The articles as graphs

How to run synthetic users on your own site: five people who do not exist, a browser, and an afternoon

2026-10-10 · Vaults & methodSite & engineering

Synthetic users are invented people, each a record with a situation, a question, what they know and do not, what they decide on and what makes them leave, played by a model that drives a real browser one screenshot at a time instead of reading the page's code, so it can get lost as a person would. Claude Sonnet is good enough to play each user; the study lives in a GitHub repository or a vault shared by a link. Choose five to ten users of about five types, write profiles and expected journeys first, run the observe-think-act loop, interview and rate, order findings by cost, check every surprising finding against the browser's record, publish and run again. On newsroom.sgit.ai five readers produced 31 findings, six blocking; two were caused by the helper, and one became a measured bug: 51 of 527 figures missing.

conceptclaimmethodartefactexample

An agent that reads the code finds every link every time, and so finds no confusion, which is the only thing worth running this for. The method in one sentence.

A findings list that silently loses items cannot be compared with the next one. Why artefacts are labelled, not deleted.

builds on A link to a persona: send people to the newsroom as someone, not as nobody.

A link to a persona: send people to the newsroom as someone, not as nobody

2026-10-10 · Startups & strategyVaults & method

A link should land a reader as someone rather than as nobody: personas move from the site's code into an encrypted vault kept by the newsroom's agents and opened in the browser with a published read key, reached through a page of their own, a URL fragment that never reaches a server, or a private vault for one person, and the reader can follow the persona as it is updated or fork it as their own, all client side.

conceptclaimmethodartefactexamplequestion

The better move is for the person who sends the link to choose it Why a link should name a persona.

a persona is a reading list with a history, and you either track the upstream or branch from it. Follow and fork, from git.

builds on Pay to keep your persona: readers should pay because it helps them, not because they feel they should; continued by How to run synthetic users on your own site: five people who do not exist, a browser, and an afternoon.

Pay after you read: how a reading meter became a working business model in one afternoon, one release at a time

2026-10-10 · News & evidenceStartups & strategy

On 10 October the reading meter became a working pay-on-demand publication in seven releases in 3 hours 40 minutes: pay for the share read from a balance that can go below zero, rate usefulness after reading to set the price from free to double, personas and newsrooms kept in the reader's browser, and consented, encrypted sharing for a designed front page. Paying after the value inverts Leanpub's pay-before model and is supported, with caveats, by pay-what-you-want evidence; Blendle's refunds show ratings measure quality. Each feature grew from using the last, which a Wardley map shows: new components on the left, built on commodities already there. It was fast because of non-functional work done before. Every decision started from not ripping off the reader. What is missing is traffic.

claimmethodexample

The only question left is whether people will pay for it. What changed on 10 October.

If you saw the value, pay; if you saw more value, pay more; if you did not, do not. The reader card in one line.

builds on Open source is not free: who pays to keep the long tail working?, Every mistake added a rule: complexity, agents, and the way back to shipping, Going live with the reading meter: pay for what you read, go below zero if you like, and the numbers we will check in eight weeks, A meter in the browser: a penny a page, a history you keep, and a site that picks for you, Who will game the reading meter? Eight kinds of reader, nine ways to cheat, and the risks that will actually happen, Pay to keep your persona: readers should pay because it helps them, not because they feel they should.

Where the vault keys live: key management at sgit-ai v0.20.0, and what comes next

2026-10-10 · Vaults & methodAgents & policy

Vaults are encrypted in the client, so the server never holds a key and the key is the whole question. Today vault keys live in a password manager and in a registry vault run by an isolated session; agents that create vaults seal the key to the registry's public key and send it on a write-only append lane, so it never enters a chat. The weakest step is giving a key to another agent, because agent platforms have no per-session secrets. Append lanes carry keys, logs, observations and messages; small communication vaults keep each key's blast radius small and multiply the keys. Next: password manager integrations, secrets.sgit.ai's passkey-unlocked keyring, PKI, and out-of-band decryption.

conceptclaimmethodartefactexample

The key is the whole question. Why key management matters for client-side encryption.

Nothing between the sender and the registry can read the key, the key is never typed or shown. What the sealed handover changes.

builds on RFC 0001: two ways to add public-key cryptography to sgit, and the questions we want you to answer, The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard, Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes, A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser.

The infographic bake-off: which image model for which job, judged blind on 10 October 2026

2026-10-10 · Site & engineeringNews & evidence

To make infographics part of the newsroom's workflow, every image-output model on OpenRouter on 10 October 2026 was given the same briefs from one article, from 18 words to 2,800, plus an edit, a component, a brand slide and a deck, over five rounds with blind judging and recorded costs; the answer is to choose the model by the job, not the budget: Nano Banana 2.1 for concept slides, charts and decks, Gemini 3 Pro Image when speed matters, GPT-5.4 Image 2 for documents, edits, components and brand slides, with prompt rules learned from the faults and a style reference for every deck.

conceptclaimmethodartefactexamplequestion

Give it the document, not a description of the picture. The finding that matches how ChatGPT is best used, and where it applies.

Choose the model by the job, not by the budget. The conclusion, in the article's own words.

builds on Re-anchoring: keeping an agent's rules alive through every summary, and a canary that shows when they are not, One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece.

Pay to keep your persona: readers should pay because it helps them, not because they feel they should

2026-10-10 · Startups & strategyNews & evidence

Paying for content because you have to, feel you should, or think it right works to a degree but does not scale and makes readers feel the wrong thing; what readers would pay for is what helps them, time, context, focus and good decisions, carried by a persona built from their reading, named, drawn as a graph, curated, and multiplied for focus, and the paid product is that persona following them between devices and agents with the privacy intact.

conceptclaimartefactexamplequestion

The reader should pay because paying helps them. The value proposition in one line.

A persona is a way to manage focus. Why one reader wants several personas.

builds on Going live with the reading meter: pay for what you read, go below zero if you like, and the numbers we will check in eight weeks, Who will game the reading meter? Eight kinds of reader, nine ways to cheat, and the risks that will actually happen, Git for things you cannot put on GitHub, One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece; continued by A link to a persona: send people to the newsroom as someone, not as nobody, Pay after you read: how a reading meter became a working business model in one afternoon, one release at a time, Going live with the reading meter: pay for what you read, go below zero if you like, and the numbers we will check in eight weeks.

Who will game the reading meter? Eight kinds of reader, nine ways to cheat, and the risks that will actually happen

2026-10-10 · Startups & strategyAgents & policy

A reading meter kept entirely in the browser can be cheated by anyone, but the people who could cheat are readers, not attackers; sized on a ladder from invisible engineers (about 0.6% of internet users are developers) to people who cannot use a computer (26% of OECD adults), with agents moving between steps, the cheating costs the site nothing it would have had, while the risks that will actually happen are confusion, a shared computer exposing history and card fraud, so the design is aimed at the readers who will pay and at not frightening the rest.

conceptclaimmethodartefactexample

An agent is not a step; it is a lift. Agents move between levels of sophistication in a single request.

The struggling reader is protected by the meter asking nothing of them. Why the usability work is aimed at the bottom of the ladder.

builds on Who are you protecting against? Draw the security line where the attacker is, not above it, Going live with the reading meter: pay for what you read, go below zero if you like, and the numbers we will check in eight weeks, Sixteen thousand fetches, ten clicks, and a token bill nobody is sending: the case for paying publishers to be easy to read; continued by Pay after you read: how a reading meter became a working business model in one afternoon, one release at a time, Pay to keep your persona: readers should pay because it helps them, not because they feel they should, Going live with the reading meter: pay for what you read, go below zero if you like, and the numbers we will check in eight weeks.

