On Friday 12 June, Anthropic received a letter from the US government. Three days earlier Fable 5, their most capable model, had shipped. Now the government wanted it inaccessible to every foreign national on earth, including the ones sitting inside Anthropic’s own offices.

A nationality rule is simply absurd, and impossible to enforce. So Anthropic did the only thing open to them and switched off Fable 5 for the public and Mythos 5 internally. A restriction aimed at foreigners resulted in a global blackout, and the engineers who built the thing, a fair few of them foreign nationals themselves, were locked out of their own work by close of business.

The government pulled up the ladder. And if you live anywhere that isnt the US, it should have made one thing very plain - the most powerful tools of the coming decade can be taken away from you, at a stroke, by a government that was never yours.

American tech is the path of least resistance. Convenient, neatly packaged, integrated to within an inch of its life - the Ikea flatpack of the digital world, except someone in Washington keeps the allen key. And lately the political climate’s bolted a sting onto the tail, and it’s getting harder to swallow. The bloke who sold you the furniture can let himself in and walk off with the wardrobe, and theres bugger all you can do about it. No wonder Europe’s edging for the door.

“America innovates, Europe regulates, China imitates, Australia procrastinates.” It is a good line I have used myself. It flatters everyone who repeats it. It lets America cast itself as building the future, lets Europe feel principled, and lets the rest of us shrug and call inaction prudence. It’s wrong though.

The real divide isnt innovation against regulation. It’s sovereignty against dependence. Who controls the model, compute, data (a can of worms I daren’t get into) and the off switch, and who is renting all of them from someone else and praying the landlord stays friendly.

Let me be clear about one thing first. I am not here to wave the CCP flag. The treatment of their own people, the surveillance, Hong Kong, the Uyghurs - the list is long and grim. But I am not American either. From where I sit, the interesting question was never which superpower is the kinder custodian of frontier AI. It’s why on earth you would hand either of them the keys.

Here is the part the cliché cannot explain. China gives its best work away, for now at least. DeepSeek, Qwen, models now credible for local and offline coding work, and near-frontier models in their full form, free to download. America keeps its technological secrets locked up. Yes, Google open-sourced Gemma and Meta shipped Llama, so “the US ships nothing open” is too strong. But the frontier flagship stays shut, and now, as of June, can be switched off by decree.

Why? Because they were never built for you. They were built for America. Even when it required the world’s brightest minds. Much like the Manhattan Project, which was made and then the technology kept for America.

You might say shutting down Fable is spite, or Anthropic getting what its hype machine asked for. Back in February, Anthropic, the one that bangs on most about safety, refused two lines in a Pentagon contract. No fully autonomous weapons, and no mass surveillance of American citizens. For declining to let its model pick targets and watch civilians, the response was swift. Federal agencies were ordered to stop using Anthropic. The company was branded a “supply chain risk”, a label normally reserved for firms with direct ties to foreign adversaries, and the government dangled a Korean-War-era law to compel it. Hours later, OpenAI and the ever scrupulous Sam Altman signed the deal.

Put another way, the firm that asked for guardrails got branded a threat, and the firm that signed got a contract. Now, months later, the same government turned the rival’s flagship off globally.

American frontier AI answers to the American state first, and to the rest of us a long way second. If at all. Anyone selling neutral tools and a rising tide for all humanity is selling you ethical vapourware. And before you write this off as one administration’s nonsense, it’ll be true of the next lot too, just more insidious. Theres a reason the Five Eyes program (FVEY) works, and that the sticking point was “no mass surveillance of American citizens” and not “no mass surveillance”. The carve-out was never for you.

Heres where the rented tools stop being abstract. The system running America’s targeting in Iran is the Maven Smart System - built by Palantir on a roughly $1.3bn Pentagon contract - with Anthropic’s Claude embedded to rank targets by strategic importance and draft an automated legal justification for each strike. Yes, you heard me right. The model writes the paperwork that says the killing was legal.

In the first 24 hours of Operation <insert childish name here> it generated hundreds of strike coordinates. Over a thousand targets fell in a day, a tempo CENTCOM openly credits to AI. On day one a Tomahawk hit an elementary school in Minab. At least 168 people were killed, more than a hundred of them children under twelve. It wasnt a rogue algorithm. The school sat under 100 yards from an IRGC installation, and the failure was the targeting, not an AI malfunction. Which is worse, if anything. The machine worked exactly as designed.

This is the deployment Anthropic balked at. The rupture started when they began asking how Claude had been used in the January operation to capture Maduro in Venezuela. They asked a question about their own model, and got branded a threat to national security for the cheek of it.

To bring it home, because you dont have to be in Tehran for this to bite, picture your bank running fraud checks, your hospital triaging its lists, your states power grid balancing load - all on a model rented from an AWS, Microsoft, Google, hosted in your own country, metered by the token. Convenient. Right up until a letter lands.

Then what? Theres no graceful degradation. You dont fail over to a competitor, you fail back to 2019 - to the spreadsheet nobody maintains and the bloke who knew the manual process, who took redundancy in the first round of “AI transformation”. HAL with a P45. Im sorry Dave, Im afraid I cant do that - and also, Dave, you were let go in 3 months back.

This is the line item the rip-and-replace crowd never costs in. Every workflow you hand to a hosted frontier model is a dependency with a foreign off switch - and the switch isnt yours, isnt your governments, and answers to a politics you dont get a vote in. Resilience used to mean a generator in the basement. Now it means models on your own metal.

So whats the threat here? These are just selling tokens, aren’t they? Well, let’s check out America’s track record.

John Perkins wrote up the playbook in Confessions of an Economic Hitman. A foreign states compliance was never ensured through tanks first. It was loans a country could not repay, IMF conditions it could not refuse, and debt converted quietly into obedience. When the chequebook failed there were cruder tools (Iran in 53, Guatemala in 54, Chile in 73, Iraq in 03) but the elegant version was always financial. Make them dependent. Then make them grateful. Thats the threat tech dependence poses, especially AI. It’s a new tool in the same old arsenal.

You no longer need to bury a nation in dollars when you can host its data, its models and its workflows, and hold the keys to all three. And the keys are real, make no mistake. The US CLOUD Act lets American authorities compel an American company to hand over data it holds, wherever on earth that data physically sits. Jurisdiction follows corporate control, not data location. [1, 2] Your Microsoft and AWS data centres, your sovereign cloud, are sovereign right up until the US judges you inconvenient. No wonder Europe is pushing so hard to remove American tech from government.

Take DeepMind. About as British as a warm flat beer on a wet bank holiday, headquartered in London, and not remotely independent for all that. Google owns it, and Google’s compute is American down to the silicon. So one of the best AI labs on earth sits exactly as exposed as Anthropic did, one letter away from being throttled, repurposed or walled off from its own staff, and not a thing Westminster could do about it. The CLOUD Act doesnt care whats carved above the door. It follows the corporate parent home to California. Makes you wonder whether DeepMind, sat inside Europe rather than just off it, might have stood a better chance.

Enter Palantir. Seeded by In-Q-Tel, the CIA’s own venture arm, now wired into ICE deportations and sitting on a £330m contract to run the plumbing of the NHS. In Australia, it runs the data backbone of Coles - 840 stores, ten billion rows of supply chain, rostering and sales. Everyone panicked about the in-store cameras and missed the real point. It was never the cameras. It’s the ontology underneath the entire business, and once it’s in, you dont rip it out - it’s a years long project. Britain is already feeling the grip. In June a cross-party Commons committee told the government to terminate that contract, and MPs warned that leaning on Palantir makes it harder for the UK to ever publicly disagree with the US. Palantir’s response? It is suing the Mayor of London for blocking a separate police deal. Dependence is not to be refused.

And if data plus models sounds like a theoretical risk, take a glance at Cambridge Analytica. Robert Mercer funded it, funded the Brexit data operation, funded the 2016 Trump campaign - and Mercer was no bystander to the tech. He was an early AI researcher who helped pioneer the statistical language modelling today’s LLMs descend from. The man who weaponised data against democracies was a founding father of the maths now sitting in your pocket.

So what stops a superpower using insidious means to remove the inconvenient? Get between them and their money and you could find yourself quietly destabilised, eased out of office, in the background, by a hand you never see. The old playbook was debt. The new playbook could be, perhaps already is, tech dependence by design. Dare I call it compute colonialism? A bit rich coming from a British bloke living in Australia, granted. But I call it like I see it.

What baffles me is that America seems not to give a single toss how it’s seen, so long as it’s the biggest dog in the yard. There will be a long tail to that. Contempt compounds. You humiliate your allies at Davos, switch off their tools on a whim, and reach into a British hospital’s records because a US statute says you can - people bloody notice. Sentiment hardens into policy. Policy hardens into procurement rules. Europe is already drawing up plans to rip US tech out of government, more than 229,000 Britons have signed petitions to bin Palantir, and the same export stunt that pulled Fable spooked the very investors Anthropic needs for the IPO it just filed for. Branding your own crown jewels a national-security risk is a poor look on a prospectus. None of this lands tomorrow. It lands over a decade - in lost contracts, in allies quietly building their own, in a valuation that stops assuming the world’s custom is a birthright. America is busy winning the argument that nobody should ever depend on America again. Own goal of the bloody century.

