AI agents need budgets and boundaries, not just a prompt
An instruction is not an access control. How to separate agent budgets, permissions and acceptance evidence before a convincing demo becomes an operating service.
Tim Witter
Blog
Perspectives on AI agents, security and operations for the people who decide. Every article is derived from my own open-source projects.
The hidden cost of “the AI says it worked”
A persuasive success message is not a test result. What evidence release decisions need, and why skipped checks must remain distinct from checks that passed.
Documentation that knows when to ask for review
Fresh files do not prove an explanation is correct. How linked sources, structural indexes and traceable decisions can direct attention to the next useful review.
AI developer tools and the data boundary
An AI label says little about privacy. What matters is where diffs, conversation history and research queries travel, and which processing stays deliberately local.
Procurement questions for an AI-ready development platform
What to establish before buying an AI development platform: clear contracts, reliable sources, real compatibility evidence and ownership in operation.
AI-assisted security testing starts with authorization
How to govern AI-assisted security testing with explicit authorization, technically enforced scope and evidence from the environment actually in use.
Reproducible infrastructure: the overlooked precondition for AI agents
Why responsible agent operation needs infrastructure people can explain: rebuild systems, review changes, plan rollback and transfer operational knowledge.
Operational visibility without workplace surveillance
How local operational data and temporary remote sessions can help explain failures without turning the entire workstation into a permanent data source.