Writing

Notes from building a governance runtime

Mostly what broke, and what we changed because of it.

2026

2026-09-05 Report

We were measuring our customers' exposure and calling it a suggestion list

Every connected runtime reports which tools it has and how often each one ran. We used that to suggest controls worth authoring, never to say how much of an agent's surface nothing governs.

agent-governance
security
audit

2026-09-04 Report

A governance audit of our own runtime

We ran our adversarial audit method against KIFF itself. Four attacks on the central guarantee, three of them worked, and the audit trail recorded all three as governed.

audit
agent-governance
security
go