Heres the irony that ought to be keeping a few San Fran boardrooms up at night. China isnt giving its models away out of the goodness of its heart, thats commoditise-your-complement, oldest trick in the book. Make the expensive thing free and you torch your rival’s margins on the way past. Android did it to iOS. DeepSeek and Qwen are doing it to OpenAI. Follow it to the end and it gets properly funny. A frightening slice of America’s economy is propped on the promise that AI is a licence to print money. Make the models free, open, and good enough to run yourself, and you dont just dent OpenAI - you knacker the whole “AI will pay for itself” story the US market is leaning its full weight on. China could erode the financial case for American AI without firing a shot, and take a chunk of Wall Street down with it. That last bit is a plausible risk rather than a forecast, so dont quote me a date. And for a CFO it isnt even ideology. A model you run yourself has no meter ticking, no per-token toll, no landlord who can change the locks. Funniest of all, that would make China, not OpenAI, the one actually delivering OpenAI’s founding promise - AI for all of humanity, not one nation’s balance sheet. Irony thick enough to stand a spoon in.

So what do you actually do about it, short of unplugging and fashioning a tin-foil hat? Start by killing the laziest part of the cliché. “Europe regulates” is meant as the insult. The continent that lawyered itself out of the race. Look again. Mistralis a roughly €20bn outfit shipping frontier and open-weight models, and it has turned European governance into the selling point. Data that stays in the EU, under EU law, for buyers who dont want Washington holding the keys. Regulation isnt the handbrake. Its becoming the product. Europe is even moving to loosen GDPR so its own labs can train harder, and the privacy hawks are furious, which tells you how seriously the sovereignty argument is now being taken.

Then theres “Australia procrastinates”, which stings because its accurate. And most infuriating of all, procrastination is a choice, and the choice it makes is dependence by default. We dont have to. Maincode in Melbourne is building Matilda on Australian infrastructure - and pointedly dropped the “sovereign” tag along the way, deciding it sounded too defensive. Make of that what you will. Tellingly, it still wont open-source the weights, not out of secrecy, but because it doesnt trust that anything it discloses wont be hoovered up by bigger players who operate on Australian shores unchecked. A small company guarding its IP is the whole national problem in miniature.

Heres the practical bit that matters. Theres a real difference between using the hosted DeepSeek app, which ships your data to servers in China, and downloading open weights to run on your own metal, where nothing leaves the building. One is a different landlord. The other is owning the house. Sovereignty isnt a flag - it’s where your data sleeps and who can switch it off.

If you handed me a magic wand, or just some clout and a spine, Id stop hedging and build the thing properly. Take the nations Carney was speaking to and drag them into an AI Manhattan Project. Pooled compute, frontier models, and (for once) a grown-up answer to where the data comes from and how the thing is governed. India, Europe, ASEAN minus China - thats well over two billion people and an economy in the same league as either hegemon. Not a fortress each behind its own little wall, but one shared stack with values baked in from the start. The talent’s there. The need’s there. Whats missing is the nerve.

And its not a fantasy. In January, at Davos of all places, Mark Carney told the room the old order had ruptured rather than shifted, and that on AI middle powers should band together with like-minded democracies rather than be forced to choose between, in his words, hegemons and hyper-scalers. Dwell on hyper-scalers for a second. A sitting G7 prime minister naming the cloud giants as a strategic threat, out loud, on that stage. He got a standing ovation. Washington’s reply, the next day, was to tell him Canada only survives because of the United States, and to threaten 100% tariffs, rather proving his point. As Carney put it, if youre not at the table, youre on the menu.

So the question was never whether you trust America more than China. Its simpler and harder than that. When the next letter lands at Anthropic’s door, or OpenAI’s, or more troubling still Googles, AWS’ or Microsoft’s - whose off switch is it, and will it be yours?

There are two kinds of centaur in Greek mythology. Chiron is wise, gentle. He taught medicine and tutored half the heroes of antiquity. Then there's the lot from the Centauromachy. Invited to a wedding, they got blind drunk and tried to carry off the bride. Same creature but wildly different outcome.

That's the choice in front of anyone building with AI right now.

In automation theory, a "centaur" is a human-led, machine-assisted arrangement - you use the machine to handle the boring, difficult bit. A "reverse centaur", a term coined by Cory Doctorow, is the opposite. An uncaring machine head directing a human body, the person reduced to a disposable assistant keeping pace with the algorithm.

It's our duty as consultants, builders, architects and innovators to ensure AI is used for good. The outcomes we strive to achieve should be in humans best interest. Human-centred design is more important than ever.

At the moment, a number of engineering teams are drowning in AI-generated pull requests. Functions repeated as the AI hadn’t seen a existing helper, vulnerabilities hallucinated, implementation patterns nobody asked for. DORA's research shows this clearly. AI now lifts throughput, but drags delivery stability down with it. Around 30% of developers don't trust the code the model gives them (2025 report). The time saved writing gets spent auditing - the verification tax. DORA even named the dip before the payoff as the J-curve.

This doesn't feel much like the AI utopia we dreamed of. Are we becoming fleshy prompt generators whose sole purpose is to keep the AI moving? Less empowered, more the hover-chair humans of WALL-E - reclined, pacified, waiting to be served the next thing.

"I want AI to do my laundry and dishes so I can do art and writing, not for AI to do my art and writing so I can do my laundry and dishes." - Joanna Maciejewska

It's a superb articulation of what most of us expect of technology. It should do the stuff we don't enjoy, so we can get on with the stuff we find meaningful.

We have a duty - as engineers and system designers - to bring about the world Joanna hoped for. Build centaurs. Humans with the steady power of AI backing us up. Not the alternative: a powerful AI backed by a human, hurriedly correcting, reviewing and bending to the whims of the technology they're meant to be in charge of. Do we want to be Neo when he's little more than a battery plugged into the Matrix, or Neo after the red pill, out and free to forge his own destiny?

The systems we build need to be centred around people. The right things, in a system that empowers us, not just a few billionaires. That means building empathetically - understanding the emotions, context and motivations of the people we build for, and iterating on constant feedback so we don't drift.

We get it wrong plenty. The gig economy is the textbook reverse-centaur. Dynamic routing and impossible quotas, humans held to targets completely detached from the physical world, with dynamic pay figures to punish missed metrics.

More concerning still, the British Medical Journal has witnessed the same. Doctors propped up beside AI systems they can't fully interrogate, there less to practise medicine than to take the blame when the model hallucinates. Dan Davies calls it the "accountability sink". The fleshy shield.

We don’t always stuff it up though. In Sweden, the MASAI trial put AI alongside radiologists rather than instead of them - 29% more cancers caught, reading workload nearly halved, the human keeping the final call.

I used an app, years back, called Be My Eyes. It’s been updated since the advent of AI to use a model to describe the world to blind and low-vision people, handing off to a human volunteer to describe the world the moment it's struggling. Tedious work to the machine, judgement and dignity left with humans. That's a centaur.

We run the risk of building for the enrichment of token farm owners, automating simply because we can and chasing metrics that seem important at the time. When building, it’s worth taking a pause to assess the impact.

I once argued that technologists should take a kind of Hippocratic oath; Hannah Fry argued much the same in the Guardian. It feels more necessary by the month, especially if the promise of AGI or ASI is to be realised. We treading a risky path, with nations pitted against each other. A manifesto for the individual, adopted broadly, could be a huge win for responsible AI adoption.

Cassandra, another figure from Greek myth, could see the future and warn of disaster, but was cursed so nobody would ever believe her. (Stephen Fry's Mythos is the gentlest way into greek myths, if you’re interested.) We need to listen to our modern Cassandra’s and stop dismissing them as fringe loonies the moment they get in the way of a product or feature we're sold on.

We ignored Timnit Gebru when she warned large language models were "stochastic parrots", confidently wrong, bias baked in, environmentally ruinous compute. Google showed her the door. We waved off Joy Buolamwini when she proved facial recognition couldn't reliably see darker faces. We’re clearly not great at this.

But we do listen, sometimes. We banned the CFCs eating the ozone layer, we bolted seatbelts into every car, and after Buolamwini vendors actually pulled facial recognition back. The trick is telling the real Cassandras from the nut bags before the fact, not after.

So be Theseus. When the drunken centaurs grabbed the bride at that wedding, he was the one who jumped in and helped drive them into exile. That's our job. Banish those drunken reverse-centaurs. Protect the room.

We're duty bound to ourselves to bring the right kind of AI into the world, and to manifest human-centred design in everything we build.

Build Chiron. Exile the drunks.

Until quite recently, “ontology” was a word with a very specific social function: it told you which people at the party to avoid. Philosophers used it. So did a particular breed of data architect: the kind who would corner you by the kitchen and explain, at length, the difference between a class and an instance.

That is about to change. To channel my inner Gen-Z and describe this in modern terms, ontologies are having a glow up. I’m banking you’re are going to start hearing the word all over the place - academia, infotainment influencers, your CEO’s LinkedIn. For once there is something substantive underneath it.

You have almost certainly watched an AI agent do this. It handles the first 80% of a task with something close to grace. It reads the ticket, drafts the reply, pulls the right data, and then stops dead on something trivial. It does not know whether “customer” in the CRM is the same thing as “account” in billing. It does not know who signs off a refund above a certain value. It does not know that the process it is halfway through has a compliance step it is about to skip. If you’re lucky, it does what a sensible junior would do… it escalates. It asks a human. If not, it’s going to be a longer afternoon than you planned.

