Writing on AI
AI governance, agents, AI security, and FinOps — for the CIOs, CISOs, and architects who have to ship.
Everything here is written by Michael York, VP of Information Security & DevOps at SavvyMoney, who stood up AI governance for a fintech platform serving 1,500+ financial institutions. These essays take positions — on AI governance and regulation, AI security, agents and non-human identity, and AI cost — argued from production work rather than a news wire. New essays land weekly; the topic hubs below group them by theme.
Featured
Fair Lending: The Real AI Governance Problem
Mapping models to AI frameworks isn't governance for credit. The binding constraint is fair-lending law — ECOA/Reg B, FCRA adverse action, SR 11-7 model risk.
Context Custody Is a Concentration Risk
Intelligence went cheap, yet enterprise buyers expect to pay more for Claude. You're not paying for the brain — you're paying for where your context lives.
Why We Built AgentOS
One model scored 78% in one agent harness and 42% in another. In regulated fintech the harness is where governance lives, so we built our own: AgentOS.
The Boundary Layer Is the Actual AI Control
Every AI governance framework describes the same controls. The one that matters is a design decision: does this output get acted on, or interpreted first?
More posts
'We Don't Train on Your Data' Is Not Enough
An agent told to open no files obeyed — while the product uploaded the whole repo, canary included. "We don't train on your data" answers the wrong question.
A Convincing Voice Is Not Authenticated
A cloned voice with matching caller-ID is recognition, not authentication. Move trust onto channels you control: callback on record, dual authorization.
Your Prompt Is the Approval. That's the Gap.
An MCP connector executes writes with no approval screen — your prompt becomes the one boundary nobody governed. That missing gate is a control-plane gap.
Your AI Policy Is a PDF. Agents Can't Read It
A model given thousands of extra words wrote better prose — and failed the delivery contract two runs in three. Rules agents can ignore fail audits.
Prove You Need the Agent Before the Swarm
Token spend explained ~80% of variance in multi-agent runs; most "AI failures" are provisioning mistakes. Treat a swarm as segregation of duties.
Shadow AI: Your "Personal Tool" Is Production
A coding agent stands up a data-touching tool in an afternoon. The moment it needs a login or gets shared, it's a production system nobody reviewed.
Stop Gating the $40 Question
Two hours and $40 did what a top engineer says he couldn't — and no routing table would have assigned it. Gating frontier access defunds your own sensing.
The Second Agent Cheap, the Fiftieth Boring
Build cost was never the constraint in a regulated shop — agent #50 hits the same security review as agent #1. Make identity and action gates reusable.
Bake Audit Evidence Into Your AI Pipeline
Audit-defensibility isn't a document you write after the fact — it's a property you engineer into the AI pipeline so its operation emits evidence as exhaust.
The 2026 AI Regulatory Map on One Page
Everyone read 'EU AI Act deferred to 2027' and exhaled — but the part fining 3% of global revenue turns on in August. The four 2026 rules with teeth.
Design AI Inference for Model Disappearance
A frontier model went dark three days after launch; here's how I make AI inference survivable on AWS when the provider is a dependency you don't control.
Your AI Bill Is the New Cloud Bill
We spent a decade learning cloud FinOps and are repeating every mistake with LLM spend — here's the operating model that meters, routes, and caps it.
Nobody Is Governing Your Agents' Credentials
Your agents already outnumber your people, they can authenticate but not prove they're authorized, and that's the gap SOC 2 and HIPAA were never built to close.
Stop Trying to Patch Prompt Injection
Prompt injection isn't a bug a vendor will patch — it's a property of how models read context. Design systems that stay safe even when the model is hijacked.
The Control Plane Is the Job
Standing up an agent takes an afternoon; the control plane that lets it touch production safely is the actual engineering work, and almost nobody shows it.
Model Selection Is Capacity Planning
Most teams pick a model like a sports team and never revisit it — but model selection is a routing, capacity, and risk decision you already know how to make.
Your Agent Dashboard Is Green and Lying
Uptime tiles tell you the service answered — nothing about whether the answer was right. That gap is where a model-risk review will eat you alive.
Shadow AI Is the New Shadow IT
Every abandoned notebook and weekend prototype is a credential-bearing asset nobody owns. The fix isn't a ban — it's discovery, demotion, and real sunsets.
Three Token Counts, Zero You Can Attest To
Codex says one number, Claude another, your gateway a third. That isn't a metering problem — it's an attestation problem regulated industries can't afford.
Concentration Risk in the Three-Lab AI Stack
Most of the AI on your roadmap traces to three labs on the same chips, supply chain, and balance sheets. That's a concentration risk your board hasn't priced.
What AI Actually Changes for Attackers
Cutting through the threat inflation: what AI genuinely changes for attackers, what it doesn't, and where a defender's hardening effort actually pays off.
Make Your Enterprise Agent-Readable First
Everyone is racing to buy agents; almost no one builds the substrate that lets them act safely. The productivity is real — so is the blast radius.
Dark Code Is a Control Failure, Not Tech Debt
AI is filling repos with code nobody can explain. We call it tech debt; it's a control failure — and it should fail CI like a missing approver does.
AI Found 271 Bugs in Firefox. Now Your Repos?
AI-assisted fuzzing found hundreds of bugs in hardened open-source code. The question is whether you run it before someone else runs it against you.
Source-Map Leaks: Your Pipeline's Confession
One packaging mistake can publish hundreds of thousands of lines of internals. The leak is a confession: release controls never caught up to release velocity.
Shadow-Agent Discovery for Regulated FIs
Unsanctioned AI agents already run in your environment with your credentials. Find, classify, and gate them before they touch member data or an exam does.
Automate the Boring, Not the Judgment
A framework for deciding which security work to hand to machines — and the judgment line you should never let automation cross, no matter the headcount math.
An AI Agent Dropped Prod: The Change Playbook
Coding agents are committing real change to real systems. The question isn't whether to let them — it's how to give them speed without a SOC 2-fatal mistake.
Agent Safety: Engineer the Blast Radius
Most agent "safety" is a politely worded request to a model that need not honor it. The only controls that count still hold after the model goes wrong.
Your Browser Agent Has Your Cookies
Browser AI agents don't request access to your systems — they inherit it from the authenticated sessions in your tabs. A threat model nobody provisioned for.
Agent Memory Is a Data-Residency Problem
Give every agent a durable, MCP-connected brain and you've stood up a new data lake of PII and PCI scope nobody classified, encrypted, or can purge.
Anchoring Bias Is Already in Your KYC Agent
The failure modes that made medical LLMs unsafe sit inside your fraud, dispute, and onboarding agents. They don't announce themselves — you have to hunt.
Agent Onboarding Was Easy. Offboarding Isn't.
Every team shipped an agent in a weekend. Almost none can say how it gets fired, what credentials it still holds, or who would notice if it went rogue.