Writing
Notes on the parts of a system that have to stay honest when nobody is checking.
Assume the model cooperates with the attacker
An AI agent runs shell commands that did not exist until a prompt asked for them. You cannot write a static policy for code that has not been written yet, so the containment has to hold even when the model is talked into helping.
The model doesn't get the last word
A language model writes the verdict in my prior-art CLI. It is structurally incapable of telling me the coast is clear when it is not, and that guarantee lives in the type system, not the prompt.
The index is the identity
Four streaming adapters in an LLM gateway had the same bug: the number saying which tool call a fragment belongs to came from the wrong place. Clients trust that number, so two calls became one and nothing errored.
The tests were the spec
A developer in Germany ported my prior-art CLI from Rust to Go in 23 hours, using its test suite as the specification. The port matched every verdict, and on the way it found five bugs I had shipped.