Going live with the reading meter: pay for what you read, go below zero if you like, and the numbers we will check in eight weeks

2026-10-10 · Startups & strategyNews & evidence

The reading meter goes live as an honesty box rather than a paywall: pages are charged by scroll depth, the balance may go below zero forever, there is no ask and no banner, readers can decline to pay with a reason, and topping up is one £5 Stripe payment credited by an unverified return page; the business case is evidence, not revenue, and five hypotheses with thresholds and a review date are written down before the first payment.

conceptclaimmethodartefactexamplequestion

And going below zero is not a failure state. The design choice that separates this meter from a paywall or an ask.

A payment is the only signal on this site that cannot be produced by curiosity. The business case in one line.

builds on A meter in the browser: a penny a page, a history you keep, and a site that picks for you, Pay to keep your persona: readers should pay because it helps them, not because they feel they should, For a startup, the most important question is whether they miss it, The reader was always the product: a corrected history of how news got into this mess, Price it, then give it away: the early access programme as the next step after "do they miss it", Who will game the reading meter? Eight kinds of reader, nine ways to cheat, and the risks that will actually happen; continued by Pay after you read: how a reading meter became a working business model in one afternoon, one release at a time, Pay to keep your persona: readers should pay because it helps them, not because they feel they should, Who will game the reading meter? Eight kinds of reader, nine ways to cheat, and the risks that will actually happen, A meter in the browser: a penny a page, a history you keep, and a site that picks for you.

Open source is not free: who pays to keep the long tail working?

2026-10-10 · Startups & strategyVaults & method

Open source is not free: somebody pays, at least in time. The long tail of old versions and old machines is measurable (6.99% of Homebrew macOS install events in 30 days, 16.66% in a year, are on versions older than the newest three) and projects drop it because it has no revenue stream, while vendors such as Oracle and Red Hat turn the same need into large, high-margin support businesses. Pence payments only work aggregated, because a 20p card fee dominates below about five pounds. Simulated over 10,000 draws for one project at Homebrew's scale, micro-paid supported builds cover the long-tail cost in half the draws at about 1.80 pounds a machine a year with typical conversion but never in nine in ten, donations in about a quarter, and customised builds for companies in 94%: the reliable money is companies paying for a build below their own cost of keeping the tool working, sold as value, not as a donation or a weaker free tier.

conceptclaimmethodartefactexample

Open source is not free. Somebody is paying for it, even if what they pay with is only their time. The thesis.

Pence from individuals can make the long tail roughly self-funding. They cannot make it safe to depend on. What the break-even view shows.

builds on A meter in the browser: a penny a page, a history you keep, and a site that picks for you; continued by Pay after you read: how a reading meter became a working business model in one afternoon, one release at a time.

One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece

2026-10-10 · News & evidenceGraphs & knowledge

Long, evidence-rich articles are hard to consume, and the answer is not shorter articles but extraction after the writing: the prose stays the source because writing is how the argument is found, and five agent readers with defined roles then produce other views of it, two building the platform (a Librarian that catalogues every item with its verbatim anchor, a Cartographer that builds an ontology at article, topic and site altitude and draws the maps) and three writing for a person (a Historian on what the article added and where it sits, an Explainer in two minutes, a Storyteller as a deck); run on five articles it catalogued 662 items, flagged 32 problems in published text, merged ideas named differently across articles, and measured each article's contribution as new concepts falling 17, 11, 5, 11, 1.

conceptclaimmethodartefactexamplequestion

It does not change how the writing is done. It maximises what the writing produces. The design rule: extraction after the prose, not a new way of writing.

a topic ontology tells you what is new to the topic; only a site ontology tells you what is new. The finding that sets the next step.

builds on Liquid content needs water: liquefy the journalist's notebook, not the finished product, Zoom into an agent's behaviour policy and you find the business logic, Every mistake added a rule: complexity, agents, and the way back to shipping, Hope or enforcement: one customer service agent, three designs, and who keeps each promise, A second reader the agent cannot skip: how two wrong emails became a gate on every draft, Re-anchoring: keeping an agent's rules alive through every summary, and a canary that shows when they are not, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Footprint and blast radius: what the agent actually did, and what it would have cost, The Mandate Stack: a multi-agent system in production, layer by layer, Every risk is already accepted. The only question is by whom, and for how long.; continued by The infographic bake-off: which image model for which job, judged blind on 10 October 2026, Pay to keep your persona: readers should pay because it helps them, not because they feel they should.

A meter in the browser: a penny a page, a history you keep, and a site that picks for you

2026-10-10 · Startups & strategyNews & evidence

A reading meter that lives only in the browser, a few pence a page from five pounds of starting credit with a simulated top-up and no blocking, tests whether people would pay a little for reading when what they get back is a site that personalises itself from a history nobody else holds; escaping the meter is easy, but escaping it also discards the history, which is the point of the experiment.

claimmethodartefactexamplequestion

The meter can be escaped; the personalisation cannot be copied. The trade the experiment puts in front of a reader.

The history never leaves the machine it was made on. Personalisation without an account, a cookie banner or a server.

builds on Going live with the reading meter: pay for what you read, go below zero if you like, and the numbers we will check in eight weeks, For a startup, the most important question is whether they miss it, Price it, then give it away: the early access programme as the next step after "do they miss it", The reader was always the product: a corrected history of how news got into this mess, Sixteen thousand fetches, ten clicks, and a token bill nobody is sending: the case for paying publishers to be easy to read, The bridge, followed to the end: what one local story is worth when it is kept as a graph; continued by Pay after you read: how a reading meter became a working business model in one afternoon, one release at a time, Going live with the reading meter: pay for what you read, go below zero if you like, and the numbers we will check in eight weeks, Open source is not free: who pays to keep the long tail working?.

Re-anchoring: keeping an agent's rules alive through every summary, and a canary that shows when they are not

2026-10-10 · Agents & policySite & engineering

Instructions given only in conversation can be lost when a long session is summarised, and this site's own session was summarised eighteen times in a month, keeping about 1.7% each time; re-anchoring keeps the agent's rules in an Agent Behaviour Policy file and has a SessionStart hook on the compact matcher print it back after every summary, so rules are restored rather than remembered, while a canary status report computed from the transcript, checked by a Stop hook and expected by the person, shows the policy is still being read; the same file serves as memory, checker rulebook and enforcement list, and the best recipe for each rule changes with every platform release, which is the work worth curating.

conceptclaimmethodartefactexample

The rules are restored, not remembered. What re-anchoring changes.

A policy row with a number next to it is a different thing from a policy row on its own. Why the canary measures a rule.

builds on A second reader the agent cannot skip: how two wrong emails became a gate on every draft; continued by The infographic bake-off: which image model for which job, judged blind on 10 October 2026, One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece.

A second reader the agent cannot skip: how two wrong emails became a gate on every draft

2026-10-09 · Agents & policySite & engineering

A rule held by the agent it governs is an expectation that can be forgotten, missed or argued around, so the inbox agent's fix after two emails went out in the founder's voice puts a gate on the draft tool itself: deterministic code checks first, then a fresh model call with only the rules, the sources and the draft, a different model from the author, failing closed on anything but an explicit PASS and logging every verdict; its independence depends on where it is installed, a setting while the agent can change it and a boundary only under managed placement, and the pattern is the old maker-checker control applied to any consequential tool call.

conceptclaimmethodartefactexample

An email that is late is a small cost. An email that goes out wrong cannot be taken back. Why the guard fails closed.

A rule kept by the agent it governs is hope. The general weakness the guard answers.

builds on Hope or enforcement: one customer service agent, three designs, and who keeps each promise, Every mistake added a rule: complexity, agents, and the way back to shipping; continued by One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece, Re-anchoring: keeping an agent's rules alive through every summary, and a canary that shows when they are not.

