Softlander blog perspectives published in June 2026.
Adding every available scanner to continuous integration produces a slow pipeline and a culture of overrides. Choose gates by what they can decide reliably, and move the rest out of the blocking path.
A software bill of materials tells you what you ship. Controlling supply-chain risk needs three further things: provenance for the build, a policy for adoption, and a rehearsed route to replace a component quickly.
Design an AI workshop backwards from a named decision, then capture evidence, assumptions, disagreements, owners and triggers in an artefact that survives the meeting.
Product leaders need evaluation evidence that connects workflow outcomes, user experience and policy behaviour to a release choice—not a leaderboard score.
Agent systems change after release, so evidence must keep moving. Automation can collect and test signals; people remain responsible for judgement and action.
A useful agent threat model follows data, instructions, identity, tools and state across trust boundaries. This method turns the map into test cases and control decisions.
Give decision owners a balanced view of outcomes, quality, human work, cost, risk and change—with every measure tied to an action.
Choosing a well-regarded library settles very little. The decisions that determine whether cryptography protects anything are about where keys live, what a compromise reaches, and which threat you are actually addressing.
An agent becomes especially risky when it can read secrets, ingest attacker-controlled material and communicate or act outside the boundary. Design the workflow to break that combination.
A plan that lists algorithms and a target year is a statement of intent. A plan that survives review names sequenced workstreams, dependency owners, interim states and the decisions that are already overdue.
Finance agents can prepare, reconcile and investigate, but posting, paying and attesting require deliberately separated authority.
Attendance, speaking and sponsorship are evidence of activity; useful conference claims require separate measures of learning, relationships, follow-through and resulting decisions.
KEEP EXPLORING
Read the method, assumptions and questions to ask.