Insights
Scripting your agent chats: how I stopped copying text between my models
I became the clipboard between my coding agents, and my decisions got worse. A live demo of coderoom, the shell I built to script my agent chats, and three techniques other builders can reuse.
From Samples to Data Streams: Auditing Organisations That Change a Thousand Times a Day
Why do audit findings on segregation of duties keep coming back, even after teams fix them? The extended version of my Luxembourg talk, told through the story of one organisation.
Auditing Organisations That Change a Thousand Times a Day (Short Version)
Why a 50 item sample stops being enough when teams deploy a thousand times a day, and how data analytics helps audit see the whole picture.
Mob Programming for One
Agents can generate useful material faster than an engineer can absorb it. This post uses mob programming as a model for structuring engineer-writer-reviewer loops that preserve understanding, scrutiny, and engineering judgment.
Beyond the first submission: three governance failures that will break your DORA RoI in 2026
The 2025 Register of Information submission was a scramble for most organizations. In 2026, the biggest challenge many organizations still face is unresolved governance, driven by unclear ownership, disconnected procurement processes, and …
Why your DORA Register of Information looks complete but fails regulatory validation
The Register of Information often looks complete during internal preparation but fails regulatory validation. This happens because the reporting templates do not enforce the underlying data model. This post explains what regulators actually …
The DORA Register of Information is a Data Problem, Not a Compliance Problem
The Register of Information is creating confusion across the industry. But the difficulty is not DORA itself. The EBA published a structured information model with entities, relationships, and integrity constraints. It is delivered through …
ISO Standards at the Speed of Tech: A Thousand Audits a Day
Governance at the speed of tech: what changes when compliance evidence flows continuously instead of being collected by hand, and how that shifts strategic governance and risk based decision making.
Painless Compliance, and a Thousand Audits a Day
An audit is just a test plan we run once a year, by hand, with dozens of people. Treating audits like test plans and embedding compliance controls into engineering workflows.
Painless compliance, and a thousand audits a day. An engineering first approach
An audit is just a test plan we run once a year, by hand, with dozens of people. The same engineering principles that solved software testing can transform compliance. Instead of manual processes and yearly surprises, treat technology …
What If We Applied the Self-Driving Car Levels to Security?
Knowing that automation is the future is one thing. Understanding how to do it is another. This insight explores how applying the SAE autonomous vehicle framework to security helps to create a clear roadmap from reactive manual processes to …