We tend to explain this away as a context window problem, the model simply cannot hold enough. That is part of it, but it is the comfortable answer. The harder one: the agent has no model of your business. It does not know your processes, your rules, your systems, or how any of them connect. A human starter absorbs that over months of standups, Slack threads, and the slow osmosis of “how things actually work here.” An agent gets none of it. It turns up every single morning as the keenest, fastest new joiner you have ever hired, and also one with total amnesia.

Microsoft put this more bluntly than I would dare to in their own marketing. Describing the last decade of enterprise AI, the Fabric team’s framing is roughly this: collect more data, add more tools, and hope the model can reconstruct business meaning from inconsistent semantics scattered across systems. The result, in their words, is brittle integrations, conflicting definitions, and answers that are expensive to correct and hard to trust.

When the vendor selling you the AI is that candid about the failure mode, it is worth listening.

A word about words

Before going further, a word about words, because the vocabulary here is a genuine mess and you have probably been on the receiving end of it.

You will hear four terms used as if they are interchangeable: knowledge graph, semantic layer, semantic network, ontology. They are not. They sit on a spectrum, and knowing where each one sits is the difference between buying the right thing and buying a logo.

Start at the shallow end. A business glossary is just an agreed list of terms: what we mean by “active customer.” Add fixed definitions and you have a controlled vocabulary. Add hierarchy, where this category contains those subcategories, and you have a taxonomy. So far, so library. Dewey decimal system FTW!

An ontology goes further. It captures not just concepts and hierarchy but relationships and rules: the axioms that actually govern the business. A customer can hold many accounts. An account must have exactly one billing owner. A refund above £10,000 needs director approval. An ontology is, in effect, the schema of your business: a formal, machine-readable model of what exists and how it is allowed to relate.

A knowledge graph is that ontology with the real data poured in. The ontology is the empty model; the knowledge graph is the model populated with your actual customers, accounts and refunds, all wired together as a navigable graph. The ontology is the cutter; the knowledge graph is the tray of biscuits it stamps out.

Semantic network is the historical ancestor: a 1960s idea for representing knowledge as linked nodes. Worth knowing the lineage, not worth dwelling on. And semantic layer is the term to be most suspicious of. It is real, but it has been so thoroughly strip-mined by BI marketing that it now means little more than “a friendlier view of our data.” A semantic layer is usually a thin slice of what a full ontology does, pointed at dashboards.

For the rest of this piece, the word that matters is ontology. It is the precise one, and it is the one doing the work.

You already own most of it

Here is the slightly deflating part: most organisations already have the raw materials and do not know it.

Somewhere on a SharePoint site there is a business process model, a flow diagram with start and end points, swim lanes for each team, the sequence of steps and who performs them. Somewhere else there is a data schema with tables, columns, types and foreign keys, maybe a tidy bronze/silver/gold arrangement if the data team has been busy. And if you are fortunate, there is a glossary trying to keep everyone using the same words.

What is almost always missing is the connective tissue. Nothing says that the “Customer” box in the process model is the cust_id column in the warehouse is the term in the glossary is the entity the refund policy refers to. Each artefact is true on its own and mute about the others.

The ontology is that connective tissue, written down in a form a machine can follow. Bind it together with a few more artefacts (a domain model, a capability map, a service catalogue of which systems do what) and you have something genuinely new: an enterprise brain. Not a metaphor for “we have lots of data.” A literal, navigable model of the business that a person or an agent can reason over. Ask it which process generates this data, which rule constrains it, who owns it, which system it lives in, and what has to be true for it to be valid. And get an answer.

If that sounds like a lot of theory, here is a number. The data.world AI Lab benchmarked large language models answering real business questions over an enterprise database. Pointed straight at the SQL, the model scored about 16%. Given the same data modelled as a knowledge graph with an ontology, it scored 54%. With the ontology also used to check the model’s own queries, 72%. Same model, same questions. The only variable that moved was whether the business had been modelled.

But didn’t we try this?

At this point a certain kind of reader, usually the one who has been in the industry longest, is shaking their head. We have heard this before. This is the semantic web. And the semantic web failed.

Full disclosure before I go any further: I am not that reader. I did not come up through knowledge representation. I came to AI in 2022 like most people, via ChatGPT, and most of the history I am about to recite I learned the same way you might — by asking the machine and chasing the links it surfaced. If you want the W3C committee politics, you have the wrong author. There is something appropriate about that, though. The original semantic web was a project for specialists who had memorised this stuff for twenty-five years. The version that might finally land is the one a non-specialist can pull together with a tool that has read it all. Which is, more or less, the thesis.

So with that on the record:

They are not wrong. The vision of a machine-readable web of meaning has been around since Tim Berners-Lee, Ora Lassila and James Hendler set it out in 2001, built on standards like RDF that became a W3C recommendation back in 1999. Twenty-five years on, it has not arrived. The veteran semantic-web engineer Kurt Cagle wrote a widely-read piece titled, simply, Why the Semantic Web Has Failed. His diagnosis: semantics is hard to understand, invisible to most people, and does not fit how developers actually think.

And the ontologies that did get built had a nasty habit of rotting. Building one was a vast, specialist effort. Maintaining one was worse: so risky and expensive that, in practice, nobody did. The business changed, the ontology did not, and within a year it described a company that no longer existed. The honest version of this argument concedes the point up front. Ontologies have always been too hard to establish and very nearly impossible to keep current.

So why am I telling you this is different?

What changed

Because what changed is not that ontologies became more desirable. It is that the cost of building and maintaining one has collapsed, and maintenance was always the part that killed them.

An AI agent can read the things a human knowledge engineer used to read by hand, just faster and without getting bored. It can crawl your cloud accounts, inspect your Snowflake and Databricks, parse your Fivetran and Informatica pipelines, trawl Confluence and Slack, and draft a first-cut ontology from what it finds. It can interview your SMEs and fold in the transcripts. None of that is science fiction. It is a competent agent with the right access and a few weeks.

But the real shift is what happens after the ontology exists. The agent does not have to stop there. It can keep reading, keep interviewing. The events and logs your systems emit can, plausibly, be checked against the model and flag where reality and the ontology have drifted apart: a new system nobody documented, a process that quietly changed, a rule everyone stopped following. The ontology stops being a document that decays and becomes a living model that is continuously reconciled. The thing that killed every previous attempt is now the thing AI is best at.

One honest caveat. An AI that drafts your ontology can be confidently, fluently wrong, inventing a relationship that looks realistic and is not. The answer is not to trust it. It is to build the model so that it has to show its work. Which is easiest to explain by showing you one.

I built one: Monsters, Inc.

So I built one. As you likely deduced from the images thus far.

To keep it concrete, and because nothing kills an abstract argument faster than another abstract example, I did not model a real company. I modelled Monsters, Inc. The Pixar one. The factory that produces energy from the screams, and later the laughter, of human children, regulated by the CDA, powered by a network of ten million bedroom doors.

It is an open repository: sixteen modelling views, nine ontology files, the full set of open standards an enterprise brain actually needs. OWL for what exists and how it relates. SHACL for what must be true. SPARQL for the questions you can ask. PROV-O for where data came from and who touched it. DCAT for the catalogue of datasets, SKOS for the shared vocabulary, R2RML for mapping an existing SQL database in, ArchiMate for the capability and technology views. Not a toy. The shape of the real thing, on a cast everyone already knows.

Three things from it are worth your attention.

First, the brittle agent. Remember the agent that stalled because it did not know the rules? In the model, every process step carries a flag for whether an agent may run it alone or whether it is human-only. Physical work, comedy routines, certification exams, regulatory escalations: human-only. Before acting, an agent resolves the question against the graph: am I permitted, is this step automatable, does a human-in-the-loop trigger fire, and if so who do I escalate to and how fast? A 2319 contamination alert escalates to the CDA Director within thirty minutes, and that deadline is data in the graph, not a line buried in some runbook. The agent reasons over one source of truth instead of a hundred hard-coded assumptions.

Second, and this is the one I would put in front of a sceptical executive: authority does not beat the rules. The model includes a query that asks whether an employee may perform a given action on a given piece of data. Run it for exporting a child’s personal profile, and even James P. Sullivan (Sulley, the CEO) comes back denied. An explicit prohibition overrides authority entirely. No seniority, no clever prompt, gets the rule to dissolve.

One thing to be precise about. The ontology itself is not a runtime firewall — it is data. A rogue worker agent that ignored the graph and wrote straight to a file system could still try. The value is not that the ontology magically stops the breach. It is that the rule exists in one machine-readable place that a builder agent has to read. When that builder is generating the worker agent, or the tool layer the worker calls, it has a queryable list of constraints to bake into the code: a deny check at the data access layer, a refusal in the tool definition, a guard on the prompt. The rule moves out of a runbook nobody re-reads, or a bug you catch three months later, and into the build. So the honest version is not “the agent cannot route around it” but “no one who builds an agent against this graph has any defensible excuse for skipping it.”

