An auditor has to review what an AI did. The cheapest way to let them do that is to hand them an admin account. But then the person they are supposed to review becomes themselves. This piece is about
An auditor receives an evidence package. The hash chain verifies. What will they read that as? Most people read it as two things: the rows were not altered, and they are all here. The chain proves onl
An AI asks to write something, and a person has to approve it. There are two kinds of "expired" in that sentence, and they are not the same thing: should the conversation keep waiting for the approval
An assistant calls a tool that writes. That call can arrive twice: the model retries it, the same confirmation gets decided twice, or the process restarts mid-flight. A second arrival must not write a
The earlier pieces were about stopping things: where the boundary sits, how risk gets tiered, how a write gets undone. This one steps back and looks at a single part. What the system actually holds af
Something happened recently that I want to start with. We fixed a defect: four different kinds of "nothing" were collapsed into a single switch, so the readings couldn't tell "by design" from "broken"
After the first few pieces went out, three questions came back. They don't look related: Is tool the right unit for an AI's actions? How do you monitor a path you didn't know existed? What about a slu
The first two pieces were about stopping things — put the boundary on the execution path, then give every tool an execution policy by risk. But some of it can't be stopped. The policy allowed it, the
The previous piece, "Runtime over Prompt", argued that the security boundary belongs on the execution path — immediately before a tool call can produce a side effect. This one goes a level deeper. Onc