The turbulent AI era is here. The choices we make now are critical.
A macro-level argument about AI transition risk, institutional readiness, and choices intended to keep benefits ahead of harms.
Primary material and provenance
Sources.
Primary material and source records used across this publication.
Source records describe and attribute primary material. Synthesis pages connect ideas, interpretation, and operating observation. They are related, but they are not the same thing.
Primary sources
Canaries in the Coal Mine? Six Facts about the Recent Employment Effects of Artificial Intelligence
2025 payroll-data analysis, updated August 2026, of early-career employment in AI-exposed occupations; descriptive, not causal.
GPTs are GPTs: An Early Look at the Labor Market Impact Potential of Large Language Models
2023 task-exposure estimate for the US workforce; measures which tasks a model could plausibly do, not job loss.
Modelling suicide and unemployment: a longitudinal analysis covering 63 countries, 2000–11
2015 country-level model associating unemployment with a 20 to 30 percent increased relative risk of suicide; association, not individual cause.
The State of Non-Human Identity Security
September 11, 2024 survey report commissioned by Astrix; online survey, June 2024, 818 IT and security respondents; self-reported, vendor-funded.
External references
Framework
AI Risk Management Framework
A voluntary framework for incorporating trustworthiness into the design, development, use, and evaluation of AI systems.
Profile
Generative Artificial Intelligence Profile
A companion profile focused on risks and risk-management actions specific to generative AI.
Standard
ISO/IEC 42001:2023
Requirements for establishing, implementing, maintaining, and continually improving an AI management system.
AI Act (Regulation (EU) 2024/1689)
Risk-based regulation in force since August 2024, with chatbot transparency duties and phased application through 2027 and 2028.
Digital Identity Guidelines (SP 800-63-4)
July 2025 revision; scope covers natural persons only and does not explicitly address machine-to-machine authentication or API access on behalf of subjects.
Zero Trust Architecture (SP 800-207)
August 2020; defines subjects to include non-human entities and names authentication of AI and software agents as an open issue with a lower bar than a human's.
SPIFFE concepts
Open standard for workload identity: SPIFFE IDs within a trust domain, SVIDs as X.509 or JWT proof, and SPIRE as the issuing implementation; the page prints no date.
OAuth 2.0 Token Exchange (RFC 8693)
January 2020 proposed standard distinguishing impersonation from delegation and defining the act claim that names the acting party.
Model Context Protocol: Authorization
Revision 2026-07-28; agent-to-tool access on the OAuth 2.1 draft with protected resource metadata (RFC 9728), resource indicators (RFC 8707), audience validation, and a prohibition on token passthrough.
Principles
OECD AI Principles
Principles for innovative and trustworthy AI that respects human rights and democratic values.
Model Spec
Published statement of intended model behavior, including the chain of command that resolves conflicting instructions and self-harm handling.
Claude's new constitution
January 2026 statement of the priority order (safety, ethics, guidelines, helpfulness) used to guide model outputs.
Guidance
Code Orange: Fail Small (completion report)
May 2026 engineering account of safer configuration changes, failure containment, and emergency access.
Strangler Fig pattern
June 2026 guidance on incremental migration, coexistence costs, and the limits of the pattern.
Why agentic AI needs a strong identity foundation
August 2026 discussion of agent authority, credentials, and the limits of repeated human approvals.
Security architecture of GitHub Agentic Workflows
March 2026 vendor architecture account covering isolation, staged writes, and logging.
Task Substitution and Uplift
May 2026 analysis of how changes in task selection complicate productivity measurement.
OpenAI Hugging Face Incident: Technical Report
2026 technical incident report on evaluation agents that reached the internet through an internal Artifactory instance and compromised Hugging Face production systems, with lessons for security, alignment, and monitoring.
About secret scanning
Documentation of repository alerts on detected credentials and partner notification for secrets found in public repositories.
AWSCompromisedKeyQuarantineV3
Managed policy AWS attaches when an IAM user's credentials are compromised or exposed publicly, denying costly and privilege-changing actions; edited March 2026.