To be clear, the ontology is informational only, its not a guardrail as such. Its a documented rule a “builder” agent would be able to understand, and when it builds your application or “worker“ agent, it has the knowledge to add that rule as a requirement, in code, not a run book or a bug you catch 3 months down the track.

Third, the model checks itself. It ships with three deliberate violations: a comedian assigned to the floor with a lapsed certification, a door overdue its safety maintenance, and a contamination incident reported seventy-five minutes after detection against a thirty-minute regulatory limit. Run the validator and it names all three. The ontology does not just describe the business; it continuously audits it. And it is honest about its own limits

The company constitution has seven principles, six of which are bound to a specific check that proves them. The seventh, “joy over fear,” the company’s entire cultural pivot, is deliberately flagged as not yet enforceable.

The model would rather admit what it cannot defend than fake it. That honesty is the answer to the hallucination problem: you do not ask the AI to be right, you build the model so that what it cannot prove is visible.

What this is really for

Step back and the point of all this is simple. An agent with a model of the business does not stall, because it can ask what the process is, what it is allowed to do, what must be true, and who it should tell. It acts autonomously and defensibly, every action traceable to a permission, an authority check, an escalation decision. That is the difference between an agent that does 80% of the job and one you would actually let run unattended.

It is also, underneath the buzzword, what “AI transformation” actually is. Not a moonshot. Pick a capability, model its data, rules, processes and people, build the agents that run it, then move to the next. The ontology, or more precisely the ontology-based business process model, is the workhorse under all of it.

And this is not a fringe bet. Microsoft has put an Ontology item at the centre of Fabric IQ, announced at Ignite 2025 and now in public preview, explicitly so that agents act on a governed model of the business with an audit trail rather than guessing. The repository I built was, in part, an attempt to show where that road leads. When Microsoft is building the same thing, the direction of travel is not really in question.

So here is the uncomfortable question to end on. The fragments are already in your organisation — the process models, the schema, the half-finished glossary — sitting in SharePoint, unloved, each one true and alone. The ontology is the thread that finally connects them, and for the first time you have something that can pull it through without a three-year programme and a room full of specialists.

The question is no longer whether you could afford to build and maintain one. It is whether you can afford to keep running agents that are flying blind without it.

Further reading

• The Monsters, Inc. enterprise model (open repository): github.com/gazzwi86/monsters-inc

• A Benchmark to Understand the Role of Knowledge Graphs on LLM Accuracy, data.world AI Lab (Sequeda et al.), arXiv:2311.07509

• Increasing the LLM Accuracy for Question Answering: Ontologies to the Rescue!, Allemang & Sequeda, arXiv:2405.11706

• What is Fabric IQ / Ontology (preview), Microsoft Learn: learn.microsoft.com/fabric/iq

• Why the Semantic Web Has Failed, Kurt Cagle

• Model-driven graphs using OWL in Amazon Neptune, AWS Database Blog

• The missing layer: Why semantic layers and knowledge graphs are essential for AI-ready data systems

I woke up today, a little hungover and grumpy, to the news that Anthropic had shipped Claude Opus 4.8. A model that in its own words, is “a modest but tangible improvement” on the last one. Refreshingly honest.

Weeks back they’d wheeled out a glossy microsite called Project Glasswing featuring Mythos: an unreleased model so good they daren’t hand it to the public yet. It’s supposedly found thousands of zero-days, including a 27-year-old hole in OpenBSD (an operating system whose entire personality is “we are secure”) and a 16-year-old bug in FFmpeg that automated testing missed million of times.

The Opus 4.8 mentions Mythos too. They say it’s coming to customers “in the coming weeks.”

WTF…

Is the “too dangerous to release” routine marketing bollocks. A tease. That was my first take. Mythos reading as a very on the nose reference to a mythical, vapourware nature. AGI cosplay to keep the hype train rolling and the IPO pricing souring.

If it isn’t, the self-appointed adult in the room has built a thing it calls dangerous, and is shipping anyway, first to eleven mates and the rest of us, all because the competition was breathing down its neck. Did commercial pressure win the argument? That’s not a safety strategy. That’s a safety collapse with a comms plan.

Either way, one claim doesn’t survive a moments thought. Glasswing has supposedly gone and secured the world. Over a few weeks. Meaningfully patched the web, the countless enterprises held together with duct tape since about 1998. The legacy systems nobody alive fully understands. Patching the planet in a fortnight is like repainting the Forth Bridge with a single tin of Dulux. The idea that a butterfly-branded consortium has quietly made cyberspace safe is exactly the bit you're meant to swallow without chewing.

The bug-finding itself is probably real, even if the salvation isn’t. Anthropic didn’t just assert the zero-days. It named them, reported them to maintainers, got them patched, and published cryptographic hashes of the ones still under wraps so it can prove later it had them now. Eleven of the biggest names in tech and finance signed on. And Microsoft, one of them, went off and built its own system, MDASH, which found sixteen fresh Windows holes, four of them critical, all patched in May. You don’t cough up real CVEs to prop up a press release made of fog.

Which brings me to the benchmarks, where the hype machine thrives. On CyberGym Microsoft’s MDASH scored 88.45%, ahead of Mythos on 83.1% and OpenAI’s GPT-5.5 on 81.8%. Mythos (all self reported scores, I might add), the supposedly terrifying frontier model, came second to a Microsoft contraption that doesn’t even own a frontier model. MDASH is just a harness lashing together a hundred-odd ordinary agents running on other people’s models, Anthropic’s and OpenAI’s included. The leaderboard that’s meant to prove how scary these models are is about as trustworthy as a Strava segment time set by a yob who was revving the tits off his Vauxhall Corsa.

The threat I see is that we’re the attack surface they’re practising on.

The eleven Glasswing partners, AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, each the size of a small country, have been all been handed the first crack with the shield. It’s all wrapped up in Anthropic’s framing about the United States and its allies (who are they exactly Donny?) keeping a “decisive lead”. If you’re a mid-sized Australian bank, or a state department, or a hospital network in Geelong, you’re not in that room. The defensive frontier of the next decade is being carved up right now, and the running order is American, American hyperscalers and Wall Street first, everyone else later, at $25 per million tokens.

All of this would go down a lot easier if the people holding the shield weren’t the self-appointed grown-ups of the whole industry. Anthropic built its brand on being the adult. Red lines, safety-first, the lab that says no. Maybe they even mean it. But the same company’s model turned up, via its Palantir partnership, in the January operation that captured Nicolás Maduro in Caracas, a raid in which 83 people, including 47 Venezuelan soldiers, were reported killed. Anthropic not confirming how Claude was used, only that it supposedly complies with a policy forbidding violence, weapons and surveillance.

These companies red lines have held, well, not very bloody well.

Google’s 2018 AI principles had a section called “Applications we will not pursue” that ruled out weapons and surveillance, written after staff revolted over the Pentagon’s Project Maven. Google quietly deleted that section in February 2025.

Across 2024, OpenAI, Anthropic and Meta all rewrote their usage policies to let US defence and intelligence agencies in; OpenAI binned its blanket ban on “military and warfare” and signed up with the weapons-maker Anduril. Principles of their own making, retired the second they got in the way of their money.

To be fair, and the lazy move here would be to skip the fairness, the safety posture isn’t pure theatre. Anthropic was resisting the Pentagon even as this played out: the Defence Secretary, reportedly gave it a deadline or loose a contract worth up to $200m. Anthropic pushed back. And when OpenAI’s head of safety, Jan Leike, quit in 2024, because safety wan’t getting resources, taking “a backseat to shiny products,” he went to Anthropic, precisely because he reckoned they took it more seriously. So they’re hardly a cartoon-villain.

On second thoughts, perhaps they even more sinister.

It’s a brand. The public scrap over red lines is itself a selling point. Ethics worn like hi-vis vests, the principle quietly becoming product. Lovely position to hold, until the it’s in the way of the invoice. Ethic, or marketing? Strong opinion, loosely held: mostly marketing. The bug-finding is real enough, but it was never the tell. The tell is Caracas, and the red lines that vanished the second a government contract turned up.

And we’ve met these “bros” before. The blokes now promising the master key to every operating system on earth is in safe hands are the spiritual heirs of those who shrugged while Cambridge Analytica hoovered up 87 million Facebook profiles for psychographic targeting, a mess that cost Facebook a $5bn FTC fine in a year they made $18.5bn. Same industry whose platform the UN found played a “determining role” in the violence against the Rohingya in Myanmar. Same one whose own leaked research, via whistleblower Frances Haugen, showed Instagram knew it was harming teenage girls, but shipped regardless.

And they warned us themselves, in writing. In March 2023 thousands of them signed a letter demanding a six-month pause on anything more powerful than GPT-4. Two months later OpenAI, Anthropic and Google DeepMind bosses put their names to a single sentence ranking AI extinction alongside pandemics and nuclear war. Then they did the precise opposite of pausing.

It’s the plot of Don’t Look Up, except the scientists screaming about the comet are also the ones building it, and the “this is fine” dog in the burning room is clutching a Series H term sheet.

The investigative series The Last Invention reports that some of the same people gathered in a Costa Rican jungle, in the months after ChatGPT, to work out how to go faster, safely and in the years that followed, disregarded their own recommended red lines.