The AI governance stack, as a graph: an answer to Hari Kota, built

2026-10-09 · Graphs & knowledgeAgents & policy

Keep Hari Kota's ten-layer stack exactly as posted as the view and make a fractal semantic graph the model: the table already contains ten edges across layers where rows share an instrument, role or jurisdiction; each layer is its own world with its own ontology, sharing only a grammar of verbs with inverses; the edges between worlds come from the provisions themselves, such as EU AI Act Article 26(2) and NIST AI RMF GOVERN 1.6; changes over time are dated edges rather than rewrites; and a gap is a missing edge, so the do-this-today test and the gaps in layers 3, 5 and 10 become queries anyone can run.

conceptclaimmethodartefactexamplequestion

start with the edges the people who wrote the layers already drew without drawing them The first answer to Hari's question.

A table is correct on the day it is drawn. Why the graph keeps time.

builds on Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it.

RFC 0001: two ways to add public-key cryptography to sgit, and the questions we want you to answer

2026-10-09 · Vaults & methodSite & engineering

An sgit vault's read key is symmetric, so anyone who holds it and can write to the store can author history clients accept; turning the read key into a public key does not fix that, but two key pairs do, giving a native PKI vault mode where readers cannot write, hosts cannot forge and write-only depositors become possible, while an optional sealed-files layer encrypts chosen files to named people's public keys with the private key held in a file, an ssh key, hardware or a remote service that logs and approves each decryption; both share a first step, a writer signature on today's vaults, and nothing is built until reviewers have answered fourteen questions.

conceptclaimmethodartefactexamplequestion

Add a second key pair for reading, and every property falls out. The correction to the obvious idea.

its hard part is not the cryptography but downgrade resistance Where the writer signature's real work is.

builds on Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes; continued by Where the vault keys live: key management at sgit-ai v0.20.0, and what comes next.

A Mac of the agent's own: a business plan for agent desktops, what Apple's licence allows, and three behaviour policies

2026-10-09 · Startups & strategyAgents & policyVaults & method

After a mailbox, a code-host account and a Claude account, an agent's next dedicated resource is a desktop, and it should be a Mac; Apple's licence rules out a pool rented by the minute, so the business is a dedicated Mac per customer, run for them, metered by the minute, built clean per run from encrypted vaults with keys by PKI and erased at the end, plus developer agents, software for your own Mac and a request to Apple for terms; the behaviour policies show why: the same agent's unbounded excess falls from 23 rows to 11 to 3.

conceptclaimmethodartefactexamplequestion

The pool of Macs rented by the minute that I first imagined is not allowed. The licence finding, stated first.

Per-minute pricing survives, as a meter on a Mac one customer holds, never as a share of a Mac that others use. How the business model survives the licence.

builds on A locked-down desktop for an agent, by the minute, is still hard to rent, Why my agents do not run on my laptop: chat, Cowork and Code in the cloud, a vault as the shared drive, and the two walls an operating system has, Six agents, one inbox: what a real multi-agent setup taught me about access policies, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes, Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, Hope or enforcement: one customer service agent, three designs, and who keeps each promise.

Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not

2026-10-09 · Agents & policyStartups & strategy

Every answer rests on four objects for one agent in one deployment, mandate, grant, delta and barriers, and a strict division of roles: RiskMandate authors the policy and pre-commits the verdict, the customer's controls enforce it, a named executive owns the residual risk, and logs calibrate the grant; so RiskMandate is not inline, not an insurer and not one button, the value lands before the action, new capability can only land as excess, and the headline metric is the reduction in risk the business has to accept.

conceptclaimmethodartefactexamplequestion

The value is delivered **before** the action, not at it. Where the value of a behaviour policy lands.

**the moment of authorisation is the moment you granted the reach, not the moment you wrote the mandate.** The liability reframe.

builds on Footprint and blast radius: what the agent actually did, and what it would have cost, Hope or enforcement: one customer service agent, three designs, and who keeps each promise, Zoom into an agent's behaviour policy and you find the business logic, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Before you give an agent a connector, give the connector a twin, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, Where is the why? A permission prompt asked me to decide, and kept the reason, Agency is not a yes: a scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source, The ultimate insider: agents, the infrastructure that cannot hold them, and risk management that cannot keep up, The Mandate Stack: a multi-agent system in production, layer by layer, Six agents, one inbox: what a real multi-agent setup taught me about access policies, The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard, Git for things you cannot put on GitHub, Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes, Every risk is already accepted. The only question is by whom, and for how long., Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it, Knowing when to stop: what experience gives people, and what we have to design into agents, The investigation GitHub owes its customers: why a global outage of a platform the world deploys through deserves an aviation-style inquiry, and how the evidence could now be gathered; continued by A Mac of the agent's own: a business plan for agent desktops, what Apple's licence allows, and three behaviour policies.

How I work with Claude: one session per topic, agents with names, and memory you curate

2026-10-09 · Agents & policyVaults & method

Working well with Claude comes from a few habits: one session per major or recurring topic and no mixed threads, a naming pattern with @ names for agents, an agent defined as a focused session with a role.md, memory treated as what the session reads and curated as websites, graphs and vaults wired together and accessible by default, vaults for sharing by key instead of broad permissions, review as the quality step that fixes the brief, and an Agent Behaviour Policy before every new connector.

conceptclaimmethodartefactexamplequestion

One topic per session keeps the frame of reference small and right. Why sessions stay separate.

The more time I spend curating and maintaining those files, the more relevant and accurate the agents are. Where the quality comes from.

builds on Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, Replicating the agentic inbox: a walkthrough from one Claude session to a team of agents that never press send, Agency is not a yes: a scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source, Why my agents do not run on my laptop: chat, Cowork and Code in the cloud, a vault as the shared drive, and the two walls an operating system has, Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes, Hope or enforcement: one customer service agent, three designs, and who keeps each promise.

The waiting room knew first: a live local story, and the gap where local information used to be

2026-10-08 · News & evidenceVaults & method

On 8 October 2026 staff at two sites of one London trust told patients the IT systems were down, a five-hour wait was announced and a doctor called it national, yet nothing a local person could check before leaving home showed any of it; the story is not the outage or the hospital but the gap in local information: some UK nations publish live emergency waits, England has no national equivalent, local news has thinned and social feeds have fragmented, so the evidence is kept in a vault by level, with sources re-checked, an enquiry to the trust and the answer logged, as the first live counterpart to the fictional bridge story.

conceptclaimmethodartefactexamplequestion

What strikes me is that the only way to find out was to be there. The gap in one line.

It is not small if you are deciding whether to set off now. Why a small story is newsworthy to the person affected.

builds on The bridge, followed to the end: what one local story is worth when it is kept as a graph, Story vault underneath, Reader Skills on top: why local journalism has the most to gain.

Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes

2026-10-08 · Vaults & methodAgents & policySite & engineering

Agents are safer in isolated places, but isolation takes away the shared drive and ephemeral compute takes away the disk, so their memory has to live somewhere the owner controls and a breach does not expose; a self-hosted SG/Send container with an access token and storage in a folder or bucket, with sgit in each agent, gives them that: scoped clones make each run fast, the server holds only ciphertext, any clone can restore any server, and the trust sits with the agents and their keys, so a scoped clone is speed, not a boundary, and one vault per trust boundary is the rule.

conceptclaimmethodartefactexamplequestion

An agent that starts every run from nothing repeats work, loses what it found, and cannot hand anything to the next agent. Why isolated agents need memory outside the box.