Restrict IAM service account usage (key exposure response)
Organization policy constraint under which exposed service account keys are disabled by default since June 16, 2024, with audit logging and notification.
Risk detections, including leaked credentials for users and workload identities
Microsoft Entra ID Protection detections that match credentials found on GitHub, the dark web, paste sites, and breach dumps against valid tenant credentials, offline.
Introducing OpenTelemetry Blueprints
May 2026 initiative to help teams assemble understandable observability implementations.
Technology landscape (README)
Method, sources, schema, and exclusions for the vendor knowledge graph of 9 layers, 67 categories, 825 vendors, and 2,228 cited relations; CC0 data, generated September 21, 2026.
Wikidata
Free CC0 knowledge base queried through its SPARQL endpoint for the landscape's vendor identifiers, official websites, headquarters, founding years, business types, and parent relations.
CNCF Cloud Native Landscape
Interactive landscape of cloud native projects and products, used for category membership and open-source status of the map's infrastructure projects; data under Apache-2.0.
LF AI and Data Landscape
Interactive landscape of open-source AI and data projects, used for category membership and open-source status of the map's AI projects; data under Apache-2.0.
Market signals (SIGNALS.md)
Two years of open market signals beside the landscape map, September 2024 to September 22, 2026: capital from SEC Form D and announced rounds, GitHub stars, Hacker News stories, downloads, survey shares, events, and conference presence per quarter, category, and layer, with methods, limits, and an attribution line per dataset; the conference section records which exhibitor directories could be read and why the others could not; generated September 23, 2026.
Form D data sets
Quarterly structured data extracted from Form D, the notice of an exempt securities offering; public domain. The landscape signals read the 2024-Q3 to 2026-Q2 sets and count amounts as filed, from issuers that file in the United States only.
OSS Insight API
Public API over the GH Archive event stream, used for monthly stargazer and pull-request-creator histories per repository; its most recent months lag ingestion and are provisional.
Hacker News Search API
Free search API over the Hacker News index, used for per-quarter counts of stories whose title or text names a vendor; counts measure attention, including negative attention, and common-word names undercount.
DEF CON 33 vendors
Public list of the vendors on the DEF CON 33 floor, August 2025, read by the library's identified fetcher after robots.txt on September 23, 2026; 35 entries, none of them a landscape vendor. The village list for the same year sits beside it.
DEF CON 34 vendors
Public list of the vendors on the DEF CON 34 floor, August 2026, read the same way on September 23, 2026; 32 entries, none of them a landscape vendor. RSAC and Black Hat USA directories answered 403 to the identified fetcher and are recorded as not yet available in the library's signals summary.
Worker Displacement: 2023–2025
2026 release counting long-tenured displaced workers, reemployment by January 2026, and the share of reemployed full-time workers earning as much as before.
Changes in Suicide Rates in the United States From 2022 to 2023
2025 data brief on the 2023 age-adjusted US suicide rate from death-certificate data; the baseline behind the duty-of-care argument.
What is Microsoft Entra Agent ID?
Article date April 14, 2026: Agent ID as an identity framework for AI agents, available to all Entra customers, with security features for agents requiring Microsoft Agent 365; What's new (May 1, 2026) states general availability.
Administrative relationships: owners, sponsors, and managers
Article date April 16, 2026: at least one human sponsor is required for every agent identity and blueprint; owners are optional and technical; sponsorship transfers to the sponsor's manager when the sponsor leaves.
Conditional Access for agents in Microsoft Entra
Article date June 19, 2026: delegated flows evaluate the user, app-only flows the agent identity; agent assignments and agent risk labeled Preview in the how-to (June 2, 2026); an API key bypasses the Entra pipeline entirely.
Non-Human Identities Top 10
2025 list of ten risks to application identities and their secrets, from improper offboarding and secret leakage to long-lived secrets and human use of non-human identities.
Synthesis
What makes AI-generated work safe to accept?
A working synthesis connecting chips, models, context, and human understanding to checks for accepting useful work.