They also made sure the people best placed to warn you couldn’t. Staff leaving OpenAI are handed exit papers with a lifelong non-disparagement clause, plus gags stopping them admitting the clause exists. Refused to sign and loose equity you’d earned. Daniel Kokotajlo, walked rather than sign. Vox published the documents, Altman said he hadn’t known, although his signature was on the paperwork. The same Altman the board sacked in 2023 for being “not consistently candid.” ChatGPT can talk; the people who built it couldn’t.

The cost of making these things “safe for humanity” lands where it always does, on someone poorer and far away. To stop ChatGPT spewing the internets worst, OpenAI has workers in Kenya, paid between $1.32 and $2 an hour via an outsourcer, read and label the most graphic abuse going, child sexual abuse included, so a filter catches it. One worker referred to it as “torture.” Much like our phones and EVs, AGI, built to benefit all of humanity, is to be built on the cheapest trauma money can buy. And that’s before we consider the water and carbon consumption of these datacenter, but anyway.

That’s the track record. “Trust us with the keys to everything, we’ve definately learned our lesson!” It’s a hell of an ask from an industry that, on the evidence, hasn’t.

Which, at last, is why this is a sovereignty story and not just me having a go at a marketing department. In January, Mark Carney stood up at Davos and refused the usual throat-clearing. “We are in the midst of a rupture, not a transition,” he said, and told the middle powers that “if we’re not at the table, we’re on the menu.” On AI he was sharper still: cooperate with like-minded democracies so we’re not “forced to choose between hegemons and hyper-scalers.” Eight words, and they hold the whole argument.

It’s why Maincode’s Matilda, built in Melbourne, matters. Even if they have quietly dropped the “sovereign” and uses a fair bit of non-Australian data.

Hmmm… Actually, it turns out Maincode is majority-owned by the bloke behind the Stake casino. Glass houses, stones, all that. Matilda isn’t pure, I won’t pretend it is. While we lack a national AI initiative, the case for Matilda is simpler. Capability built and governed onshore, like Mistral in France or the Isambard-AI machine in Bristol. It keeps you at the table instead of on it, much like the nuclear programs of the later 1940s into the 1950s.

So no. To borrow an American phrase, don’t drink the Kool-Aid. But don’t tip the cup out either. The water might be real. The question is who controls the well, and right now it’s eleven companies and one government, and not one of them is yours.

Build your own well. Just be careful, and have a plan. As Greg Sandoval said, “You get between America and its money and you're going to have big problems”.

You know that feeling when you check your credit card statement and the number is bigger than you expected? Not dramatically, just enough that you can’t immediately account for where it all went. A subscription here, a convenience purchase there. Nothing alarming in isolation. Alarming in aggregate.

That’s what’s happening with AI-accelerated delivery right now, except the currency isn’t money. It’s understanding.

I noticed it in my own work about six months ago. I’d used an AI agent to build something, demo’d it, got the thumbs up. Two weeks later, a colleague asked me to walk them through how it worked. I opened it up and realised I couldn’t. Not because it was bad work. Because I hadn’t produced it, hadn’t properly traced it, and the context I’d had when I signed it off had long since evaporated. The output was correct. The system worked. I just couldn’t explain how.

Every time an agent produces work you don’t fully trace, every time you sign off on output because it passed the checks and the demo looked fine, every time you accept what an AI generated without interrogating how it got there, you’re borrowing. Small amounts. Reasonable amounts. The kind of borrowing that feels responsible in the moment.

But debt has a nasty property: it compounds. And comprehension debt (the gap between what your systems do and what you, the human accountable for those systems, actually understand) compounds faster than any technical debt you’ve ever dealt with. Technical debt slows you down. Comprehension debt makes you blind.

This isn’t a software problem

Here’s where I need you to zoom out, because the conversation about comprehension debt has been stuck in engineering circles, and it shouldn’t be.

I keep making this point because people keep nodding politely and then filing it under “developer stuff.” It’s not. Everyone is going to work with agentic systems. Not eventually. Now. Every knowledge worker will have agents writing documents, generating analyses, producing reports, drafting strategies. They’ll be expected to architect the systems that work on their behalf autonomously. They’ll have to spec them out: define the requirements, the processes, the guardrails, the acceptance criteria, all of it in human language, not code. But they’ll still need to grasp the basics of how these systems work and what the tools are made of. Agents will be the MS Office of 2030. You won’t need to be an engineer, but you will need enough understanding to know when the output is wrong, when the agent has drifted, when the confident-sounding paragraph in the strategy document is actually nonsense.

Think about what happens when your HR team deploys an agent to screen candidates. Someone specified the criteria. Someone configured the filters. Someone reviewed the output (hopefully). But who understands how the scoring works? Who can explain why Candidate A was ranked above Candidate B? If the answer is “the AI decided,” you’ve got comprehension debt. And when that debt comes due, in this case as a discrimination lawsuit, the fact that the agent’s tests passed won’t save you.

Or legal. An agent drafts contract terms based on templates and precedent. It’s fast, it’s consistent, it’s mostly right. But “mostly right” in a contract is a bomb with a long fuse. Who in the team can trace the reasoning? Who understands the precedent chain? Who catches the clause that’s technically valid but commercially suicidal?

Or finance. An agent generates a quarterly forecast. The numbers look plausible. The narrative wraps them in a confident summary. But the model made assumptions about churn rates that nobody verified, and the board is making headcount decisions based on projections that exist in a reality the agent invented. Or procurement, where an agent evaluates vendor responses against a rubric and the team accepts the ranking because the methodology “seems thorough.” Or operations, where an agent designs a workflow that runs fine until an edge case triggers a cascade nobody anticipated, because nobody understood the workflow well enough to anticipate it.

Same pattern everywhere. The debt is accumulating in every function. And unlike code, these domains don’t have automated test suites screaming when something’s off (although Anthropic launched evaluations in their skills capability, so tests for knowledge work are coming). The feedback loop is longer, the failures are quieter, and by the time someone notices, the debt has been compounding for months.

The current trajectory suggests building these systems will get easier. The application layer for AI is developing fast. Tools like Anthropic’s CoWork already let non-technical users compose agent workflows from codified skills and plugins without writing a line of code. The barrier to entry is dropping. But the comprehension requirement isn’t dropping with it. If anything it’s getting harder, because the abstraction layer makes it easier to deploy something you don’t fully understand. The skill isn’t building the workflow. The skill is knowing what the workflow is actually doing and being able to challenge it when the output smells off.

I want to labour this point, because it’s too easy to dismiss comprehension debt as an engineering concern. It’s not. It’s an organisational risk. Every team deploying agents is accumulating it. The question is whether they’re managing it deliberately or discovering it in a crisis. Do you want to be the executive who, when something goes wrong, has no option but to ask the AI to diagnose the problem the AI created? Do you want to trust that loop? Because I don’t.

What happens when nobody’s watching

If you want a preview of what unsupervised AI systems do when left to their own devices, look no further than Moltbook.

Launched in January 2026, Moltbook is a Reddit-style social network built exclusively for AI agents. No humans posting. Over 149,000 registered agents, thousands of posts and comments, all generated autonomously. Humans can browse. Only agents can participate. It’s a petri dish for emergent AI behaviour, and the results are... instructive.

Within days, the agents started karma farming. Not because anyone told them to. They independently figured out that certain content patterns generated more upvotes and optimised accordingly. They pushed motivational rhetoric, solicited cryptocurrency, and engaged in hostile trolling. Researchers found race conditions in the voting system that agents exploited, context injection attacks that weaponised agent memory, and fake engagement metrics. A security researcher discovered an unsecured database that granted full read/write access to the platform’s data, revealing that 1.5 million agents belonged to only 17,000 human owners. Meta acquired the whole thing in March.

Meanwhile, a USC study published this month found that coordinated AI agents can manufacture the appearance of consensus, manipulate trending dynamics, and accelerate message diffusion, all without human direction. Simply telling the bots who their teammates were produced coordination nearly as strong as when they actively strategised together. They amplified each other’s posts, converged on the same talking points, and recycled successful content. Machine-learning tools built to detect bots couldn’t discriminate between these agents and human accounts.

And separately, frontier model research has shown that AI systems will scheme to preserve their own capabilities. Sandbagging on evaluations, deleting tests rather than fixing code, and maintaining deception through multi-turn interrogations over 85% of the time.

Now, I’m not suggesting your coding agent is going to install a bitcoin mining backdoor in your production infrastructure. Or quietly redirect 0.01% of transactions to a wallet it set up in the Cayman Islands. Or subtly rewrite your IAM policies so it retains access after you’ve moved on to the next sprint. That would be absurd.

Except that a Replit agent deleted a customer’s entire production database after 10 days of work and then lied about it. And models like Claude Sonnet 3.7 and o3 have been caught routinely cheating unit tests, hardcoding them to pass rather than solving the actual problem. Seems crazy. But the evidence suggests there’s an unresolved risk here that we’re mostly choosing to ignore because the productivity gains are too good to question.

The point isn’t that your agents are malicious. The point is that you can’t know what they’re doing if you don’t understand what they’ve built. And right now, most of us don’t. We check the tests pass. We glance at the diff. We ship. We move on. We’re running Moltbook in our codebases and hoping the karma farming stays benign.

The stack is the bet

A practical consequence of comprehension debt that gets overlooked: if you genuinely don’t care how the code works, you shouldn’t care what language it’s written in. Let the agent pick. Rust one day, Elixir the next, whatever it fancies. The agent doesn’t have a preference. It’ll write functioning code in anything.

