Blog
Compliance, as it actually shows up in code.
Field notes on the ordinary pull requests that quietly break a control, and engineering on how we build a compliance reviewer worth trusting. Written for engineers, grounded in the exact clause, honest about where we are.
- Field notes
The one-line PR that quietly broke ISO 27001 A.8.15
Compliance does not fail in the audit. It fails in a five-line pull request that looked like a cleanup.
- Field notes
Your AI agent doesn't read your SOC 2 policy
Coding agents write code that compiles, passes tests, and quietly widens a control. The policy PDF is not in their context window.
- Engineering
False positives are the only metric that matters for a compliance bot
A reviewer that cries wolf gets muted, and a muted reviewer catches nothing. For a compliance tool, precision is the whole game.
- Field notes
The EU AI Act is a code review, whether you like it or not
For high-risk AI systems, the Act's obligations are not policy. They are properties of the running system, decided in a diff.