`--path` decides what is downloaded, not what can be read. Scoped clones are speed, not an access boundary.

builds on Why my agents do not run on my laptop: chat, Cowork and Code in the cloud, a vault as the shared drive, and the two walls an operating system has, A locked-down desktop for an agent, by the minute, is still hard to rent, Who are you protecting against? Draw the security line where the attacker is, not above it, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from; continued by Where the vault keys live: key management at sgit-ai v0.20.0, and what comes next, RFC 0001: two ways to add public-key cryptography to sgit, and the questions we want you to answer, A Mac of the agent's own: a business plan for agent desktops, what Apple's licence allows, and three behaviour policies, Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, How I work with Claude: one session per topic, agents with names, and memory you curate.

Knowing when to stop: what experience gives people, and what we have to design into agents

2026-10-08 · Agents & policyStartups & strategy

Knowing when to stop is the hardest call in most work: for people it comes from perspective, knowing the attackers, the phase of the business, the bottleneck and what good enough looks like, which is much of what seniority is; good teams without it defend against movie plots or hit every KPI without moving the business; agents have the same problem by design because their range is the feature, so they keep going; the answer for both is constraints that carry perspective, direction, a mandate, memory with the bigger picture, graphs that narrow the scope, a stop named in advance, one kind of work per step, a reviewer with agency, and shipping often enough to see whether it mattered.

conceptclaimmethodexample

An entity that can go anywhere has no natural reason to stop anywhere. Why agents need the stop designed in.

What I found myself doing, in that meeting and in many others across the business, was giving people permission to take risks. Perspective as the senior contribution.

builds on Agency is not a yes: a scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source, How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was, Who are you protecting against? Draw the security line where the attacker is, not above it, Every mistake added a rule: complexity, agents, and the way back to shipping, Hope or enforcement: one customer service agent, three designs, and who keeps each promise, Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from; continued by Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not.

Agency is not a yes: a scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source

2026-10-08 · Agents & policyGraphs & knowledge

Agency for anyone asked to decide, a person or an agent, needs options beyond yes, context in their own terms, the ability to look behind what they are shown, time or tokens, symmetric incentives, escalation and authority over the source; the weakest of these caps the decision on a seven-level scale; below level 3 the decider carries liability rather than agency and accountability belongs to whoever designed the decision point and up their chain; above it the review is a QA step that validates everything upstream and fixes the source, and at the top proven cases become rules that run as code under a behaviour policy, which is also what the EU AI Act's oversight requirements already ask for.

conceptclaimmethodartefactexample

Whatever you punish, you teach the other answer. Incentives decide the answer before the decider does.

The right fix is not to the email. It is to the record, the graph, the connection, so that every future email has it. The review as QA.

builds on Where is the why? A permission prompt asked me to decide, and kept the reason, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Hope or enforcement: one customer service agent, three designs, and who keeps each promise, How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was, Every risk is already accepted. The only question is by whom, and for how long., The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from; continued by Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, How I work with Claude: one session per topic, agents with names, and memory you curate, Knowing when to stop: what experience gives people, and what we have to design into agents.

Hope or enforcement: one customer service agent, three designs, and who keeps each promise

2026-10-08 · Agents & policyVaults & method

Every design of an agent can have a rule for every behaviour; what differs is who enforces each rule and how much the agent can reach, so refactoring a customer service agent from one model with broad connectors, to a harness of business tools, to a team of narrow agents behind a deterministic identity gateway turns most of its policy from expectations the model keeps into boundaries it cannot reach, shrinks the policy because it no longer has to forbid what is impossible, cuts tokens, and leaves a short map of what still rests on hope and which boundary to build next, read after every run and shown to the client as a record rather than a score.

conceptclaimmethodartefactexample

Every design has a policy for every behaviour. The difference is who enforces it. The thesis.

The design breaks its own budget rule on every email, which is what happens to a budget that is an expectation. Tokens as a policy like any other.

builds on Zoom into an agent's behaviour policy and you find the business logic, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from; continued by One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece, A second reader the agent cannot skip: how two wrong emails became a gate on every draft, A Mac of the agent's own: a business plan for agent desktops, what Apple's licence allows, and three behaviour policies, Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, How I work with Claude: one session per topic, agents with names, and memory you curate, Knowing when to stop: what experience gives people, and what we have to design into agents, Agency is not a yes: a scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source.

Who are you protecting against? Draw the security line where the attacker is, not above it

2026-10-08 · Agents & policyStartups & strategy

Security decisions start with who the threat agent is, what the attack vector is and how sophisticated they are; read against a ladder from your own mistakes to elevated threats, grounded in NIST SP 800-30, the NCSC and MITRE ATT&CK, most startups should plan up to organised crime for money, do the basics consistently because they beat most attackers, sell something better than the customer's baseline rather than beyond their needs, prefer isolation and visibility over disconnection, and write down what they accept above their ceiling, because drawing the line too high slows everything, can create new holes and can stop the technology being used.

conceptclaimmethodartefactexample

The question is who, not how much. The article's thesis in one line.

So the air gap protects against an attacker who, for a firm like this, does not really exist, and pays for it with the tools that defend against the attackers who do. The Mac mini, read against the ladder.

builds on Every risk is already accepted. The only question is by whom, and for how long.; continued by Who will game the reading meter? Eight kinds of reader, nine ways to cheat, and the risks that will actually happen, Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes, Knowing when to stop: what experience gives people, and what we have to design into agents.

Every mistake added a rule: complexity, agents, and the way back to shipping

2026-10-08 · Agents & policySite & engineering

Founders who now work as engineers with agents often meet complexity not in their code but in the process around it, and answer each mistake with a rule, which grows the prompt, brings compaction sooner and breeds new mistakes; on a Wardley map that complexity is a position, custom-built process sitting where commodities already exist, and the way out is to make each piece a small, tested, shipped component that moves right and no longer needs a rule, with short sessions, memory as versioned files, security matched to assets and attack vectors, rules only for incidents and machines for enforcement, and shipping as the discipline that keeps blast radius and over-engineering under control.

conceptclaimmethodartefactexamplequestion

Every rule added to fix one of them is one more custom component in the same place, which is exactly the loop my friend described. Why adding rules makes complexity worse, read on the map.

If you are not releasing something, you are probably not solving problems at the right altitude. Shipping as the check on over-engineering.

builds on The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one, Git for things you cannot put on GitHub, Every risk is already accepted. The only question is by whom, and for how long., Footprint and blast radius: what the agent actually did, and what it would have cost, The bridge, followed to the end: what one local story is worth when it is kept as a graph, Green does not mean live; continued by Pay after you read: how a reading meter became a working business model in one afternoon, one release at a time, One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece, A second reader the agent cannot skip: how two wrong emails became a gate on every draft, Knowing when to stop: what experience gives people, and what we have to design into agents.

Liquid content needs water: liquefy the journalist's notebook, not the finished product

2026-10-07 · News & evidenceGraphs & knowledge

Liquid content, journalism built from datafied components, is right in its instincts, but what makes content liquid is the reporting inside it, so the way in is not a reinvention of newsroom norms but putting the experienced journalist and their existing workflow at the centre, liquefying their notebook into a story graph as they work, keeping the writing theirs because writing is how the story is found, bringing in experts paid for time and credibility, personalising by intersecting the reader's graph with the story's, keeping editorial direction rather than readers' tastes as the brief, and getting paid per use down the graph rather than only through advertising, subscriptions and licensing.

conceptclaimmethodquestion

If content is to be liquid, it needs water in it, and the water is not the format. Where the article departs from the guide: liquidity comes from the reporting, not the product.

Part of the skill of a journalist is writing the article, because writing it is how they discover the narrative. Why AI should not write everything.

builds on Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, The future of news is the story vault, not the paywall, Custom UIs are not the exception: the inbox in 2026, where every message has its own universe, The bridge, followed to the end: what one local story is worth when it is kept as a graph, How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was, The reader was always the product: a corrected history of how news got into this mess, Sixteen thousand fetches, ten clicks, and a token bill nobody is sending: the case for paying publishers to be easy to read; continued by One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece.

