Principles

What I believe about building AI responsibly.

On safety, control and governance. These are working beliefs, not settled ones. They come from putting agents in front of real data, real money and real users, and from the mistakes along the way.

Why this matters to me

Models are getting more capable faster than most organisations are learning to oversee them. The engineers who build the layer between a model and the real world decide much of how safe AI is in practice. I want to build that layer well.

  1. 01

    Safety is part of the product, not a tax on it.

    If the safe path is harder than the unsafe one, people take the unsafe one. The job is to make the responsible choice the default, so nobody has to choose it.

    In practice

    Guardrails ship inside the templates. A new app gets auth, logging and review on day one without asking.

  2. 02

    You can't oversee what you can't see.

    Oversight starts with observability. Before an agent gets more freedom, a person should be able to see what it did, why, and stop it mid-run.

    In practice

    Every agent action is traced to a live graph. Visibility shipped before any optimisation did.

  3. 03

    Autonomy should be earned, one step at a time.

    Start with the least privilege that does the job. Widen permissions only when reliability has been shown, not assumed, and keep the ability to narrow them again.

    In practice

    Platforms start read-only, run in rootless sandboxes, and only grow write access as users and checks prove it out.

  4. 04

    Agents act. People stay accountable.

    An agent can draft, propose and execute, but a named person owns the outcome. Irreversible actions need a human decision, and that decision should be informed, not a rubber stamp.

    In practice

    Approval gates on anything that deploys, sends or moves money, with the context needed to actually review it.

  5. 05

    Be honest about what the system can't do.

    Overclaiming is a safety problem: people trust what they're told works. Claims should come from evals and tests, and limits should be written down as clearly as features.

    In practice

    Agent output is validated against the spec and end-to-end tests before anyone calls it done.

  6. 06

    Good governance enables. It doesn't only block.

    When governance is just a list of no's, people route around it, and shadow IT is the result. Governance works when the approved path is also the easiest one.

    In practice

    Replaced emailed dashboards with a governed platform people preferred to use.

  7. 07

    The benefits should reach more people, safely.

    AI's upside shouldn't be limited to people who can write code. Widening access is worth doing, but only with guardrails strong enough that new builders can't hurt themselves or others.

    In practice

    Non-engineers build real apps inside a sandbox that handles security, hosting and data for them.

Open questions

What I haven't figured out.

Holding beliefs loosely means being clear about where they run out.

How do you evaluate an agent that runs for hours?

Unit tests check outputs. Long runs fail in the middle, quietly, in ways a final check misses.

Where should the human checkpoints go?

Too few and you lose control. Too many and people stop reading what they approve.

How much should agents shape their own guardrails?

Lesson stores make agents better over time. They can also teach them to work around the rules.

Think I've got one of these wrong? I'd like to hear it.

Email me Message me on LinkedIn