO#CTOLire sur Substack → - Essai 115
The Customer Sent an Agent
Two standards announced on October 6 let a customer's AI agent act for them once they sign in at the company. Your patients have no login. Decide what each location accepts as proof first.
On October 6, Meta and Sierra announced the Personal Agent Protocol and Decagon open-sourced PACT, two ways for a customer's own AI agent to deal with a business on the customer's behalf. Both route account actions through a sign-in at the company, which fits retail and payments. It does not fit a dental patient, an HVAC customer or a salon client, who is a name, a birth date and a phone number in one location's system, with no login. So the decision lands at the front desk before any standard does. The essay sets out three answers each location needs when an agent asks to book, move or cancel: what counts as proof the person asked (knowing the birth date no longer does; a confirmation to the contact on file still does), what an agent may do as a guest (read freely, request writes), and what is kept afterward. On that last point, PACT has the business sign a receipt for every delegated action and tells the customer's agent to keep it, while nothing requires the business to. It argues the cost is inconsistency between locations, discloses where JieGou stands, and closes with five things to do on Monday.
#MultiLocation#DentalGroups#HomeServices#AIAgentsLire sur Substack →
Nouveaux essais + version podcast audio, chaque semaine
Abonnez-vous pour recevoir chaque essai dans votre boîte de réception et dans le flux du podcast.