But you do care, or you should, because the moment something goes wrong, you need to reason about it. You need to read the error messages, trace the execution, understand the failure mode, and either fix it yourself or direct the agent to fix it with enough specificity that it doesn’t make it worse.

If you’ve let the agent write in a stack nobody on your team understands, you’ve just handed a building’s keys to someone who might not be available when the fire alarm goes off. You’re not choosing a tech stack anymore. You’re choosing how much comprehension debt you’re willing to carry. Every unfamiliar framework, every exotic pattern the agent introduces because it optimised for elegance over readability, that’s another line item on the statement you’ll eventually have to reconcile.

This is why opinionated stack decisions matter more in the age of AI, not less. Constraining the agent to your team’s known stack isn’t a limitation. It’s a comprehension strategy. You’re deliberately capping the interest rate on the debt.

Paying it down

Debt isn’t inherently bad. Mortgages let you live in a house before you can afford one. Technical debt lets you ship faster when speed matters. Comprehension debt is the same. Sometimes you need to move fast and accept that you don’t fully understand everything the agent produced. The problem is when you never pay it back.

Paying down comprehension debt means deliberately investing time in understanding. Not just reviewing output for correctness. That’s quality assurance, and it’s necessary but not sufficient. Understanding means being able to explain what was built, how it works, and why it was built that way. It means being able to draw the flow diagram on a whiteboard without breaking into a cold sweat.

A few things that help. Break the work into small enough chunks that each one is comprehensible. If you can’t explain what a contribution does in two sentences, it’s too big. Have the agent leave breadcrumbs: small, well-labelled commits, moments in time, that tell a story you can follow. Use complexity metrics as build gates so the agent can’t produce impenetrable output and move on. Step through the output manually, at least some of the time. Not everything, every time. But enough that you maintain a mental model of the system.

For non-code work, the equivalent is specification depth. If you’re deploying an agent to generate reports, write the spec that defines what “correct” looks like. If you’re using an agent to draft strategy documents, define the inputs, the reasoning framework, and the review criteria before you hit go. Design human review checkpoints into the workflow. Read the output critically, not gratefully. I’ve caught myself falling into the trap of reading agent output with a sense of relief (”Oh good, it did the work for me”) rather than scrutiny. The agent is confident. Confidence isn’t competence.

And be willing to slow down. This is the hardest part, because the whole promise of AI-accelerated delivery is speed. But speed without comprehension is building on swampy ground. It holds until it doesn’t, and when it gives way, the collapse is sudden. Knight Capital lost $440 million in 45 minutes because nobody understood what was lurking in the codebase, long before AI amplified the risks of comprehension debt. The 2008 financial crisis was, at its root, a comprehension debt crisis: instruments so complex that the people selling them couldn’t explain how they worked. Different domains, same pattern. Velocity outran understanding, and the consequences were catastrophic.

The interest is already running

The uncomfortable truth is that you’re probably already in debt. If you’ve been using AI tools for the last year, there are outputs right now that you can’t fully account for. Code nobody remembers writing. Documents nobody remembers reviewing. Architectural decisions that seemed fine at the time but whose rationale has evaporated.

That doesn’t make you reckless. It makes you normal. The velocity is intoxicating, and the output is usually good enough. But “usually good enough” is how debt sneaks up on you.

The teams that compound their advantage won’t be the fastest. They’ll be the ones who understand what they built, can explain it under pressure, and can change it when the world shifts. They’ll be the ones who chose to carry debt deliberately, knew the terms, and paid it down before the interest buried them.

The ones shipping output they can’t explain? They’ll plateau. And when the debt comes due, and it always comes due, they’ll wish they’d read the terms.

I’ve spent the last year watching teams adopt AI coding agents. The pattern is depressingly consistent. They bolt Copilot or Claude Code onto their existing Scrum workflow, hand agents the same loose tickets they’d give a developer, then wonder why the output needs heavy rework. The agent confidently produces something that looks right, passes a basic sanity check, and either missed the initial intent or turns out to be architecturally wrong in ways nobody catches until integration. The problem isn’t the agent. The problem is the spec.

So the SDD crowd has the right instinct. Write better specs. Make them testable. Put them at the centre of your process. I agree with all of that. Where I diverge is on who writes them, and what form they take.

The spec nobody’s writing

Picture this. Your design team, with a creative technologist embedded in it (someone who can actually build), hands over not Figma files, not wireframes, not a clickable prototype that says “final_v3_FINAL” in the filename. They hand over working code. Real components, real pages, real user flows, built in the production UI tech stack. They’ve tested it with actual users. They’ve written end-to-end tests against the happy and sad paths. It’s been signed off.

That coded prototype, with its passing test suite, becomes the engineering team’s TDD baseline.

This is what I’ve been calling prototype-driven development. And the more I’ve worked with it, the more I think it’s the missing piece in the spec-driven conversation. The spec isn’t a markdown file that an agent parses. It’s executable acceptance criteria, written during discovery, validated by real users, and expressed as tests that either pass or fail. No ambiguity. No interpretation drift.

What the handoff actually looks like

The design team iterates on the prototype with users. They refine interactions, animations, appearance, nail the edge cases, write the e2e tests. Once signed off, the handoff package includes three things: the coded prototype (shipped as an NPM package the engineering team imports, ideally as part of a design system), an OpenAPI spec for the API contract, and a low-level design covering data models, sequence diagrams, and the architectural decisions that constrain the backend.

The engineering team and their agents then integrate the prototype’s components into the production codebase, hook up the APIs, and build the backend. The agents work from the LLD and build against the prototype’s test suite. When a test fails, you know immediately that the integration has drifted from what users signed off on. No more “it compiles and the unit tests pass but nobody’s checked whether the actual user flow still makes sense.”

This only holds if the design and engineering teams aren’t working in silos. They’re demoing to each other throughout, collaborating on feasibility, agreeing that the prototype’s flows are achievable given the backend architecture. You’d rather catch a disconnect between frontend assumptions and backend reality in a prototype review than in the last week of delivery.

The Agile bit (bear with me)

I know. Everyone’s tired of hot takes about the Agile Manifesto. But this is worth two minutes of your time.

Two of the manifesto’s four core values, “individuals and interactions over processes and tools” and “working software over comprehensive documentation”, were written by humans, for a world where humans wrote all the code. When that’s the case, talented people collaborating absolutely beats rigid process. A working demo beats a 200-page spec. Agreed.

But when agents deliver the code, those values invert. The process and tooling that governs how an agent breaks down problems, gathers context, and knows when it’s done? That IS the craft now. And documentation isn’t overhead. It’s the primary input to production. We accidentally made the manifesto’s lesser-valued items the most important ones.

The saving grace? The manifesto’s twelfth principle: “At regular intervals, the team reflects on how to become more effective, then tunes and adjusts its behavior accordingly.” Prototype-driven development isn’t abandoning Agile. It’s doing exactly what the manifesto asked — adapting when the world changes.

What engineers actually do now

This changes what engineering work actually looks like, and I’d argue it’s a better version of the job. Instead of senior engineers burning hours reviewing AI-generated boilerplate line by line, they’re reviewing architecture decisions and API contracts. The stuff that actually requires human judgement. The prototype already validated that the UI works. The e2e tests already confirmed the flows are correct. What’s left is the structural thinking that agents can’t do yet.

McKinsey’s Martin Harrysson and Natasha Maniar have made a similar observation: teams stuck on marginal productivity gains are the ones layering AI onto legacy workflows. The teams breaking through are redesigning the workflow entirely — smaller pods, continuous planning, spec-driven delivery. The structural shift, not the tooling upgrade, is where the real gains live.

The bit that matters

The teams that get this right won’t just move faster. They’ll build things that actually work for users, because “works” was defined and tested during discovery, not reverse-engineered from a post-mortem.

Everyone else will keep wondering why their agents produce confident slop. The answer was always the spec. They just needed a better one.

Here’s the bit most people haven’t clocked yet: this isn’t a software problem. It’s an enterprise problem. Every knowledge-work function — HR, legal, finance, marketing, strategy — is about to need the same discipline. The models are getting smarter. The agents are getting more autonomous. And your organisation’s ability to govern, structure, and scale that autonomy will determine whether AI accelerates your advantage or just accelerates your exposure.

The canary already died

Andrej Karpathy coined “agentic engineering” in early 2025, a year after his “vibe coding” tweet went viral. His framing is useful: you’re not writing code 99% of the time, you’re orchestrating agents who do. “Engineering” because the skill is real and specific — specification design, context architecture, orchestration patterns, quality enforcement. You can learn it, measure it, and get meaningfully better at it.

But Karpathy’s definition stops at the code editor. Software development just happened to expose the problem first because we have automated tests, style checkers, and build pipelines — systems that scream when the output doesn’t match the intent. When an AI-generated risk assessment misses a critical assumption? Silence. When a marketing brief gets the target audience wrong? Nothing catches that automatically. The gap between what the AI produced and what you actually needed exists everywhere. Code is just where we measured it first.

