Intel
Writing
Field notes on AI, federal technology and building products. Start with the newest below if you are new here.
More: how I work.
New here? Start with four places.
22 articles in Tech
Contract Archaeology: Finding the Product in Your Services
Read three delivered contracts for what repeated. Four shapes to dig for, five criteria to score a candidate, and one boundary test before you build.
2025 Moved the Constraint From Capability to Authority
Three artifacts from 2025 tell one story. The binding limit stopped being what the model could do and became who was allowed to let it.
Agentic Engineering: The Product Is the Policy
Port raised $100M to put agents in the platform layer. The product that matters is not the agent. It is the policy the agent executes.
AI Sustainment Is Performance Sustainment
The RDT&E to O&M shift exposes a gap: O&M contracts are scoped for stable systems, and an AI system is never stable enough to leave alone.
KPMG's TACO Framework Sorts Agents, Not Risk
KPMG's TACO framework names four kinds of agent by how much intent they supply. Oversight has to attach to the action, not to the label.
AI Security Is an Accreditation Problem, Not a Model Problem
Prompt injection is not a jailbreak. It is unverified input driving real actions, and that breaks the assumption every authorization rests on.
Data Governance Agents Enforce Policy. They Cannot Own It
KPMG and Oracle are selling agents for data management. The limit is not the model: most policies are too vague to execute or to audit.
Platform Migrations Fail on Governance, Not Technology
Consolidation programs run over budget because the hard part is decision rights, not engineering. Sometimes integrating what you run is cheaper.
There Is No FedRAMP Shortcut to IL4
FedRAMP 20x changes how cloud security evidence is produced and reviewed. It does not turn a FedRAMP High package into a DoD impact level authorization.
Tactical RAG Fails on the Index, Not the Latency
A cloud RAG system assumes a complete, current corpus. At the edge the corpus is a shipment, and the index date decides whether the answer is usable.
What It Takes to Put an Assistant on SIPRNet
The assistant is the easy part. A classified deployment turns on the authorization boundary, the model catalog inside it, and who reviews the markings.
Your Browser Went Post-Quantum. Your VPN Did Not.
Hybrid ML-KEM is on by default in Chrome and Firefox. The migration that matters is the long-lived data no browser upgrade will touch.
A Fork Does Not Fix Your Infrastructure Governance
OpenTofu joining the CNCF settles a licensing argument. The controls that decide who can change production were never in the license.
Vibe Coding Is for Throwaway Code, Not Delivery
The practice means not reading what the model writes. Fine for a weekend project, disqualifying for anything someone else has to maintain.
An AI Bill of Materials Is Not a Control
A list of model components tells you what went in. It does not tell you what the model will do. SBOM taught that lesson the hard way.
The Quantum Risk Is Your Data's Shelf Life
Whether quantum computing arrives in five years or twenty, data captured today is at risk now. The migration clock starts at your retention period.
Spatial Computing Wins Where Your Hands Are Busy
The headset did not kill the screen. It found a narrower job: putting a procedure in front of someone whose hands are already occupied.
FedRAMP 20x Changes the Unit of Evidence, Not the Form
OSCAL made the paperwork machine-readable. FedRAMP 20x goes after the review itself, and the review was always the slow part of an ATO.
Sovereign LLMs: Open Models for On-Prem Government AI
Downloading the weights is the easy part. Sovereign AI requires provenance, evaluation, and a hardware plan you can defend in an audit.
Data Mesh in Defense Is an Accreditation Decision
A data mesh is a governance decision, not a platform purchase: who owns each domain, who may query it, and who signs for the result.
GCC High Is a Platform, Not a Compliance Badge
GCC High migrations fail on identity and data residency before they fail on technology. What to sequence, and what breaks when you sequence it wrong.
NPE Identity: Your Agent's Credential Needs a Sponsor
Giving an AI agent its own identity is the easy half. The half that survives an audit is the named human who owns the credential and can revoke it.
End of the archive. 22 essays.