Skip to content
Rutger Hemrika
Menu

Writing

Long-form, evidence-led, with a decision, a limitation and a practical implication in every piece. On AI governance, the AI era of software, and shipping in the public sector.

Agent platform field notes

Eight decisions a CTO or Head of AI has to make about an agent platform, each with the evidence I used, where I landed, and what I still cannot prove. Read in order; each note builds on the last.

  1. 01
    6 min read

    The trust-root question: who is allowed to be the thing you cannot question?

    Every agent platform has a trust root. If it is your model provider, your runtime or your cloud, you have outsourced the one decision you are accountable for. Field note one.

  2. 02
    6 min read

    Connected is not sovereign: what it takes to qualify a frontier model route

    Most "sovereign AI" claims fail at the first outage, when the system quietly phones out. Here is the contract I wrote to keep two assurance classes honest. Field note two.

  3. 03
    7 min read

    What agent frameworks actually govern, and what they leave to you

    Six agent frameworks compared on one axis: which of the five governance decisions they take, and which land on your desk. Field note three.

  4. 04
    6 min read

    When every tool is a server: where MCP gateways really enforce policy

    MCP turned tool access into a network problem. Eight gateways read at source, four ideas worth taking, and the question of what a gateway can and cannot govern. Field note four.

  5. 05
    5 min read

    The run is the unit of governance: why durable execution belongs under every agent

    Temporal, DBOS and Restate solve reliability. For a regulated agent platform they solve governance first: without a durable run, nothing can be approved, audited or stopped. Field note five.

  6. 06
    5 min read

    Prove or hope: what evaluation and guardrail tooling can actually establish

    Inspect AI, NeMo Guardrails and Langfuse each answer a different question. Confusing them is how teams end up with a dashboard where a control should be. Field note six.

  7. 07
    5 min read

    Evidence against enthusiasm: the ledger behind a build-versus-buy decision

    How a hundred frameworks and four hundred sources became a decision-grade ledger, and why its first act was to downgrade every claim about my own work. Field note seven.

  8. 08
    5 min read

    The rules my AI coding agents work under, and why validators detect but never prevent

    Declared write sets, forbidden decision fields, a required not-established answer, named human sign-off. The operating contract for the agents that build a governed platform. Field note eight.

The case behind this series: the governed agent platform

Decision records

One architecture decision per piece, from the governed agent platform: the situation, the decision, what I rejected and why, what it costs, what it does not do.

  1. 01
    5 min read

    Business rules are enforced outside the model

    Prompts configure behaviour; they do not enforce policy. Why executable rules live in a policy service outside the model, and what that costs. Decision record one.

  2. 02
    5 min read

    Model output is an untrusted candidate until promoted

    Every model output starts untrusted and becomes a response, record or memory only through an explicit promotion path. Memory as the worked example. Decision record two.

  3. 03
    5 min read

    The controls an extension can never disable

    A fixed set of kernel controls no extension can replace, and the retrieval filter that was wrongly listed as replaceable. Decision record three.

  4. 04
    4 min read

    A library the governed code can decline to call is not a control

    An in-process governance library can be a useful signal source. It cannot be an enforcement point, because nothing forces the call. Decision record four.

  5. 05
    4 min read

    Graduated autonomy: delegate by blast radius, keep binding decisions human

    Four autonomy classes for a build pipeline that produced decisions faster than a human could ratify them, and the one class that stayed human-only. Decision record five.

  6. 06
    4 min read

    Content entering the model is untrusted at every entry point

    Actions leaving the model were well governed. Content entering it was not. Six entry points, one named kernel control each, and three honest limits. Decision record six.

  7. 07
    4 min read

    Three release gates, and only a human releases

    Deterministic checks may block. Statistical evaluation may block, or say inconclusive. Only a named human releases. Why a judge model never gates. Decision record seven.

  8. 08
    4 min read

    Break-glass: deny-all by default, and a designed narrow override

    When the approval service is down, the override you did not design is the one that gets invented under pressure. The five properties of the one I did. Decision record eight.

  9. 09
    4 min read

    Adopting a vendor agent harness with its dangerous defaults enforced off

    A vendor harness reached stable. Four of its default capabilities each break a platform rule. Adopt it, and enforce all four off at two fail-closed points. Decision record nine.

  10. 10
    4 min read

    Agents are principals: machine identity as a first-class actor

    Every identity source hard-coded the principal type to user, so a caller no human authenticated was recorded as human. Found while building, not by review. Decision record ten.

The case behind this series: the governed agent platform

Methods and explainers

Longer pieces on method: how to threat-model your own agents, how the EU AI Act turns into engineering controls, and what a leader builds to understand AI.

  1. 01
    7 min read

    Treat your own agents as an adversary class: a threat-modelling method for agent platforms

    Eight adversary classes, one of them the platform’s own agents, another the agents that build it. The record format, the matrix, and ten threat patterns with the control that answers each.

  2. 02
    7 min read

    The EU AI Act as engineering controls: Article 14 first

    How I turned a compliance library of fifty frameworks into controls an engineer can build, starting with the article most AI strategies get wrong: human oversight.

  3. 03
    4 min read

    What a leader builds to understand AI: a learning arc in eight repositories

    From an AI course in 1995 to a governed agent platform in 2026, by way of a sentiment analyser, a code-review bot and a language framework. The repositories I built to earn an opinion.

The case behind this series: the governed agent platform

Programming languages in the AI era

Eight articles from my open research framework scoring ten languages for AI-agentic development, ending with predictions I will grade in public in May 2027.

  1. 01
    15 min read

    Programming Languages in the AI Era: A Greenfield Reset

    Why incumbent gravity stops being the right answer once AI is doing more of the writing — and what to use instead.

  2. 02
    8 min read

    TypeScript or Go? The Tie at the Top Is Actually Two Different Bets

    Why my framework’s most interesting finding is a deadlock that resolves into a decision rule.

  3. 03
    8 min read

    The Python Paradox: Best-in-Class AI Ecosystem, Mid-Pack Overall Score

    Why Python’s tier-leading AI-systems ecosystem is held back by gaps in the rest of the row.

  4. 04
    8 min read

    The .NET Sleeper: The Cohort’s Strongest Forward Bet While No One Was Looking

    .NET ranks #3 today and alone at #1 on both Ecosystem Dependency Risk and Reachability. The matrix exposes an under-positioned platform.

  5. 05
    8 min read

    Memory Safety Crossed Into Regulatory Territory in 2024

    Four independent institutions now treat memory safety as a structural language property they actively select for. Greenfield C++ adoption now carries a knowingly-accepted regulatory risk.

  6. 06
    8 min read

    Pydantic Has More Power Over Your Stack Than You Think

    The Ecosystem Dependency Risk dimension makes visible what most language-choice frameworks miss: who actually controls your platform.

  7. 07
    8 min read

    Don’t Pick a Language for Where It Is. Pick It for Where It’s Going.

    The Reachability dimension separates current-state ranking from forward-trajectory plausibility. For a 5-year platform bet, trajectory matters more than this-year score.

  8. 08
    6 min read

    Eight Predictions I’m Willing to Have Graded in 12 Months

    If a framework can’t be falsified, it isn’t useful. Here are the bets I’m placing publicly.