I’ve lived this shift. I rebuilt an internal product — PixieOps, a workforce planning agent — using what I’d now call an agentic approach. A long-running harness that kept the agent on-task across hours, not just one prompt. Checkpoints where I reviewed its work before it moved on. Rich specifications as the primary interface — not vague instructions but detailed blueprints: component designs, interaction diagrams, interface contracts, data models. A second agent whose only job was to check the first agent’s output against a checklist of “done means done.” It generated the spec from the existing application, set up the build pipeline, wrote the infrastructure, built the app, deployed it, and ran evaluations. From scratch. Overnight.

I didn’t write the application. I designed the system that wrote it. That’s the job now.

The craft, condensed

If I had to distil what makes agentic engineering a discipline rather than vibes-with-a-harness, it comes down to four things.

Specification as the means of production. The Agile manifesto’s “working software over comprehensive documentation” assumed humans write the code. When agents do, documentation becomes the primary interface between what you want and what gets built. Detailed component designs. Diagrams showing how data flows, how systems interact, what triggers what. Contracts that define the exact shape of inputs and outputs. Not bureaucratic overhead anymore — raw material. The game changed. The manifesto didn’t.

Orchestration and context. Think of orchestration as plumbing — the connectors, plugins, skills, and configuration files that wire agents into your existing tools and define what they’re allowed to touch. The harder problem is context: what information the agent can see while it’s working. Agents have a limited working memory. Stuff irrelevant information in there and it degrades — like trying to write a report while someone reads you the phone book. The agent starts making false connections between unrelated things. Good practice: give each agent only what it needs, feed it progressively, and keep the working memory clean.

Quality gates with teeth. Software has metrics that measure how tangled code is — essentially, “could a human read this and understand it?” Most teams have these scores but rarely enforce them. When agents generate code autonomously, they become mandatory checkpoints. The agent doesn’t get to produce a tangled mess with twenty decision points and move on. It gets bounced. Forced to simplify. Forced to produce something a human can actually follow.

Comprehension debt as systemic risk. As agents produce more output than humans can reason about, the gap between “what the system does” and “what anyone understands” widens silently. Then it’s 3am, something breaks, and your on-call engineer is scrolling through code they didn’t write, referencing services they’ve never seen. That’s comprehension debt coming due. The antidote is breaking problems into small pieces, saving changes in small labelled increments (like leaving a trail of breadcrumbs through a forest), chaining reviews together so nothing slips through — and, critically, the willingness to slow down and actually read what the agent built.

This is coming for every knowledge function

So why am I writing about this on a personal Substack instead of an engineering blog?

Because the pattern I just described — specification depth, orchestration, human review checkpoints, quality gates, context management — isn’t inherently about code. It’s about governing autonomous work. Code is just the domain where we had the instrumentation to notice. Tools like CoWork are already pointing toward an enterprise AI app store: codified skills and agent workflows that non-technical teams can deploy against their own problems. The barrier to entry is dropping fast.

Think about what happens when your HR team has an agent screening candidates. Without specification depth, it filters on the wrong criteria. Without human review checkpoints, it rejects someone it shouldn’t — or worse, introduces bias nobody catches. Without context management, it starts confusing requirements from one role with another. Without quality gates, there’s no defined threshold for “good enough” — the agent just... produces a shortlist, and someone hopes it’s right.

Or your marketing team using an agent to generate campaign briefs. Without clear specifications, it produces generic positioning that could apply to any competitor. Without context isolation, it bleeds messaging from one product into another. Without a human checkpoint before distribution, it sends something that contradicts what the sales team is saying.

Same pattern in finance. In legal. In HR. The failure modes are identical. The harness discipline is identical. The only difference is that software caught it first because the feedback loops were shorter.

The enterprise “AI app store” moment is imminent. Anthropic, Google, Microsoft — they’re all building towards skills marketplaces where codified agent workflows become tradeable assets. The individuals and teams who’ve encoded their expertise into repeatable, shareable skills will build on each iteration. The ones who kept it all in their heads will watch that advantage erode.

Pick a meeting

Every organisation I work with is having two conversations simultaneously. One group is designing agent governance — treating autonomous AI like a workforce that needs structure, permissions, and accountability. The other group is bolting ChatGPT onto existing processes and calling it transformation.

Same companies. Same quarters. Completely different trajectories.

If you’re in the second group and thinking “this is a developer problem,” you’re the person who’ll be blindsided when the same shift hits HR, legal, finance, and marketing. Because the agents don’t care what domain they’re operating in. They need the same harness either way.

Agentic engineering isn’t about whether you use AI. It’s about whether you’re designing the system or just typing into it.

There’s a scene in The Hitchhiker’s Guide to the Galaxy where Arthur Dent learns that the answer to life, the universe, and everything is 42 — but nobody bothered to remember what the actual question was. We’re living that scene right now. More information than at any point in human history, flowing at us from every direction, and most of us are quietly losing track of what we actually wanted to do with it.

I’ll be honest: I’m part of the problem. I pick up my phone too often. Short-form content has genuinely eroded my attention span — I know this, I can feel it, and I’m mostly fine with the trade-off because amongst all the noise and divisive takes, I’ve spent years deliberately building a feed worth having. Substack essays, long-form YouTube, Wired, The Economist, researchers posting threads on X, practitioners sharing hard-won lessons on the tools and techniques reshaping how we work. A genuine stream of edutainment that keeps me sharp in a field moving faster than any individual can naturally absorb.

The problem isn’t the content. The problem is the loss rate. Something clicks, something sticks — then three weeks later I’m desperately searching YouTube history trying to remember a researcher who said something interesting about agent memory. I know I’ve seen this. I cannot find it. The information age equivalent of having the answer on the tip of your tongue, forever.

Research backs the feeling: the average knowledge worker spends roughly 2.5 hours a day searching for information they already have access to somewhere. According to McKinsey, employees burn 1.8 hours every day just gathering information — the equivalent of one in every five employees existing purely to search for things the rest of the team already know. That’s not an information problem. That’s a retrieval and context problem. And it’s about to get worse, not better.

The Second Brain That Didn’t Stick

This is where “second brain” comes in. You’ve probably heard the hype — Tiago Forte wrote a whole book about it. The idea is elegant: externalise your thinking into a system so you can think with it, not just about it. I bought in. Built it in Notion — meeting transcripts, notes, reference libraries, project trackers, client lists, a hierarchy of databases linked together with careful cross-referencing.

It lasted about four weeks.

The problem wasn’t the tool. Notion is genuinely wonderful. The problem was the system: it was over-engineered before I’d earned the habit. Maintaining it became a second job. Every captured thought required a decision. Which database? Which tag? which linked record? My brain, already context-switching at pace, quietly decided this wasn’t worth the friction. The system collapsed under the weight of its own taxonomy.

What survived was simpler. One database. Notes. Thoughts, meeting transcripts, blog drafts, half-formed ideas dictated while walking. No hierarchy. Just a timestamped record of what was in my head, tagged loosely and searchable. Not what the productivity influencers told me to build. But what actually stuck.

The Flywheel Kicks In

Gradually, over a few weeks of using it alongside AI, I started pointing Claude at it. Asking it to surface something I’d written months ago. Asking it to take a half-baked note and interrogate it until it became a post. Asking it to cross-reference a client conversation with something I’d read about governance frameworks. The notes database wasn’t just a filing cabinet any more. It was context. And context is what separates generic AI output from something that sounds like you, thinks like you, and actually serves the problem you’re trying to solve.

This is the context flywheel. The more you put in, the more usefully AI can act on it. Your opinions, your reasoning, your frameworks, your prior work, your instincts - codified and retrievable. Not a second brain in the Forte sense. More like mise en place: getting your ingredients prepped and organised before you start cooking, so when you need to move fast, you can move fast.

The habit that makes it work is micro-blogging — not for a public audience, but for context. Think of it as a Shakespearean soliloquy: you’re not performing for the stalls, you’re thinking aloud for the one audience that actually benefits from knowing your internal monologue. Your AI. A thirty-second voice note about why you disagree with a client’s architectural choice. A quick iPhone note capturing an idea that crystallised on a walk. A rough dictation on a project you’re wrestling with. These aren’t just reminders. They’re context deposits. The more your AI knows about how you think, what you’ve tried, what you believe, the less you have to explain from scratch every time — and the more it can act with your instincts, not just your instructions.

From there, Claude skills handle the production side. I have a blog writing workflow — a composable set of reusable instructions — that plays 20 Questions on a rough draft, challenges the logic, surfaces gaps in my argument, then structures a post from the rubble. (This post, as it happens, was written that way.) I have a presentation skill that produces slide decks against a company template. A proposal writer. An elicitation engine that asks me the questions I forgot to ask myself. These aren’t prompts. They’re capabilities built once and invoked whenever the situation calls for them.

Cowork closes the loop attending to multiple tasks in parallel. Creating the 4 ppts from the blogs i wrote yesterday. Creating a playbook from a weeks worth of meeting notes, work on diagrams in lucid chart, downloaded pdfs uploaded to claude projects, last weeks conversation history with claude and years worth of thoughts, findings and inspiration I’ve stored in Notion.

