Blog
Notes from applying the framework.
Writing on AI agent deployment and governance — identity, audit trails, and the parts of "putting an agent into production" that a demo never shows you.
Why AI Agents Break When a Tool Call Fails
Demos run on the happy path. Production agents need retries, timeouts, and escalation handled by the orchestration layer, not the model.
12 October 2026
IdentityHow many AI agents are running in your company right now?
Most companies can't list their AI agents. Unregistered agents pose security and compliance risks. Here's how to gain control.
11 October 2026
IdentityShould an AI Agent Act as Itself or as You?
Delegated user permissions look tidy but hand an AI agent everything a senior person can do. Here's why a narrower, agent-owned identity is safer, and when delegation fits.
9 October 2026
IdentityHow to Revoke an AI Agent's Access Mid-Task Safely
Revoking an AI agent's credentials is easy. Doing it mid-task without leaving a customer record half-changed takes idempotent steps, checkpoints and a defined stop.
7 October 2026
IdentityOne identity for your AI agent, or one per system?
Give an AI agent separate scoped credentials per system, not one identity across all of them. Here's the cost in rotation work and where a broker pays off.
5 October 2026
Case StudyAnatomy of an AI Agent Pilot That Stalled at a Services Firm
A composite walkthrough of an AI agent pilot that stalled for weeks because no one could say who approves its actions or what happens when it's wrong.
4 October 2026
Case StudyWhy We Start AI Agents With Read-Only Access
Running an AI agent in observe-only mode against real data, before it gets any write permissions, catches source-system errors that demos never show.
2 October 2026
GovernanceISO 42001 Readiness for AI Agents: What an Australian Business Needs to Show
ISO/IEC 42001 is the certifiable standard for managing AI. Here is what it asks of a business running AI agents, and the evidence an auditor will look for.
1 October 2026
GovernancePrivacy Act Automated Decision-Making Rules: What They Mean for AI Agents
From 10 December 2026 Australian privacy policies must explain automated decisions that significantly affect people. What that requires of an AI agent deployment.
1 October 2026
GovernanceAustralia's Voluntary AI Safety Standard, Applied to AI Agents
The ten guardrails in Australia's Voluntary AI Safety Standard, mapped to what a governed AI agent deployment looks like in practice.
1 October 2026
AuditHow Long Should You Keep an AI Agent's Audit Records?
Agent audit records should be kept as long as your industry's regulations require for the equivalent human action. Here is who should decide that, and how.
30 September 2026
AuditWhy "We Have Logs" Isn't the Same as an Audit Trail
Application logs show that an AI agent acted. An audit trail shows why, under what policy, and who approved it — and most companies only have the first.
28 September 2026
AuditWhat an AI Agent Audit Trail Needs to Survive a Regulator
A demo activity log and a regulator's request are different things. Here is what an AI agent audit trail must capture at the moment of action to hold up.
27 September 2026
GovernanceWho Should Own the Policy Your AI Agent Enforces?
IT usually ends up owning AI agent policy by default. The business unit should own what the policy says; tooling should only enforce it faithfully.
25 September 2026
GovernanceWhat Should an AI Agent Never Be Allowed to Do?
Approval thresholds should flex with performance; a small set of actions — like changing its own permissions — never should. Here's how to draw that line.
23 September 2026
KnowledgeShould an AI Agent Be Allowed to Read Your Slack History?
Slack contains HR complaints and salary talk never meant to train anything — here's how to scope what an AI agent's knowledge layer can actually see.
21 September 2026
KnowledgeYour AI Agent Is Still Using Last Quarter's Price List
An AI agent grounded in a stale pricing sheet or approval matrix won't flag the problem — it'll just act on it. Here's why knowledge needs an owner.
20 September 2026
KnowledgeWhy Your AI Agent Gets Your PTO Policy Wrong
LLMs answer HR and policy questions from generic training data, not your internal wiki—here's why that gap breaks AI agents in production.
18 September 2026
OrchestrationWhen Does a Second AI Agent Make Your Workflow Riskier?
Splitting a workflow into a research agent and an execution agent sounds safer — but the gap between them can cost more than one agent doing less.
16 September 2026
OrchestrationWhat Happens When AI Agent B Rejects Agent A's Work?
