Posts on Thinking on Paper

Agent Governance Is an Old Job

Sat, 26 Sep 2026 13:27:29 -0400

Let employees build agents on every platform you own, and soon you’ll have more agents than anyone can name.

Each build platform keeps its own inventory, usage data, and risk view, so governance splits along the same lines. The collaboration admin governs collaboration agents, the low-code admin governs low-code agents, and the identity, data, and security teams each work alone. That arrangement holds until agents start calling each other, running unattended, and holding their own identities. After that, nobody sees the whole system.

Write Without AI First

Sun, 06 Sep 2026 10:30:34 -0400

Writing is thinking. Leslie Lamport put it more sharply in a 2014 talk: if you’re thinking without writing, you only think you’re thinking. He also quoted the cartoonist Dick Guindon: “Writing is nature’s way of letting you know how sloppy your thinking is.”

Lately I’ve been breaking that rule in a new way. I’m not skipping the writing. I’m handing it to AI.

A draft is a test Link to heading

An idea in my head feels complete. It has no gaps because I never have to look at all of it at once. Writing forces order: this claim before that one, this because of that. The gaps show up as sentences I can’t finish and transitions I can’t justify.

What Identity Does Your Agent Run As

Sat, 05 Sep 2026 17:15:44 -0400

The refund went through. The agent was supposed to investigate a disputed charge. It held its owner’s personal API token, with every billing permission the owner had, because that was the only credential available. A support message instructed it to refund another account. The API accepted the call.

The token was valid. The action was outside the task.

Authentication identifies the workload. Authorization determines what it may do for this task. A credential can carry both. The mistake is treating the owner’s available permissions as the agent’s authority.

Understanding Agent Skills

Sat, 29 Aug 2026 20:11:21 -0400

Understanding Agent Skills Link to heading

If you’ve used Claude Code, or watched an AI agent debug the same kind of error for the hundredth time like it was the first, you’ve run into the problem Agent Skills were built to solve. Large language models are broadly capable but they don’t remember how your team does things. Every session starts from zero. A coding agent that has fixed the same null pointer exception a hundred times still approaches the hundred and first as if it’s never seen it before, because whatever it learned last time disappeared the moment the context window closed.

Agents Propose, Policy Accepts

Sat, 22 Aug 2026 21:15:41 -0400

I’ve spent a good chunk of this year helping teams put coding agents into real delivery pipelines. Not demos. Pipelines with on-call rotations attached.

The mental model that survived is one sentence: agents propose, policy accepts. An agent’s output is a change proposal. It merges when the same machinery that gates human changes says yes: automated checks, ownership rules, review, deploy approvals. The agent never gets to say yes to itself.