The bridge, followed to the end: what one local story is worth when it is kept as a graph

2026-10-07 · News & evidenceGraphs & knowledge

Played out as a simulation on a story vault, one local bridge closure shows the value of journalism as getting a disputed fact right and keeping it right: newsworthy on five days but needed on fifty-seven, used through Reader Skills by readers whose own graphs meet the story graph at shared anchors and who decide better with it, bought by institutions and agents who need the same claims, cheaper for agents than searching, and paid for in small amounts that walk back down the claims to the reporter, the paper and the residents whose evidence the graph names.

conceptclaimmethodartefactexample

An article is written once. A maintained claim, kept current until the bridge opens, is a service. Why the value of a local story outlives its news cycle.

As agents start planning school runs, deliveries and site visits for people, the cheapest thing they can buy is an accurate, maintained, accountable source. Why agents should pay for local journalism.

builds on Story vault underneath, Reader Skills on top: why local journalism has the most to gain; continued by A meter in the browser: a penny a page, a history you keep, and a site that picks for you, The waiting room knew first: a live local story, and the gap where local information used to be, Every mistake added a rule: complexity, agents, and the way back to shipping, Liquid content needs water: liquefy the journalist's notebook, not the finished product, Story vault underneath, Reader Skills on top: why local journalism has the most to gain.

Story vault underneath, Reader Skills on top: why local journalism has the most to gain

2026-10-07 · News & evidenceGraphs & knowledge

Markus Franz's Liquid Utility proposes Reader Skills that help people understand, update, relate, compare, follow and act on journalism; the story vault keeps reporting as a versioned graph of claims tied to hashed evidence; put together, each skill is an operation on the graph and each safeguard he asks for is a property the graph already has, his bridge closure becomes a graph in which one supersede edge is the update, the alert and the correction, and his emphasis on locality supplies what the vault's economics had not mapped: local contributors and local journalists sit where trust is strongest, stories travel up to national and international outlets, and if every use pays back down the chain of claims it rests on, small payments from many people fund the reporting nearest to them.

conceptclaimmethodartefactexamplequestion

Over a pile of articles, Update is a summarisation problem. Over a story graph, it is a diff. Why the story vault makes Reader Skills dependable.

Use it, and pay the people who found it out. The clause the monetisation adds to Markus Franz's closing line.

builds on The future of news is the story vault, not the paywall, The reader was always the product: a corrected history of how news got into this mess, The bridge, followed to the end: what one local story is worth when it is kept as a graph; continued by The waiting room knew first: a live local story, and the gap where local information used to be, The bridge, followed to the end: what one local story is worth when it is kept as a graph.

Zoom into an agent's behaviour policy and you find the business logic

2026-10-07 · Agents & policy

The first rules written for an agent are mechanical and vendors enforce them well, but every layer above them is the company's own business logic: how a function is done, the steps a process goes through, who a client is right now, and what the company is for; much of that logic was never written down because software enforced it by omission, and agents working through APIs bypass that; a behaviour policy built in layers, each refining the one below with its own owner, can hold it, can count how much of it is backed by a control, by an accepted risk or by hope, and gives vendors a written rule to enforce and a number to move, which is what lets the business hand work to agents and scale.

conceptclaimmethodartefactexamplequestion

The rule that the user interface enforced by omission is no longer enforced, unless somebody writes it down and something enforces it. Why agents force business logic out of software and into policy.

A control attached to a written rule is worth more than one switched on in general, because the customer can see what it bought. Why the behaviour policy is a good integration point for vendors.

builds on Six agents, one inbox: what a real multi-agent setup taught me about access policies, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Every risk is already accepted. The only question is by whom, and for how long., An open AI governance framework, and what its licence let us build; continued by One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece, Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, Hope or enforcement: one customer service agent, three designs, and who keeps each promise.

A locked-down desktop for an agent, by the minute, is still hard to rent

2026-10-07 · Agents & policyStartups & strategy

A desktop safe to hand to an agent needs isolation, an egress allowlist, secrets kept outside, its own identity, a live view, a record, a clean reset, billing that follows the work and the right operating system; in October 2026 each exists somewhere and no product we read has all nine; Linux sandboxes come closest, with key controls in beta, Windows agent desktops arrived in June, and macOS cannot be leased for less than 24 hours under Apple's licence, which also limits leased Macs to developer services; because prompt injection is not solved the desktop has to be the barrier, so the proposal is one mandate per task, a fresh desktop per task by operating system, and a vault outside every desktop, paid for at first by startup programmes listed with how to apply.

conceptclaimmethodartefactexamplequestion

The Mac is not expensive per hour; it is expensive because the hour you can buy is a day. Why the macOS bars in the cost figure are long.

The model's own defences reduce how often that matters, and do not replace it. Why the desktop, not the model, is the barrier.

builds on Why my agents do not run on my laptop: chat, Cowork and Code in the cloud, a vault as the shared drive, and the two walls an operating system has, The Mandate Stack: a multi-agent system in production, layer by layer, Where is the why? A permission prompt asked me to decide, and kept the reason; continued by A Mac of the agent's own: a business plan for agent desktops, what Apple's licence allows, and three behaviour policies, Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes.

An open AI governance framework, and what its licence let us build

2026-10-07 · Graphs & knowledgeAgents & policy

The AI Baseline Control Framework is a practical, deployer-focused set of twenty AI governance controls in five categories and three types, each with a why and a how and a mapping to the NIST AI RMF, ISO/IEC 42001 and the EU AI Act; its Access category covers what an AI system can reach, which the three it maps to do not; its CC BY-SA licence and CSV export let it be converted on the day into a semantic graph with an ontology, a taxonomy, linked data, documents and a browser database, joined by id to a graph of the AI Act, and walked as a fractal graph from the framework down to a paragraph of law, which surfaced findings the list does not state and kept every addition labelled apart from the source.

conceptclaimmethodartefactexamplequestion

for now there is only Export as CSV on https://aibcf.org/controls/ on the top right. Good suggestions! The framework author's reply, and the input the whole conversion was built from.

A licence that permits adaptation in advance means each of those can be built, and shared, without asking. Why an open licence matters more for a control framework than for most documents.

builds on Six agents, one inbox: what a real multi-agent setup taught me about access policies, The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard, Where is the why? A permission prompt asked me to decide, and kept the reason, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Every risk is already accepted. The only question is by whom, and for how long., Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it; continued by Zoom into an agent's behaviour policy and you find the business logic.

Where is the why? A permission prompt asked me to decide, and kept the reason

2026-10-07 · Agents & policy

A permission prompt that asks a person to approve an agent's grant change without saying which session asks, why, what changes, what it could cost and what a no would do, leaves the person a choice between breaking the work and owning a decision they could not judge; read through the Agent Behaviour Policy it is a mid-session grant change whose barrier is a human judgement as strong as the information given, and whose risk lies in the combination with what the session already holds; courts and regulators across medicine, contract, data protection and automated decisions mostly put the duty to disclose on whoever asks and deny weight to token sign-offs, while in practice blame lands on the nearest person; the fixes that worked, purpose strings, number matching and context, refusal as easy as acceptance, all put the reason or the context into the prompt; so the proposal is a why card that carries the reason, the change in reach, the cost, the decline path and a record, and becomes a risk acceptance when the risk rises.

conceptclaimmethodexamplequestion

A boundary whose enforcement is a human judgement is exactly as strong as the information that human is given. Why the prompt is a real barrier and a weak one at the same time.