Chaining AI agents fails when nobody defines what happens on a rejection, timeout, or bad handoff — here's how to fix that before deployment.
14 September 2026
IdentityWhy Does Your AI Agent Have Admin Access to the CRM?
Most AI agents get broad write access because scoping permissions felt like extra setup. Here's what that costs when one output goes wrong.
13 September 2026
IdentityWhat Happens to an AI Agent's Access When Its Creator Leaves?
Most AI agents run under a personal login or API key. When that employee leaves, the agent's access rarely gets revoked with them.
11 September 2026
IdentityCan AI Agents Share Logins? What Breaks Downstream
Using a single service account for multiple AI agents makes auditing impossible, compromises security, and prevents granular control over automation.
9 September 2026
GovernanceAI Agent Pilots Stall Because Governance Isn't an Afterthought
AI agent pilots often stall because they skip a diagnostic audit that defines real workflows and approval policies upfront.
7 September 2026
OrchestrationToo Many AI Agents: When Coordination Becomes Risk
Understand when multiple AI agents genuinely improve automation and when they introduce unnecessary complexity and hidden risks.
6 September 2026
AuditWhat "Runs Inside Your Infrastructure" Actually Means
A plain look at the architectural difference between an AI vendor that hosts your data and a deployment that stays inside infrastructure you already control.
4 September 2026
GovernanceSix Questions That Tell You If You're Ready for an AI Agent
The six operational and governance questions that predict whether an AI agent deployment survives contact with your business.
2 September 2026
IdentityYour AI Agent Needs Its Own Identity, Not Your API Key
A shared API key isn't an agent identity. Here's what a scoped agent credential actually looks like, and why it matters for security and audit.
28 August 2026
GovernanceApproval Gates: Where AI Agents Actually Need a Human
How to decide which AI agent actions need human sign-off and which can clear automatically, without stalling the automation or losing control.
28 August 2026
KnowledgeAI Chatbot vs. Automation Tool vs. AI Operating System
A chatbot answers, an automation tool executes, an AI operating system decides — here's how to tell which one you're actually deploying.
28 August 2026
Case StudyYour Finance Backlog Isn't a Headcount Problem
Financial-ops backlogs come from manual handoffs between systems, not effort — what a governed agent can safely absorb, and what still needs a human.
28 August 2026
KnowledgeWhy Does Your AI Agent Answer From the Wrong Data?
An AI agent without real grounding answers from general internet patterns, not your documents — here's what a real knowledge layer requires.
28 August 2026
Case StudyThe Audit Trail Question Every Healthcare AI Agent Must Answer
Healthcare AI agents fail audits, not demos. Here's what “who touched this record and why” has to look like before an agent goes near patient data.
28 August 2026
Case StudyInsurance Claims and AI Agents: What Governance Actually Buys You
A rules engine denies what it can't parse. See how a governed AI agent handles claims edge cases while still clearing an approval gate for anything unusual.
28 August 2026
Case StudyWe Migrated Our Own Invoicing Agent Off Wave. The Guardrails Never Moved.
We built an AI agent against Wave Financial, then moved our own books to Invoice Ninja days later. What had to change was smaller than we expected — and what didn't change is the actual argument for building it this way.
17 August 2026
GovernanceWhy Most AI Pilots Never Leave the Demo Stage
Demos skip approval, audit, and failure handling. Here's what production actually requires before an AI agent touches real customer data.
17 August 2026
OrchestrationWhat Is an AI Agent Orchestration Layer?
A single LLM call can't hold state, retry failures, or coordinate tools — here's what an orchestration layer has to guarantee instead.
16 August 2026
GovernanceGovernance isn't what slows automation down. It's what gets it approved.
Why every agent deployment we build starts with the approval policy, not the automation — and what happens to the ones that skip it.
15 August 2026
IdentityThe permission problem nobody solves before deploying agents
A shared API key isn't an identity. Why 'who is this agent, and what is it allowed to do?' has to be answered before the first workflow goes live.
12 August 2026
AuditWhat happens when someone asks "why did the agent do that?"
If you can't answer that question in one query, you don't have an audit trail — you have log files. The difference matters the first time it's tested.
9 August 2026