Articles
Agents need identities, not API keys An agent needs an identifiable actor, explicit authority and bounded credentials. Preserve the delegating person or organisational owner in the action record, and test scope, expiry and revocation before granting access. Carry access control through the retrieval system A well-sourced answer can still disclose information to someone without permission to see it. Carry entitlement through ingestion, retrieval, caching and revocation, and test access separately from answer quality. Review tool definitions as a supply-chain dependency Tool definitions are supplier-controlled inputs to an agent’s context. Review their provenance, permissions and changes as part of the software supply chain, and test whether untrusted text can influence an authorised action. Plan the embedding change as a migration Changing an embedding model can require a new index, a retrieval evaluation and a controlled cutover. Record the source versions, transformations and permissions needed to rebuild the service before committing to the switch. Include power availability in the architecture review Power availability can affect where AI capacity is offered, when it becomes available and what a workload costs. Include it in placement and capacity reviews, while keeping energy estimates separate from measured usage. Proof, attribution, and the work somebody else can check AI-assisted work needs verifiable claims, clear attribution and accountable reasoning. A declaration from mathematics provides a useful starting point for acceptance criteria in research and commissioned analysis. A smaller model on your own hardware is a governance decision Self-hosting can offer control over inference, but it also transfers operational responsibilities. Assess utilisation, serving security, evaluation and supplier evidence alongside the cost and residency case. Write down what would make you stop Agree the evidence that would pause, narrow or end an AI use before approving it. Name the measurement, threshold and accountable owner, then connect review findings to a deliberate operating decision. Give the pilot a measurable operating decision A pilot needs workflow and economic evidence as well as model output. Define the operating change, baseline and decision rule before interpreting adoption or benchmark scores as financial value. Your model retires before your system does A hosted model can retire while the business service still depends on it. Record version dependencies, assign notice ownership and evaluate replacement paths before accepting the supplier lifecycle risk. ISO/IEC 42001 is a management system, not a badge ISO/IEC 42001 asks an organisation to maintain an AI management system. Procurement assurance depends on that system continuing to operate as models, suppliers and use cases change, rather than on documents prepared for an audit. Build evaluation evidence before approving the system Fund and maintain evaluation evidence alongside the AI service. Representative cases, reviewed expectations and explicit access boundaries make supplier, model and workflow changes easier to assess.
Bring us the question
Something here already on your desk?
That is the conversation we are best at. Thirty minutes, a written summary, no obligation.