Our engineers write these after the work, while it's still fresh. What broke and what we changed, and what we'd do again. You'll get through one in under ten minutes. Terms are explained as you go, and three questions at the end check what stuck.
the ideaEvery access decision is a claim, and it needs evidence you can show.
Read the track in order, as each note leans on the last one. We save your progress in this browser, so you can come back and carry on.
Start with sign-in policy, finish with the agents now asking for access.
What to ask a partner, and where the money actually goes.
Who runs the move, how many clouds, and how much freedom teams get.
Fresh numbers and retrieval that doesn't fall over.
Every takeaway from every note. Shuffle for a new set; click one to read the note it came from.
Give every agent its own identity and record the delegation. Then cap its authority at what the delegating user actually holds.
Security · Your AI agent is a privileged user. Treat it like one.Pay for named people over a logo, and lock the delivery staff and the substitution terms into the contract.
Security · How to choose an IAM implementation partnerSplit the work: pay for experience on the one-shot foundations, and grow your own people for anything you'll be running for years.
Cloud · In-house or consultancy? An honest framework for cloud migrationConnector work dominates and scales with difficulty, not count. Tier every application before comparing quotes.
Security · What a SailPoint implementation actually costsStart with identity governance. Get provisioning automated and auditable before anyone writes a single policy.
Security · Zero trust isn't a product. It's a proof obligation.Price every cross-cloud data path at twelve months of production volume before you commit to it.
Cloud · The multi-cloud tax, and how to stop paying itAssume retrieval fails silently. Hybrid search, reranking, structure-aware chunking and an index freshness SLO are where you start, before any polish.
AI and data · RAG in production: what actually breaksTranslate entitlements into business language before asking anyone to certify them. Bad data makes every attestation worthless.
Security · The access review nobody dreadsGive each decision its own freshness SLO and show the data's age right on the dashboard that serves it.
AI and data · Your dashboard is lying by twelve hoursKeep conditional access policies in version control and peer-review the changes. Incident questions then turn into plain git queries.
Security · Conditional access is a policy, not a prayerMeasure voluntary adoption. Mandated coverage tells you nothing about whether a platform works, because teams had no choice.
Engineering · Golden paths beat golden cagesIssue per-task credentials with short TTLs, behind a tool allow-list that denies by default. If an injection lands, that credential decides how far it gets. A prompt filter won't.
Security · Your AI agent is a privileged user. Treat it like one.Never accept an implementation quote before a fixed-scope discovery has sized connectors, data and roles.
Security · How to choose an IAM implementation partnerIn-house needs a dedicated team with an end date, and partners need contractual exit criteria. Each model fails without its guardrail.
Cloud · In-house or consultancy? An honest framework for cloud migrationDuring discovery, profile the authoritative-source data and see how mature the role model is. Low bids tend to hide their gaps right there.
Security · What a SailPoint implementation actually costsAdd signals one at a time. Run each in monitor mode before you enforce it, and keep a way back.
Security · Zero trust isn't a product. It's a proof obligation.Let data gravity set placement: one center of gravity, plus a short list of workloads that earn an exception, each with a written exit cost.
Cloud · The multi-cloud tax, and how to stop paying itBuild a golden-set eval harness before the second feature, score retrieval and generation separately, and gate merges on regression.
AI and data · RAG in production: what actually breaksLet policy auto-certify low-risk access that hasn't changed, and send just the ranked exceptions to humans. Those are SoD conflicts, dormancy and peer outliers.
Security · The access review nobody dreadsDo the semantic work: watermarks and late-data policy, replay-safe idempotent sinks, CDC with schema evolution and backfill planned from day one.
AI and data · Your dashboard is lying by twelve hoursLeave it in report-only for a full business cycle. Don't enforce until the projected impact matches what you intended.
Security · Conditional access is a policy, not a prayerMake the default path the fastest path. Teams should get CI/CD, observability and security already wired from one scaffold command.
