Insights · 16 September 2026
Security is what we settle first
Most AI projects stall at the security review. We answer its questions in the first conversation, because by then the answers are cheap.
Every AI project reaches a point where someone from security asks four questions. What reaches the model? What can the system do on its own? Who approves the actions that commit the organisation? What evidence remains afterwards? Usually the questions arrive at the end, when the architecture is already fixed, and the answers mean rebuilding.
We ask them before we design anything. It is not a matter of principle so much as economics: the same answers cost a conversation at the start and a redesign at the end.
Autonomy is the value and the exposure
Software that acts inside your systems is exactly why AI in operations is worth doing. It is also what makes it dangerous. You cannot keep one and remove the other. What you can decide is how far the system's authority reaches and who checks it.
So the useful question is never whether to grant access. It is which operations, on which systems and records, within which limits. An agent that can read what it needs but also write, delete and send has a surface far larger than its purpose.
Four decisions we make the same way every time
Least authority by default: each action names its system, its records and its limits, never a broad integration account.
A person owns consequential decisions: anything that commits money or changes customer records is proposed with its evidence and released by someone accountable.
Evidence for every action: what the system read, what it proposed, who approved it and what changed is recorded as part of the work, so an audit is a retrieval rather than an investigation.
Requirements before architecture: data classification, residency, retention and oversight are settled with your teams before the design exists.
What this means for a first conversation
Bring the workflow you have in mind, the data it touches and the questionnaire your security team sends every vendor. We would rather work through it now than at the end. If a requirement is one we cannot meet, we say so during scoping, which is the cheapest possible moment to find out.