Topic
Data and access
Who can see what, and where that rule is enforced. These pieces are about moving an access rule below the application code — into the database itself — so a new screen or a new client cannot leak another client's data just by someone forgetting to add a check.
Oct 28, 2026NoteFor companiesDraft
Check the data before you sell the map
I pulled three public data portals for my own region into one AI-coding session to find products local businesses would pay for. Joining the data was the easy part. The checks afterwards killed two of the best-sounding ideas, moved a third, and showed that "nobody does this here" was wrong. The four checks to run before you build anything on someone else's data.
Oct 28, 2026NoteFor companiesDraft
The report that lists its own gaps
I built a property due-diligence report from public data: one address in, nine sections out, about forty queries in thirty seconds. I picked the test site blind, and it turned out to have a live application for more than 1,300 homes. The report held up. The most useful page was the list of eight things it couldn't answer. What that taught me about any report an AI tool helps you produce.
Oct 7, 2026NoteFor companiesDraft
I nearly built an AI assistant that reports your staff to you
An AI chat for employers that tells management when someone pastes client data in or goes looking at things they shouldn't. I did the homework before building it. The big vendors already sell it, it watches the wrong place, and the reporting is the part lawyers push back on. What a small firm should want instead.
Sep 24, 2026NoteFor companies
Canada's privacy finding on ChatGPT isn't about your business. These rules are.
The May 2026 finding against OpenAI is about how OpenAI trained its models. The rules for a business whose staff use AI were published by the same regulators in 2023, and most small firms have never read them. What they say, in plain English, and how they fit on one page.
Sep 5, 2026NoteFor AI-coders
Why I put the authorization rule in the database, not the app
Multi-tenant ticketing with row-level security, and why "you can only see your own company's tickets" belongs below the application code.
Sep 5, 2026NoteFor both
Where the rule lives
"You can only see your own company's tickets" is one sentence. Where a team chooses to enforce it decides whether the next feature can forget it. A story about moving a rule below the code, told for people who will never write a database policy.
Sep 5, 2026BuildFor AI-coders
A client portal where every client sees only their own work
A ticketing system with a client portal and tenant isolation enforced in the database itself.