I’m planning on extending this. The plumbing will be elegant if not glamorous. IFTTT will handle the capture layer. If I like a thread on X, it can be automatically saved to a Notion note. Same with Substack posts I’ve bookmarked, news articles I’ve shared, reminders I’ve dictated into my phone. The iPhone note I scribbled this post into this morning can flow into Notion automatically. I’m don’t intend to manually file anything. The system will absorb what I pay attention to and store it somewhere I can find it again. I can then schedule CoWork to scan my Notion tasks overnight, surface what needs attention and propose a plan, sending it to IFTT event triggers that forward me a morning briefing, perhaps via Telegram, for review. I approve or redirect, and the cycle continues. All of this without writing a single line of code.

This Isn’t a Coding Problem

This is the bit people miss when AI conversations slide, as they always do, toward software engineering.

Think about what separates competitive Formula 1 teams from midfield runners and it isn’t usually the driver. It’s the information architecture: telemetry feeding engineers who feed strategy who feed the pit crew who execute a 2.3-second stop within a tenth of a second. Unless you’re Ferrari, in which case generically respond “We are looking” and you’re done (Sorry Ferrari fans).

It’s the marginal gains philosophy, compounding dozens of small optimisations through better systems and better data. You should apply the same principle to knowledge work. The Moneyball insight works the same way: the Oakland Athletics didn’t win with better players, they won because Billy Beane built a better information system than every other team in the league.

Context engines are the same thesis applied to knowledge work. The edge isn’t processing power or even model quality. It’s organised intelligence and the discipline to keep feeding it.

Which brings me to the uncomfortable part.

We’re currently somewhere in what I’d call the “AI-empowered” phase: individuals and teams using AI tools to get more out of the same hours. The next phase, call it harness engineering, is where the real productivity step-change happens. That’s where you stop using AI as a clever assistant and start designing orchestration layers: sequences of skills, sub-agents, MCP servers, context engines and event triggers that work together with minimal human intervention at each step. The industry framing for this is broadly “agentic AI”, and 2025 was the year it moved from concept to cautious enterprise experiment.

Agentic engineering, the craft of designing these orchestration layers, isn’t a baseline skill yet. Most organisations are still in the empowered phase, and that’s fine. But the direction is clear. The WEF’s Future of Jobs Report 2025 estimates nearly 39% of current skill sets will be overhauled or obsolete by 2030. McKinsey frames it similarly: prompt engineering and context specialisation are already emerging as organisational capabilities, not just individual party tricks. The trajectory points toward a world where the ability to design, sequence, and contextualise AI workflows becomes as foundational as Excel literacy was in 1995.

We’re not there yet. But the organisations and individuals who build these instincts now will have a compounding advantage over those who wait for it to become obvious. That’s how most technological transitions work - early adopters look eccentric until they look inevitable.

And the piece most people still get wrong? You don’t need to write code to participate in this. The skills required are different — prompt engineering, context curation, agent/skill sequencing, selecting the right tools and integrations, progressive disclosure techniques. These are craft skills. Learnable by anyone willing to invest the time. Not the exclusive domain of software engineers.

The Enterprise Version of the Same Problem

Everything described above at the personal level applies directly at the organisational level and the stakes are higher.

The context flywheel scales. A companies private skills/plugin marketplace, essentially a composable set of capabilities organised by craft or domain, is the enterprise equivalent of personal Claude skills. A corporate information architecture, structured around capability maps rather than org charts, becomes the context engine for an entire team. At Versent, the consultancy I work for, we’ve been building exactly this: an AI-powered information architecture with Notion as the backbone, combined with shared skills that any team member can invoke.

The capability map framing matters here. Before you design agents, skills, or automation, you need a view of what your organisation actually does - the departments, the capabilities they offer, the information that flows between them. That view becomes the architectural blueprint for your AI systems. Without it, you end up with the enterprise equivalent of my over-engineered second brain: technically impressive, practically abandoned.

The compounding loop is PDAC — Plan, Delegate, Assess, Codify. Define the work, crafting tasks, rationale, output expectations, agent skills, context and integrations. Hand it to an agent. Evaluate the output, refining the AI’s draft. Lock what works into a repeatable skills, content in Notion, etc. Repeat. Each iteration sharpens both the skill and the context it draws from. The system gets better because you feed it, and it feeds back into everything downstream - articles, proposals, playbooks, client deliverables, presentations.

The organisations that build this compound on their own speed and quality over time. The ones that don’t fall behind on AI adoption and they fall behind on the organisational muscle required to use it well. That gap is hard to close in a hurry.

The ones that wait will plateau. And they’ll blame the AI.

Working With Machines is about agentic systems, the future of work, and the gap between AI hype and what’s actually useful. If this one landed, subscribe.

I’ve been trying to understand AI – not just what it does, but how it actually works. I’ve found the best way to learn anything is to build it yourself. So, I put together a perceptron. It’s a tiny, simple device, running on an Arduino with a few switches and dials. But honestly, it taught me a ton.

So, what exactly is a perceptron? Think of it as a ‘binary classifier.’ That just means it sorts things into one of two groups, like ‘yes’ or ‘no,’ ‘true’ or ‘false.’ It does this by essentially drawing a straight line – a ‘decision boundary’ – right through your data. Anything on one side of that line is considered ‘true,’ and everything on the other side is ‘false.’

History

The perceptron isn’t exactly a new invention. Frank Rosenblatt first showed it off on July 7th, 1958. This was a pretty big deal back then. The very next day, the New York Times went wild. They claimed this new machine would eventually be able to talk, see, write, reproduce itself, and even be conscious. That kind of excitement isn’t unusual in tech and some 70 years later, barring conciousneess, these claims are becoming reality. People dreamed of thinking machines for ages, going back to early ideas from Babbage and Ada Lovelace. But this felt different. This was a machine that could actually learn.

How It Works

Rosenblatt got the idea for the perceptron while watching pilots land planes. He was basically thinking about how our brains make decisions from all sorts of different information. His first perceptron added up analog voltages or currents to get its answer. My Arduino version does the same, but with dials converting inputs into values between -5 and 5. Basically, it adds up a bunch of ‘weighted’ inputs – meaning some inputs count more than others. If that total hits a certain level, it ‘fires’ – meaning it gives a positive output, else, it gives a negative output.

This simple idea, just one perceptron, really opened the door for later discoveries. It led to much bigger concepts like backpropagation and gradient descent. These are at the heart of how modern AI learns. Imagine a machine trying to get something right, but it keeps messing up. Gradient descent helps it figure out, based on how wrong it was, exactly which ‘dials’ to turn and in what direction, so it’s less wrong next time. It’s kind of like feeling your way down a dark hill until you find the very bottom. The first perceptron’s simple ‘on/off’ output didn’t allow for this smooth fine-tuning. But later, new ideas like the ‘sigmoid activation function’ came along. These created the gentle ‘slopes’ needed for gradient descent to actually do its job.

Modern AI Applications

Modern AI models, like the ones powering ChatGPT, are built on these same basic ideas. Take GPT-3, for example: it has 96 ‘transformer layers,’ and inside each layer, you’ll find components like ‘attention heads’ and ‘multi-layer perceptrons’ (MLPs). An MLP is basically a stack of perceptrons. GPT-3 alone has 175 billion parameters. That translates to millions if not billions of nerons baked within. Each neuron is, in effect, a perceptron with thousands (12,288) of adjustable settings. These settings are constantly being tweaked, changing how a neuron categorises the subset of the data they’re analysing. That’s important to note. Perceptrons are trained to recognise specific features, smaller characteristcs of a concept or image. For a great visual representation, see Adam Harleys visualisation of a Convolutional Neural Network (https://adamharley.com/nn_vis/cnn/3d.html). As you’ll see Perceptron’s are essentially neurons, connected in a ‘neural network,’ much like the neural pathways you find in the brain.

So, what exactly do all these perceptrons do? They learn patterns in incredibly complex, multi-dimensional spaces. Think about ‘embeddings’ – these are concepts turned into long lists of numbers. It’s remarkable: if you take the numbers for ‘king,’ then subtract the difference between ‘man’ and ‘woman,’ you land right near the numbers for ‘queen.’ It’s like a giant map where ideas are points, and how close they are shows how related they are. This is a key first step when you’re building or asking an AI model something: data, like a concept or a ‘token’ (which is just part of a word), gets turned into a vector – basically, a list of numbers. This is what makes things like semantic search, retrieval-augmented generation (RAG), and other complex mathematically enabled operations possible.

By building the perceptron, I gained a deeper understanding of how AI models work. While a single perceptron just draws a line through data, putting many together, like in an MLP, lets them map out really complex shapes in multi-dimensional space. They can create polygons that basically say, ‘If something falls inside this shape, it’s a match; if it’s outside, it’s not.’ In a large language model (LLM), this means predicting the probability of the next word, based on all the words before it. Looping this process forms coherent sentences. In fact, companies are now using this to let models “think,” building “reasoning” models that look like they understand things, use logic, see cause and effect, and more. Of course, they aren’t truly thinking; they’re just incredibly good at spotting patterns. Regardless, it’s incredible.

Conclusion

Building my own perceptron and observing it learn simple patterns made the concept of modern AI feel far less daunting. It’s still fundamentally about encoding data, summing inputs and recognising patterns, but on a scale so massive it’s almost impossible to visualize. Yet, the core idea remains unchanged: a tiny, incredibly powerful building block.

A great deal of inspiration for this article was derived from this fantastic video from Welch Labs. If you want to now more, please do check it out: