Writing
#Architecture
14 pieces with this tag.
Connected is not sovereign: what it takes to qualify a frontier model route
Most "sovereign AI" claims fail at the first outage, when the system quietly phones out. Here is the contract I wrote to keep two assurance classes honest. Field note two.
Agents are principals: machine identity as a first-class actor
Every identity source hard-coded the principal type to user, so a caller no human authenticated was recorded as human. Found while building, not by review. Decision record ten.
Adopting a vendor agent harness with its dangerous defaults enforced off
A vendor harness reached stable. Four of its default capabilities each break a platform rule. Adopt it, and enforce all four off at two fail-closed points. Decision record nine.
Graduated autonomy: delegate by blast radius, keep binding decisions human
Four autonomy classes for a build pipeline that produced decisions faster than a human could ratify them, and the one class that stayed human-only. Decision record five.
The run is the unit of governance: why durable execution belongs under every agent
Temporal, DBOS and Restate solve reliability. For a regulated agent platform they solve governance first: without a durable run, nothing can be approved, audited or stopped. Field note five.
Break-glass: deny-all by default, and a designed narrow override
When the approval service is down, the override you did not design is the one that gets invented under pressure. The five properties of the one I did. Decision record eight.
Content entering the model is untrusted at every entry point
Actions leaving the model were well governed. Content entering it was not. Six entry points, one named kernel control each, and three honest limits. Decision record six.
The controls an extension can never disable
A fixed set of kernel controls no extension can replace, and the retrieval filter that was wrongly listed as replaceable. Decision record three.
A library the governed code can decline to call is not a control
An in-process governance library can be a useful signal source. It cannot be an enforcement point, because nothing forces the call. Decision record four.
Model output is an untrusted candidate until promoted
Every model output starts untrusted and becomes a response, record or memory only through an explicit promotion path. Memory as the worked example. Decision record two.
Business rules are enforced outside the model
Prompts configure behaviour; they do not enforce policy. Why executable rules live in a policy service outside the model, and what that costs. Decision record one.
Three release gates, and only a human releases
Deterministic checks may block. Statistical evaluation may block, or say inconclusive. Only a named human releases. Why a judge model never gates. Decision record seven.
The trust-root question: who is allowed to be the thing you cannot question?
Every agent platform has a trust root. If it is your model provider, your runtime or your cloud, you have outsourced the one decision you are accountable for. Field note one.
When every tool is a server: where MCP gateways really enforce policy
MCP turned tool access into a network problem. Eight gateways read at source, four ideas worth taking, and the question of what a gateway can and cannot govern. Field note four.