Holiday reading: An engineer arrives at nine.
Holiday reading: An engineer arrives at nine.
She wants to add a queue, extend a service's network reach, and grant it access to a data store it hasn't used before.
She writes a declaration. Composed from curated modules that already encode every decision the organisation has made about encryption, logging, network position and lifecycle. Eleven minutes, because the hard thinking was done once and has been reused four hundred times since.
She opens a change. Ninety seconds later she has three answers: queue fine, network fine, data store grant conflicts with a residency rule.
Not "referred to security for review."
Conflicts. With a rule, by name, linked to that rule as it is written in code, with an alternative that satisfies both her intent and the rule.
A colleague reviews it for whether it's a good idea — the only question humans are actually better at — because every question about whether it was permitted has already been answered by something that doesn't get tired.
It merges. It applies. She never touches production.
She has never held credentials that could touch production.
Neither has anyone else.
No screenshots. No control questionnaire. No meeting. The evidence fell out of the pipeline as exhaust, already attributable, already queryable.
Here is the uncomfortable part.
Every component of that morning is buildable today, with technology that shipped years ago. No breakthrough required. No vendor you don't already have. The individual parts are ordinary.
What doesn't exist anywhere is all of it at once, without exceptions.
That's what makes it a utopia rather than a specification.
Because exceptions aren't technical objects. An exception is what happens when a deadline is real and the correct path costs more than the shortcut. It's a feeling, converted into paperwork so it can be survived.
And the moment you accept that, the engineering problem changes shape entirely.
You stop spending your capability on more controls.
You spend it on making the right path cheaper than the wrong one — until nobody complies because they were persuaded, and everybody complies because it was easier.
That's achievable. It's also a considerably less exciting slide than the one with the curve on it.
There's a diagnostic for this and it takes a minute.
Ask any organisation for its exception register. For each entry, ask two questions:
Who owns this.
When does it expire.
Most cannot answer either.
That is the distance between here and the utopia, and it has never once been measured in technology.
Full piece in the article below — the five artefact classes nobody governs, why autonomy has to be earned per capability against a measured reversal rate, and the one property of AI agents that no privileged account in history has ever had.
They can all be stolen.
This one can be persuaded.
Threat intelligence every morning — new victims, new groups, what matters, in plain English. Free, with receipts.
Subscribe to the Daily →
Scott Gardner ·