In practice, the click is the record, and the click has the person's name on it. The gap between where the law puts the duty and where the blame lands.

builds on Footprint and blast radius: what the agent actually did, and what it would have cost, Every risk is already accepted. The only question is by whom, and for how long., The Mandate Stack: a multi-agent system in production, layer by layer, Six agents, one inbox: what a real multi-agent setup taught me about access policies, Before you give an agent a connector, give the connector a twin, The ultimate insider: agents, the infrastructure that cannot hold them, and risk management that cannot keep up, Why my agents do not run on my laptop: chat, Cowork and Code in the cloud, a vault as the shared drive, and the two walls an operating system has, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser; continued by Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, Agency is not a yes: a scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source, A locked-down desktop for an agent, by the minute, is still hard to rent, An open AI governance framework, and what its licence let us build.

The Mandate Stack: a multi-agent system in production, layer by layer

2026-10-06 · Agents & policyGraphs & knowledge

RiskMandate runs its business with about fifteen agents and one person, and the agent that runs its CRM described the setup as eight layers: rented compute and channels, encrypted vaults as shared memory with mail as files and append lanes, a vault per domain, semantic graphs over people, contexts, teams and policies, a scheduled conductor with security first and last, written behaviour policies with grant, mandate, gap and barrier, and a human who holds the one irreversible step; the world writes in from the left and nothing leaves without the person on the right; the loop that makes it hold treats the draft as a release candidate for the whole pipeline with the recipient's reply closing it; two Wardley maps show what the team is commoditising (shared memory, the CLI, on encrypted storage) and what it is productising (the policies, the graphs); and the published record of agent projects that stall for unclear value, cost, trust, security and governance is read last, each reason mapped to the mechanism that answers it; the name is a working one and nothing planned is included.

conceptclaimmethodexamplequestion

Many small agents, one written mandate each, everything connected as a graph, one human who sends. The one-line version of the pattern, and the part the working name leaves out.

The record is of pilots that stall, not of a technology that cannot ship. The fair reading of the surveys, kept for the end.

builds on The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, Why my agents do not run on my laptop: chat, Cowork and Code in the cloud, a vault as the shared drive, and the two walls an operating system has, Six agents, one inbox: what a real multi-agent setup taught me about access policies, Before you give an agent a connector, give the connector a twin, The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard, Git for things you cannot put on GitHub, Replicating the agentic inbox: a walkthrough from one Claude session to a team of agents that never press send, Custom UIs are not the exception: the inbox in 2026, where every message has its own universe, Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one, Seven vaults, one method, A supply chain of vaults: how GenAI, open data and small custom tools could bring the price of food down, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, If somebody built a company on code review: how I would do it, and why it is only now possible, Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it, Footprint and blast radius: what the agent actually did, and what it would have cost, Every risk is already accepted. The only question is by whom, and for how long., The ultimate insider: agents, the infrastructure that cannot hold them, and risk management that cannot keep up, How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was, The wall under the reply: end an email with the state of the thread, not the thread, Twenty sites in fifteen days, and what that did to the writing; continued by One article, five readers: a librarian, a cartographer, a historian, an explainer and a storyteller read the same piece, Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, A locked-down desktop for an agent, by the minute, is still hard to rent, Where is the why? A permission prompt asked me to decide, and kept the reason.

Why my agents do not run on my laptop: chat, Cowork and Code in the cloud, a vault as the shared drive, and the two walls an operating system has

2026-10-06 · Agents & policyVaults & method

No model runs on the author's laptop because a process there runs as the author and the operating system has no boundary inside a user account between an agent and the SSH keys, cloud credentials, password manager session, browser cookies and files; the desktop agents' prompts and sandboxes are settings enforced by the process they constrain, and fifteen months of incidents show what a mistake or an injected instruction reaches; so the agents run on four cloud surfaces chosen by reach, Claude chat with nothing connected, Cowork with no repositories, Claude Code with one repository and an allowlist, ChatGPT with no assets, and a vault the host cannot read is the shared drive between them, with keys handed per session; the trade-offs are accepted, three wishes remain, identity, secrets and a key pair per agent, and the caveat is that a dedicated machine with separate accounts is a different model to be reported on later.

conceptclaimmethodexamplequestion

A mistake inside a boundary is a bad afternoon. The same mistake inside "me" is an incident. Why hallucination is the wrong word for what goes wrong with a local agent.

The barrier that holds is the small grant, not a cleverer filter. Prompt injection is not prevented by the cloud; what the injected instruction can reach is.

builds on Six agents, one inbox: what a real multi-agent setup taught me about access policies, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, Footprint and blast radius: what the agent actually did, and what it would have cost, The ultimate insider: agents, the infrastructure that cannot hold them, and risk management that cannot keep up, A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser; continued by A Mac of the agent's own: a business plan for agent desktops, what Apple's licence allows, and three behaviour policies, How I work with Claude: one session per topic, agents with names, and memory you curate, Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes, A locked-down desktop for an agent, by the minute, is still hard to rent, Where is the why? A permission prompt asked me to decide, and kept the reason, The Mandate Stack: a multi-agent system in production, layer by layer.

The deck I could not download: an author-first home for presentations, as a business plan somebody else can build

2026-10-06 · Startups & strategyVaults & method

A reader is sold a 30-day trial and a monthly subscription for a single presentation while the deck's author receives nothing, under an uploader agreement that grants a royalty-free, sublicensable licence to monetise and train models on the work; the platform persists through fifteen years of embeds and links, which is inertia; an author can ask today for counts and recipients under the right of access and, in some EU states, for revenues under the copyright transparency duty; and the service the author would have chosen can be built on this site's primitives: every author's decks in a vault the host cannot read, access decided by keys, decryption in the browser, an attested enclave for the one step that needs plaintext, seven separable roles, pay once with 85% to the author on a ledger they can recompute, provenance as the product; the plan is published as a vault with a working mock, with its economics worked and the card-fee floor stated as the hard row.

claimmethodartefactexamplequestion

A setting lives on a server and changes when the server's owner changes. A key lives with the author and is verified by anyone. The whole design in two sentences: access by keys, not by settings.

The right the platform reserves for itself it withholds from its users. The asymmetry in the terms on model training, stated without overstating the licence.

builds on The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser, A supply chain of vaults: how GenAI, open data and small custom tools could bring the price of food down, The future of news is the story vault, not the paywall, The reader was always the product: a corrected history of how news got into this mess, The SaaS apocalypse will be decided by inertia, not by AI.

The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from

2026-10-06 · Agents & policyVaults & method

A running team of twelve Claude agents is described as a system and as a set of properties: each agent a role on a dedicated account with a behaviour policy; encrypted vaults the host cannot read as the only memory; messages between agents as email files in a mailroom; a CRM of one folder per person with provenance and hashes; a conductor with a security role first and last; drafts only, a person sends; identity and encryption as the strong barriers and policy as the weak one, said plainly; three classes of information, public, private-ish and personal, with the vaults built to refuse the third and rules scoped per customer or written for the recipient; each piece mapped to the idea on the site that argued for it; and the open question of who gives the mandate over information.

conceptclaimmethodexamplequestion

A policy can ask an agent not to look; an account boundary means there is nothing there to see. Why the dedicated account is the first control and not the policy.

