Topic
Security
Security treated as part of the plan, not a review that happens once and gets forgotten. These pieces cover where an access rule should live so a new feature cannot forget it, what a continuous security pass catches that a quarterly one does not, and what to check before trusting code — AI-written or otherwise — with real data.
Oct 9, 2026Start hereFor AI-coders
The informed way to code with AI inside a company
You may have been at this for a week or a year. Either way, code you ship with AI inside a company is judged on five things, and none of them is speed. Here is how to answer all five.
Oct 7, 2026NoteFor companiesDraft
Five companies that got AI wrong, with the receipts
Real companies, their own words, and the one decision each of them skipped. A coding agent that deleted production and its backups, an email bot that confirmed a typo, 45 jobs cut and reinstated, a chatbot a Canadian tribunal said was the company, and $31,150 in costs for invented case law.
Oct 7, 2026NoteFor companiesDraft
I nearly built an AI assistant that reports your staff to you
An AI chat for employers that tells management when someone pastes client data in or goes looking at things they shouldn't. I did the homework before building it. The big vendors already sell it, it watches the wrong place, and the reporting is the part lawyers push back on. What a small firm should want instead.
Oct 3, 2026PlaybookFor companies
Before you hire someone to build with AI
The questions to ask an AI-assisted developer or agency before work starts, what a good answer sounds like, and the red flags. About the people building your software, not the AI product you might buy.
Oct 3, 2026PlaybookFor companies
Before your staff build with AI
The fifteen-minute conversation to have before an employee builds something with an AI coding tool: nine questions for the manager, the matching line the builder checks first, and three tiers so saying yes stays cheap.
Sep 24, 2026NoteFor companies
Canada's privacy finding on ChatGPT isn't about your business. These rules are.
The May 2026 finding against OpenAI is about how OpenAI trained its models. The rules for a business whose staff use AI were published by the same regulators in 2023, and most small firms have never read them. What they say, in plain English, and how they fit on one page.
Sep 24, 2026NoteFor AI-coders
Your AI coding tool is part of your supply chain
The tool that writes your code also installs code: plugins, extensions, servers. In September 2026 a flaw in four major coding agents showed that a pinned plugin wasn't really pinned. What that means for anyone coding with AI inside a company, and four checks that cover it.
Sep 5, 2026NoteFor AI-coders
Why I put the authorization rule in the database, not the app
Multi-tenant ticketing with row-level security, and why "you can only see your own company's tickets" belongs below the application code.
Sep 5, 2026NoteFor companies
Seven questions to ask anyone selling you AI
The vendor has a demo. You need answers. Seven questions that separate an AI feature from an AI liability, and what a good answer sounds like.
Sep 5, 2026NoteFor AI-coders
A security pass that runs whether or not anyone remembers
Scheduled scans, nightly dependency matching, findings as tickets, fixes as reviewed pull requests. The shape of a security practice for a small team that ships with AI.
Sep 5, 2026NoteFor companies
The app is the visible part
Companies that build or buy an AI feature usually stop at the feature. Three invisible parts decide whether it is an asset or a liability, and none of them is optional.
Sep 5, 2026NoteFor companies
The employee who can now build apps
Someone in your company who is not an engineer has built something the business now relies on. It is an opportunity and the biggest new risk in most small firms. What to require before you rely on it.
Sep 5, 2026NoteFor both
Where the rule lives
"You can only see your own company's tickets" is one sentence. Where a team chooses to enforce it decides whether the next feature can forget it. A story about moving a rule below the code, told for people who will never write a database policy.
Sep 5, 2026PlaybookFor companies
An AI policy in one page
A template for the rules part of an AI plan, written to be followed rather than filed. Fill in the named tools and the named person and it is done.
Sep 5, 2026PlaybookFor AI-coders
A continuous security pass for small teams
Scheduled static scanning, database advisor sweeps, a bill of materials matched nightly against vulnerability data, findings routed into tickets with a draft fix. What it catches, what it does not, and the order to build it in.
Sep 5, 2026PlaybookFor both
The infrastructure around the app
A homework checklist for anyone building an application a business will rely on, and for the leader deciding whether to let them. The app is the easy part; this is everything else.
Sep 5, 2026PlaybookFor AI-coders
Reviewing code you did not write
The review pass I run on everything an AI coding tool produces: what to read first, the mistakes that show up most, tests as the contract, and how to keep context so the next session does not repeat the last.
Sep 5, 2026BuildFor AI-coders
A client portal where every client sees only their own work
A ticketing system with a client portal and tenant isolation enforced in the database itself.
Sep 5, 2026BuildFor AI-coders
A continuous security pass across a dozen live applications
Scheduled scans and sweeps that turn findings into tickets and fixes into reviewed pull requests.