A working publication
Current evidence, an operating point of view, and a practical next step.
Showing 12 of 41 pieces
Or ask the library a questionWhat Brown, Gredil, and Kaplan found about private equity fund valuations reported during fundraising, and how I would design a small investment firm's reporting, its review of incoming marks, and its record around a raise.
Aloha is my spec-driven workflow for Claude Code: it keeps a project's plan in files and git, commits each task, and verifies every phase against its goal rather than its task list.
What Brynjolfsson, Li, and Raymond found when a software firm gave its support agents an AI assistant, and how I would decide who at a small investment firm gets one first and how to watch quality.
What Maxime Bonelli found about venture firms that adopted data technologies for screening, and how I would decide whether a small investment firm should let a model rank its pipeline.
What Csaszar, Ketkar, and Kim found when they compared language models with investors at generating and judging startup strategies, and how I would decide where a model belongs in a small investment firm's decision.
What Woods, Böhme, Wolff, and Schwarcz found about how cyber insurance and breach attorneys shape incident response, and how I would plan the record a small registered adviser keeps after an incident.
A practical security approach to deploying OpenClaw using isolation, least privilege, credential separation, network controls, sandboxing, audit logging, and human approval.
OpenClaw points toward a much larger security challenge: identity, delegation, credentials, memory poisoning, agent-to-agent trust, and how we secure autonomous AI systems.
What OpenAI's Hugging Face incident report says happened, what it changes in the threat model for small high-trust firms, and the standard I now hold agents to for observation and containment.
Five theses on where a small firm's technology spend is going, from observability and model providers to identity and the investment-specific categories, each with the outcome being bought and the signal that would change my mind.
What a non-human identity is according to NIST, OWASP, and CSA, what Microsoft Entra now does with AI agents, how other platforms treat workloads, and the controls I would put on every one.
What Conti, Peukert, and Roche found about open-source engagement and early funding, and how I would turn it into a sourcing signal a small investment firm can define, test, and trust.
A proposal for defining resilience through failure scenarios, business continuity, and observed recovery.
How chip architecture, model progress, context, and human learning affect the useful work a firm can accept and sustain.
What the displacement and mental-health literature says, how people use AI day to day, and who decides what safe output is, framed as a duty of care an operator can act on.
A practical pilot with editable comparisons, evidence records, learning exercises, productivity measures, and recovery checks.
How I connect chips, models, context, and human understanding to five checks for accepting useful work.
How I would use AI coaching, practice, and observable progress to help people explain, adapt, and improve their work.
How I would decide which complexity to remove, which dependencies to preserve, and how to test the transition.
My reading of Bill Gates’s essay and the questions it raises for technology operations.
A proposal for a narrow extension with a clear job, visible failures, and an exit condition.
Comparing the capability a firm needs with the responsibility it can sustain.
The records, relationships, permissions, and workflows I would examine before accepting a migration.
A completion standard that follows an assistant’s action into the authoritative system.
Following information and authority through a connected assistant before granting access.
The task boundaries, evidence, and operating conditions I would test before expanding an AI workflow.
A lifecycle view of delivery, review, maintenance, support, handover, and retirement.
How faster implementation with AI changes the build-or-buy options, and what still needs to be measured: requirements, review, integration, security, support, and future change.
The responsibilities that would make me reconsider a familiar spreadsheet workflow.
How I would compare accepted work, review effort, rework, and changes in the tasks people attempt.
A proposed response exercise for making decisions when the available evidence is incomplete.
How I would connect sharing to a purpose, a recipient, and a clear ending condition.
A proposed test that connects a network transition to the work people need to continue.
The questions I would ask about a vendor’s data access, business dependency, and exit path.
How I would distinguish a completed restore from a usable recovered service.
What a central identity change can establish about the end of application access, what it cannot, and how to verify that access ended where it was supposed to end.
A proposal for making intended changes, observed results, and safe retries clear to another operator.
Which signals help a small team understand a problem and choose a useful response?
A case for understandable foundations and experiments that earn their operating cost.
How current threat evidence can inform a practical security program and leadership review.
How I would connect critical workflows to ownership, support, evidence, and recovery.