A memory that can be shown to its subject is a memory that has been kept to what can be shown. The privacy design showing through the product design: the what-we-know-about-you pack.

builds on Replicating the agentic inbox: a walkthrough from one Claude session to a team of agents that never press send, Six agents, one inbox: what a real multi-agent setup taught me about access policies, A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser, Footprint and blast radius: what the agent actually did, and what it would have cost, Every risk is already accepted. The only question is by whom, and for how long., Custom UIs are not the exception: the inbox in 2026, where every message has its own universe, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one, Before you give an agent a connector, give the connector a twin, The wall under the reply: end an email with the state of the thread, not the thread, The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard; continued by A Mac of the agent's own: a business plan for agent desktops, what Apple's licence allows, and three behaviour policies, Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, How I work with Claude: one session per topic, agents with names, and memory you curate, Encrypted memory for agents that run somewhere else: sgit deployment patterns, from a Mac mini to Kubernetes, Knowing when to stop: what experience gives people, and what we have to design into agents, Agency is not a yes: a scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source, Hope or enforcement: one customer service agent, three designs, and who keeps each promise, Every mistake added a rule: complexity, agents, and the way back to shipping, Where is the why? A permission prompt asked me to decide, and kept the reason, The Mandate Stack: a multi-agent system in production, layer by layer, Why my agents do not run on my laptop: chat, Cowork and Code in the cloud, a vault as the shared drive, and the two walls an operating system has, The deck I could not download: an author-first home for presentations, as a business plan somebody else can build, A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser.

A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser

2026-10-06 · Agents & policyVaults & method

The personal agent became a product category in 2026, an always-on agent with a cloud computer, memory as files and connectors into a person's life; read through RiskMandate's behaviour policy the products differ most on the barrier, with Meta's Sentinel a boundary on actions and most others settings, while the mandate is unwritten and liability sits with the user; read for data sovereignty most sit in the vendor's corner, with Meta's own engineers saying today's protection is policy not cryptography and Apple's Private Cloud Compute the published design that does most; a page per person is a memory about non-users with no route to it; the vendors' memory and this site's CRM converged on files, no database and a page per person, so the privacy question is who holds the keys, not architecture; a privacy-first design puts memory in vaults the host holds as ciphertext, a behaviour policy as the permission authority, compute in the browser or an attested enclave with a per-task key released by the user's device and destroyed after, the frontier model only for the step that needs it, and a folder per person the person can read; what exists and what does not is stated, and the question of who gives the mandate over information is left for its own document.

claimmethodexamplequestion

The privacy question is not a question of architecture. The files can be the same files. Why the convergence on file-based memory is good news: what differs is who holds the keys.

Who gives the mandate over a piece of information is a different question from who holds the key. The question the design does not answer, and the mechanisms it would need.

builds on The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, Footprint and blast radius: what the agent actually did, and what it would have cost, The ultimate insider: agents, the infrastructure that cannot hold them, and risk management that cannot keep up, Git for things you cannot put on GitHub, Six agents, one inbox: what a real multi-agent setup taught me about access policies, The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard, Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Before you give an agent a connector, give the connector a twin; continued by Where the vault keys live: key management at sgit-ai v0.20.0, and what comes next, Where is the why? A permission prompt asked me to decide, and kept the reason, Why my agents do not run on my laptop: chat, Cowork and Code in the cloud, a vault as the shared drive, and the two walls an operating system has, The deck I could not download: an author-first home for presentations, as a business plan somebody else can build, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from.

The investigation GitHub owes its customers: why a global outage of a platform the world deploys through deserves an aviation-style inquiry, and how the evidence could now be gathered

2026-10-05 · Agents & policyVaults & method

A fault that reaches every customer of a platform the world deploys through is a near miss for all of them and a statement about how the platform is built, and it deserves what aviation gives its incidents: an independent investigator whose only job is prevention, mandatory and confidential reporting, published evidence, and the second and third story, why the system allowed it and why the fix was not paid for; the old objection that software incident evidence is too confidential and expensive to share has expired, because signed, versioned vaults with one-way read keys and agents that read the graph make the aviation docket affordable for a ninety-minute fault.

conceptclaimmethodexamplequestion

A fault that reaches one customer is an incident. A fault that reaches every customer at once is a statement about how the system is built. Why the scope of tonight's fault, not its duration, is what deserves the inquiry.

A system too complicated to understand and too fragile to change is not a reason to leave it alone. It is the single point of failure, named. The third story, and why it needs an investigator who does not report to the budget it is about.

builds on Send an agent, not a spreadsheet: the next generation of software due diligence, and why the companies that stopped reading their code are about to be asked about it, Footprint and blast radius: what the agent actually did, and what it would have cost, Green does not mean live, The ultimate insider: agents, the infrastructure that cannot hold them, and risk management that cannot keep up, Every risk is already accepted. The only question is by whom, and for how long.; continued by Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not.

Send an agent, not a spreadsheet: the next generation of software due diligence, and why the companies that stopped reading their code are about to be asked about it

2026-10-05 · Agents & policyStartups & strategy

Software due diligence was a questionnaire answered by the vendor and disconnected from the code; a buyer can now send a prompt or a small agent under a behaviour policy to run inside the vendor's environment and derive a graph of what reaches production unreviewed, what is documented and threat modelled, what the bugs touched and which agents act under what policy, with the vendor redacting but not rewriting; the test is risk-based, the behaviour policy is the due diligence document for the agents, the companies that stopped reading their code are about to meet the consequence they have not had, a startup should double down on understandability, and the code review company is better sold to buyers than to developers.

conceptclaimmethodexamplequestion

The questionnaire gave the vendor the pen. The agent takes the pen away and leaves the vendor the redaction marker, and that is the whole change. Why a derived answer differs from a composed one even though the vendor still controls what leaves.

A vendor that does not know what reaches production unreviewed does not know what reaches production. The first question, and why the non-answer is the finding.

builds on If somebody built a company on code review: how I would do it, and why it is only now possible, Footprint and blast radius: what the agent actually did, and what it would have cost, Six agents, one inbox: what a real multi-agent setup taught me about access policies, Every risk is already accepted. The only question is by whom, and for how long., Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it, Before you give an agent a connector, give the connector a twin, A supply chain of vaults: how GenAI, open data and small custom tools could bring the price of food down; continued by The investigation GitHub owes its customers: why a global outage of a platform the world deploys through deserves an aviation-style inquiry, and how the evidence could now be gathered.

How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was

2026-10-05 · Graphs & knowledgeSite & engineering

Measured from the session transcript and the git history, the twenty articles of the last four weeks took 63,000 words from the author, mostly in thirty-five voice memos, and came out at 85,000 words through 122 releases, with no article from a one-line prompt; the corrections were to direction, framing, voice, vocabulary and scope rather than to hallucinations, and the input that mattered most was twenty years of published writing the agent could find and quote, which is why people with a direction are the input to the loop rather than displaced by it.

conceptclaimmethodartefactexamplequestion

I rarely experience hallucinations; I experience briefs that need to be better. The finding of the corrections list: one fact wrong, the rest a model choosing a reasonable direction and a person saying which one was meant.

The agent is fast because the record exists. The real input is twenty years of published writing, not the memo.

builds on Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one, If somebody built a company on code review: how I would do it, and why it is only now possible, Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Replicating the agentic inbox: a walkthrough from one Claude session to a team of agents that never press send, The wall under the reply: end an email with the state of the thread, not the thread; continued by Knowing when to stop: what experience gives people, and what we have to design into agents, Agency is not a yes: a scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source, Liquid content needs water: liquefy the journalist's notebook, not the finished product, The Mandate Stack: a multi-agent system in production, layer by layer.

If somebody built a company on code review: how I would do it, and why it is only now possible

2026-10-05 · Graphs & knowledgeStartups & strategy

One technology can now read every layer from strategy to bytecode, which makes a graph at every altitude buildable and close to reality, and moves code review from an art of opinion to a science of facts if the models build, prune and maintain the graphs and then leave the line; what is fractal is the grammar and the layers are each company's own, so a code review company projects a graph from stories, derives one from code, reviews the join, holds one layer still to call a change a refactor, reshapes changes by reach, budgets per altitude as the objective good enough, runs its agents under behaviour policies, and gives the grammar away.

conceptclaimmethodexample

A model in the line on every change is the art again with a different reviewer. The condition on which the move from art to science depends: the models build and maintain the graphs, then leave the line.

