Blog
Field notes on security and AI, written by a practitioner.
Long-form writing for risk, security, and board readers. Framework-anchored, regulator-literate, and informed by what actually happens in mid-market deployments.
12 min read
Digital employees on the platform: the eight integration decisions nobody briefs
When a business unit deploys a digital employee, the platform engineering team gets the bill, the audit findings, and the on-call ticket, usually without being involved in the decision. The integration decisions that protect both sides are not the ones the AI vendor's solution architect will brief you on.
- Digital employees
- Platform engineering
- Identity
11 min read
The Privacy Act reforms changed the AI compliance baseline. Most organisations have not updated.
The Privacy and Other Legislation Amendment Act 2024 brought a statutory tort, expanded OAIC enforcement, and surfaced automated decision-making in legislation. The AI deployments most Australian organisations are running now sit under privacy obligations they were not designed for.
- Privacy Act
- OAIC
- AI governance
3 min read
MCP and the new authorisation surface nobody is reviewing
Model Context Protocol turns every internal API into a tool an agent can call on a user's behalf. The authorisation model most teams ship with is naïve, and the audit log usually proves it.
- MCP
- Agents
- Authorisation
5 min read
Digital employees, with the governance attached
Why most digital employee deployments fail their first audit, and what a governance-first build looks like: identity, data access, supervision, and the accountability question almost no-one is answering well.
- Digital employees
- Agents
- Governance
4 min read
Mapping APRA CPS 230 to your AI tooling: a practical checklist
Translating CPS 230 material service obligations to Microsoft 365 Copilot, ChatGPT Enterprise, and Claude deployments: what changes when an AI vendor becomes a material service provider.
- APRA
- CPS 230
- Vendor risk
3 min read
Securing CI/CD pipelines without slowing engineering down
Pipeline security is the gap between policy and reality. Most regulated firms have written rules about code review and signed releases that the actual pipeline does not enforce, and the audit evidence is whatever the runner happened to print to stdout.
- CI/CD
- Platform engineering
- Supply chain
Stay informed
Get new posts by email.
One email a fortnight. Long-form content only, no promotional sequences. Unsubscribe at any time.
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.