Intel
Writing
Field notes on AI, federal technology and building products.
More: how I work.
New here? Start with four places.
108 articles · page 2 of 5
KPMG's TACO Framework Sorts Agents, Not Risk
KPMG's TACO framework names four kinds of agent by how much intent they supply. Oversight has to attach to the action, not to the label.
Agentic Commerce Solves Checkout, Not Spending Authority
The Agentic Commerce Protocol gets the token right: a permission that carries its own limit. Federal money needs something a limit cannot supply.
GPT-5-Codex Moves the Bottleneck to Review
The agent can write more code than a team can inspect. The constraint is no longer generation, it is the review record that makes code defensible.
CMMC 2.0: The Deadline Is a Solicitation, Not a Date
The DFARS final rule took effect on 10 November 2025. Certification is phased in over three years, and the real clock starts with a solicitation.
The Model Spec Is a Promise, Not a Control
OpenAI's Model Spec sets out how its models should behave. It also says production models do not yet match it, which is the part worth reading twice.
Replicator 2 Is Counter-Drone Work, Not a Software Phase
The program's second line of effort went to countering small drones. The coordination software everyone talks about sits somewhere else.
TITAN Is in Production. The Hard Part Starts Now
The Army put TITAN into production with $192 million across Palantir and Anduril. Contract terms, not the demo, decide whether it stays software-defined.
AI Security Is an Accreditation Problem, Not a Model Problem
Prompt injection is not a jailbreak. It is unverified input driving real actions, and that breaks the assumption every authorization rests on.
Data Governance Agents Enforce Policy. They Cannot Own It
KPMG and Oracle are selling agents for data management. The limit is not the model: most policies are too vague to execute or to audit.
GPT-5 Picks Its Own Effort. Your Budget Cannot.
GPT-5 routes between models and effort levels on its own. That is convenient in a chat window and a problem for cost, testing and reproducibility.
Platform Migrations Fail on Governance, Not Technology
Consolidation programs run over budget because the hard part is decision rights, not engineering. Sometimes integrating what you run is cheaper.
There Is No FedRAMP Shortcut to IL4
FedRAMP 20x changes how cloud security evidence is produced and reviewed. It does not turn a FedRAMP High package into a DoD impact level authorization.
The Pentagon's New Dependency Is Code, Not Advice
Hyperscalers no longer leave a roadmap behind. They leave a pipeline and a permission set, and the exit cost moves from recompete to migration.
APFIT Is a Bridge. It Is Not a Market.
APFIT funds the move from prototype to production. It does not guarantee a program of record, and that is the part contractors underrate.
Grok for Government Needs a Boundary, Not a Benchmark
xAI's federal pitch leans on FedRAMP. But no model gets an authorization, and FedRAMP High is not the same thing as a DoD impact level.
Cyber Command's AI Problem Is Evidence, Not Models
A pilot that works in a lab and cannot be accredited is not capability. In military cyber operations the model is the cheap part of the system.
JADC2 Data Fabric: Where the Schedule Actually Dies
JADC2 is not one system. It is a stack of accreditation decisions and data rights agreements, and that stack is where the schedule dies.
The Air Force Wants Structured Data, Not a Prettier Twin
DMM is Digital Materiel Management, and its hardest requirement is structured, secure data. A physics-accurate model is downstream of that.
Tactical RAG Fails on the Index, Not the Latency
A cloud RAG system assumes a complete, current corpus. At the edge the corpus is a shipment, and the index date decides whether the answer is usable.
What It Takes to Put an Assistant on SIPRNet
The assistant is the easy part. A classified deployment turns on the authorization boundary, the model catalog inside it, and who reviews the markings.
DeepSeek Halved Its Hallucination Rate. Yours Is Different.
DeepSeek says its update cut hallucinations by up to half. That number came from its benchmarks, not from your task, and the gap is the whole job.
Your Browser Went Post-Quantum. Your VPN Did Not.
Hybrid ML-KEM is on by default in Chrome and Firefox. The migration that matters is the long-lived data no browser upgrade will touch.
The Army's MSD IDIQ Is Really About Continuous ATO
The Army's software vehicle treats authorization as an ongoing obligation. That moves contractor risk from the delivery date to sustainment.
The Hyper-Enabled Operator Is a Training Problem
At SOF Week 2025, SOCOM's own industry panel rated AI progress a six or seven out of ten and named digital fluency, not devices, as the gap.
End of page 2 of 5. The archive continues.