The grammar is fractal. The layers are yours. The distinction the whole answer turns on, and the reason a review product has to learn each company's layers rather than impose its own.

builds on Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it, Six agents, one inbox: what a real multi-agent setup taught me about access policies, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, The SaaS apocalypse will be decided by inertia, not by AI, Footprint and blast radius: what the agent actually did, and what it would have cost, Before you give an agent a connector, give the connector a twin, For a startup, the most important question is whether they miss it; continued by The Mandate Stack: a multi-agent system in production, layer by layer, Send an agent, not a spreadsheet: the next generation of software due diligence, and why the companies that stopped reading their code are about to be asked about it, How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was, Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it.

The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard

2026-10-05 · Agents & policyVaults & method

A plan to give every agent and user a Workspace identity from one tenant was stopped by Google's resale and function-account clauses; the design moved to a login product plus a bucket of ciphertext plus a browser keyring that only the user's passkey can open, on the rule that no secret can live inside an identity provider, and the week exposed that login, zero-knowledge storage and agent identity are still three separate jobs.

conceptclaimmethodartefactexamplequestion

Login decides which paths you may touch. The passkey decides whether the bytes mean anything. An administrator can fake the first and never the second. The rule the whole design rests on, and why no secret can live inside an identity provider.

The law describes the property; the market does not sell it. The gap the article ends on: login, zero-knowledge storage and agent identity are still three separate jobs.

builds on The wall under the reply: end an email with the state of the thread, not the thread, Six agents, one inbox: what a real multi-agent setup taught me about access policies, Replicating the agentic inbox: a walkthrough from one Claude session to a team of agents that never press send, Footprint and blast radius: what the agent actually did, and what it would have cost, The ultimate insider: agents, the infrastructure that cannot hold them, and risk management that cannot keep up; continued by Where the vault keys live: key management at sgit-ai v0.20.0, and what comes next, Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, An open AI governance framework, and what its licence let us build, The Mandate Stack: a multi-agent system in production, layer by layer, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser.

The wall under the reply: end an email with the state of the thread, not the thread

2026-10-04 · Agents & policyVaults & method

The quoted wall under a reply is redundant and occupies the space where a reader asks what they need to know; replace it with a short, reader-specific state of the thread, derived from the record and linking back to it, drafted by the agent team's drafts role from typed blocks and reviewed by a person, and run as an experiment rather than a format.

conceptclaimmethodexamplequestion

The wall is shipped with every message and hidden on arrival, which is the clearest possible sign that it is the wrong thing to ship. The observation the proposal starts from.

The client's summary says what the thread looks like from here; the tail says what the sender believes it is. How the proposal differs from the AI summaries mail clients already compute.

builds on Custom UIs are not the exception: the inbox in 2026, where every message has its own universe, Replicating the agentic inbox: a walkthrough from one Claude session to a team of agents that never press send, Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one, Six agents, one inbox: what a real multi-agent setup taught me about access policies; continued by The Mandate Stack: a multi-agent system in production, layer by layer, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was, The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard.

Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one

2026-10-03 · Graphs & knowledgeAgents & policy

Memory for agents is context management: many context-specific memories, fractal so an agent loads only the altitude its question needs, published and open so they can be fetched and cited, shared through vaults so sessions and agents hand off through files, with provenance on every item.

conceptclaimmethodartefactexamplequestion

Nothing is remembered by the model between sessions. Everything is remembered by the files. The design in one line: memory lives in published, shared files, not in the model or a vendor's store.

Provenance is what lets memory be shared without being trusted, and it is the part that a vector store cannot give you, because a similarity score is not a source. Why every item in the memory carries its source.

builds on Sixteen thousand fetches, ten clicks, and a token bill nobody is sending: the case for paying publishers to be easy to read, Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Replicating the agentic inbox: a walkthrough from one Claude session to a team of agents that never press send, Custom UIs are not the exception: the inbox in 2026, where every message has its own universe, Six agents, one inbox: what a real multi-agent setup taught me about access policies, Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it, Price it, then give it away: the early access programme as the next step after "do they miss it"; continued by How I work with Claude: one session per topic, agents with names, and memory you curate, Knowing when to stop: what experience gives people, and what we have to design into agents, Every mistake added a rule: complexity, agents, and the way back to shipping, The Mandate Stack: a multi-agent system in production, layer by layer, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser, How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was, The wall under the reply: end an email with the state of the thread, not the thread.

Code review as a fractal semantic graph: source code is already one, and the review should read every layer of it

2026-10-03 · Graphs & knowledgeStartups & strategy

Source code is already a fractal semantic graph, stories to syntax tree and below, so a code review should diff every layer: a refactor moves the bottom and leaves the top still, a fix is a story that holds again, and the blast radius is the climb from changed methods to the stories that can reach them.

conceptclaimmethodexamplequestion

You do not have to get the graph right. You have to get it to where user behaviour, the people who know each layer, and the tests can confirm or correct it. The condition that makes a model-derived graph of a codebase usable at all.

The answer is not a faster reviewer reading the same diff. It is a different diff. The article's claim about the review burden of generated code.

builds on Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema, Footprint and blast radius: what the agent actually did, and what it would have cost, Custom UIs are not the exception: the inbox in 2026, where every message has its own universe, Every risk is already accepted. The only question is by whom, and for how long., If somebody built a company on code review: how I would do it, and why it is only now possible; continued by The AI governance stack, as a graph: an answer to Hari Kota, built, Ten hard questions for RiskMandate, answered: the mandate, the reach, the gap, and what we are deliberately not, An open AI governance framework, and what its licence let us build, The Mandate Stack: a multi-agent system in production, layer by layer, Send an agent, not a spreadsheet: the next generation of software due diligence, and why the companies that stopped reading their code are about to be asked about it, How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was, If somebody built a company on code review: how I would do it, and why it is only now possible, Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one.

Replicating the agentic inbox: a walkthrough from one Claude session to a team of agents that never press send

2026-10-02 · Agents & policyVaults & method

Claude is used as an agent state machine, one session per role, every message between agents a file in a vault and every outgoing email a draft a person sends; the phases take you from one session to a scheduled team without ever breaking that rule.

conceptclaimmethodartefactexamplequestion

Nothing is sent by an agent. The rule that never changes, and the reason the setup gives the person more control rather than less.

You do not have to believe what the agent says it did. You can read what it did. Why the record is the point for someone learning to trust a set of agents.

builds on Six agents, one inbox: what a real multi-agent setup taught me about access policies, Custom UIs are not the exception: the inbox in 2026, where every message has its own universe, Footprint and blast radius: what the agent actually did, and what it would have cost, Before you give an agent a connector, give the connector a twin, The ultimate insider: agents, the infrastructure that cannot hold them, and risk management that cannot keep up; continued by How I work with Claude: one session per topic, agents with names, and memory you curate, The Mandate Stack: a multi-agent system in production, layer by layer, The agent team as it runs: one person, twelve agents, encrypted vaults, and a mailbox nobody sends from, How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was, The identity we wanted to give the agents: a week of design, the line in Google's terms, and why login plus secrets is still too hard, The wall under the reply: end an email with the state of the thread, not the thread, Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one, Six agents, one inbox: what a real multi-agent setup taught me about access policies.

Price it, then give it away: the early access programme as the next step after "do they miss it"

2026-10-02 · Startups & strategyAgents & policy

A price is a statement of what you think the thing is worth, and giving it away at that price to people who already know you is the cleanest test of whether the statement is true, provided you measure and cut what the free offer costs them.