A working publication
Current evidence, an operating point of view, and a practical next step.
10 pieces
Or ask the library a questionWhat Woods, Böhme, Wolff, and Schwarcz found about how cyber insurance and breach attorneys shape incident response, and how I would plan the record a small registered adviser keeps after an incident.
A practical security approach to deploying OpenClaw using isolation, least privilege, credential separation, network controls, sandboxing, audit logging, and human approval.
OpenClaw points toward a much larger security challenge: identity, delegation, credentials, memory poisoning, agent-to-agent trust, and how we secure autonomous AI systems.
What OpenAI's Hugging Face incident report says happened, what it changes in the threat model for small high-trust firms, and the standard I now hold agents to for observation and containment.
What a non-human identity is according to NIST, OWASP, and CSA, what Microsoft Entra now does with AI agents, how other platforms treat workloads, and the controls I would put on every one.
A proposed response exercise for making decisions when the available evidence is incomplete.
How I would connect sharing to a purpose, a recipient, and a clear ending condition.
The questions I would ask about a vendor’s data access, business dependency, and exit path.
What a central identity change can establish about the end of application access, what it cannot, and how to verify that access ended where it was supposed to end.
How current threat evidence can inform a practical security program and leadership review.