Engineering · Golden paths beat golden cagesGate anything you can't undo on an out-of-band human approval. Log every action too, with the agent, who delegated, the tool and the outcome.
Security · Your AI agent is a privileged user. Treat it like one.Make the exit contractual. Get runbooks and paired delivery in writing, and a handover your team runs on day one.
Security · How to choose an IAM implementation partnerPair on everything. Knowledge travels in commits and runbooks your team has run, and documentation handoffs don't carry it.
Cloud · In-house or consultancy? An honest framework for cloud migrationKeep scope in check with risk-scored certifications and as few environments as you can live with, and settle the run model before signing.
Security · What a SailPoint implementation actually costsMake every control emit its own evidence, and audits become report generation.
Security · Zero trust isn't a product. It's a proof obligation.Put cost in the engineering loop. Each team sees its own unit economics and hears about anomalies within a day, and commitment coverage gets modeled per cloud.
Cloud · The multi-cloud tax, and how to stop paying itShip the plumbing. Make retrieval ACL-aware and cite at chunk level. When confidence is low, refuse honestly. Feed failures back into the golden set with telemetry.
AI and data · RAG in production: what actually breaksWire revocations to automatic deprovisioning with closure checks, so the campaign emits its own audit evidence.
Security · The access review nobody dreadsTier the pipeline. Streaming is for places where seconds matter and micro-batch for where minutes do. Everything else can be honest batch.
AI and data · Your dashboard is lying by twelve hoursEngineer the blast radius before the bad deploy. That means ring rollouts and alarmed break-glass exclusions, plus a rehearsed rollback.
Security · Conditional access is a policy, not a prayerDon't ban escape hatches; govern them. When a team documents a deviation and owns its operational cost, that's roadmap input.
Engineering · Golden paths beat golden cagesThe diagram on each card is the note's main point. Filter by topic, or search for a term you've run into.
the ideaThe model decides what it wants. The credential decides what it can do.
Service accountDelegationTTL 7 min 3 chapters 3-question checkthe ideaPick the partner whose named people have built your system before.
ShelfwareSISoW 8 min 3 chapters 3-question checkthe ideaBuy experience for one-shot work, and keep anything you will operate in-house.
Landing zoneWaveCutover 7 min 3 chapters 3-question checkthe ideaThe license is predictable. The cost that varies comes from your own estate.
ConnectorAuthoritative sourceRole engineering 8 min 3 chapters 3-question checkthe ideaEvery access decision is a claim, and it needs evidence you can show.
Zero trustConditional accessOrphaned accounts 6 min 3 chapters 3-question checkthe ideaRun each workload next to its data, and price every crossing between clouds.
EgressData gravityFinOps 8 min 3 chapters 3-question checkthe ideaWhat makes a RAG assistant dependable is everything around the model.
RAG (retrieval-augmented generation)ChunkingBM25 9 min 3 chapters 3-question checkthe ideaAuto-certify the boring access so reviewers only see ranked, explained risks.
EntitlementCertification campaignSegregation of duties (SoD) 5 min 3 chapters 3-question checkthe ideaA dashboard number is only as fresh as its last load, so show its age.
ETLFreshness SLOWatermark 7 min 3 chapters 3-question checkthe ideaChange access policies the way you'd ship code: report-only, then rings, rollback at hand.
Conditional accessPolicy-as-codeReport-only mode 6 min 3 chapters 3-question checkthe ideaA platform has proved itself when developers would still use it if it were optional.
Golden pathShadow platformsScaffold 6 min 3 chapters 3-question checkPick a track. Each one is a short reading order, and your progress is saved in this browser.
Identity security, from the ground upBefore you sign an identity contractCloud calls you'll have to makeData and AI that hold up in production see the tracksYou get the month's most useful field note, with its diagram and the three questions. One click unsubscribes you, and we never share your address.
A 30-minute working session with a senior engineer. No slides.