Research notes
Each note sits under one research pillar and is typed as a design pattern, meaning a reusable way to build something, or an operating theory, meaning a claim about how a system behaves.
Design Pattern · September 2026
Lectio
The reference implementation of the closed loop: make a knowledge-sharing request explicit, observable, and answerable, so delivery, consumption, comprehension, application, and outcome stay separate claims with separate evidence.
Under Human knowledge as a closed loop
Apply this pattern
Operating Theory · September 2026
The Zero Neo principle
New business-operations software should be the last resort. Start with the capabilities already owned and move outward only when evidence shows a real gap.
Under Zero Neo
Test this theory
Operating Theory · September 2026
The business application polypharmacy problem
Applications accumulate the way medications do. Each addition was reasonable at the time; the collection is nobody's deliberate design and nobody's responsibility to review.
Under Zero Neo
Test this theory
Design Pattern · September 2026
Microsoft and Google as business operating substrates
Treat the owned platform as a substrate of capabilities rather than a bundle of products, then map those capabilities against the jobs that category software is bought to perform.
Under Zero Neo
Apply this pattern
Design Pattern · September 2026
From applications to work
Businesses do not need CRM software; they need work performed. Decompose the outcome into roles, tasks, workflow, and capabilities, and the application stops being the organizing unit.
Under Labor as Code™
Apply this pattern
Operating Theory · September 2026
AI changes the configuration economics
Specialized SaaS won largely because configuring general-purpose platforms was expensive. If AI collapses that cost, the reason for the historical result stops applying.
Under Labor as Code™
Test this theory
Operating Theory · September 2026
Zero Neo without an IT department
Small businesses historically chose between buying SaaS and hiring consultants. If AI can configure owned platforms, a third option appears for organizations that never had one.
Under Zero Neo
Test this theory
Operating Theory · September 2026
Zero Neo with an IT department
The larger effect may be in organizations that do have IT. Governing a few strategic platforms is a different job from administering hundreds of applications and the integrations between them.
Under Zero Neo
Test this theory
Design Pattern · September 2026
From human work to AI workforce
Automation follows understanding. Work becomes explicit, then observable, then repeatable, and only then is it a candidate for AI execution with human exception handling.
Under AI Workforce™, Native Alpha™, and Recomposition
Apply this pattern
Operating Theory · September 2026
When Zero Neo should fail
The conditions under which specialized software remains the right answer, stated precisely enough to be used in an actual review.
Under Labor as Code™
Test this theory
Operating Theory · September 2026
Zero Neo economics
Subscription price is the easiest number to compare and the least decisive. The hypothesis stands or falls on total operating cost, including the costs of assembling badly.
Under Zero Neo
Test this theory
Design Pattern · September 2026
The Zero Neo reference architecture
Systems of record at the bottom, platform capabilities above them, AI orchestration above that, then workflows, then the mixed workforce, with observable outcomes at the top and purchased software entering only from the side.
Under Zero Neo
Apply this pattern
Operating Theory · September 2026
Credentials as insurance
Training, credential, licence, supervision, and liability cover exist as a stack because each layer is insufficient alone. An AI worker arrives with none of them.
Under Unbundling Work, Credentials, and Liability
Test this theory
Operating Theory · September 2026
Recomposition, not replacement
The realistic outcome is not fewer credentialed people. It is credentialed people supervising a distributed set of workers, human and otherwise.
Under AI Workforce™, Native Alpha™, and Recomposition
Test this theory
Design Pattern · September 2026
Data readiness before automation
Most assembled systems fail before any model runs, because the data they depend on is incomplete, inconsistent, or somewhere nobody checked.
Under Operational Truth™, Risk, Liability, and Outcomes
Apply this pattern
Operating Theory · September 2026
How platform and SaaS choices affect care delivery
The published evidence that fragmented, poorly usable software has measurable costs in healthcare, what it supports, and what it does not.
Under Zero Neo
Test this theory
Design Pattern · September 2026
Native Alpha invention discovery interview
Recover the unusual observation and technical principle before drafting turns the conversation toward an implementation.
Under Design Your Patent Around What the Customer Buys
Apply this pattern
Design Pattern · September 2026
Commercially irreducible constraint map
Trace customer value to the smallest constraint a capable rival cannot remove without losing that value.
Under Design Your Patent Around What the Customer Buys
Apply this pattern
Operating Theory · September 2026
Native Alpha density review
Concentrate research and protection where unusual insight, customer importance, resistance, and compounding are strongest.
Under Design Your Patent Around What the Customer Buys
Test this theory
Design Pattern · September 2026
Customer-led IP evidence log
Keep customer behavior connected to claim, continuation, filing, and maintenance choices.
Under Design Your Patent Around What the Customer Buys
Apply this pattern
Design Pattern · September 2026
AI compression test
Assume capable AI makes ordinary reasoning and software cheap, then identify how much of the claimed advantage disappears.
Under IP in a World of Abundant Intelligence
Apply this pattern
Operating Theory · September 2026
AI resilience score
Test what remains scarce after a competitor gains better models, tools, and engineering capacity.
Under IP in a World of Abundant Intelligence
Test this theory
Design Pattern · September 2026
Adversarial design-around report
Give a capable future competitor the customer outcome and ask for credible routes around the proposed boundary.
Under IP in a World of Abundant Intelligence
Apply this pattern
Design Pattern · September 2026
Negative know-how ledger
Preserve failed approaches and the conditions that make them fail before the lesson leaves with a person or project.
Under IP in a World of Abundant Intelligence
Apply this pattern
Operating Theory · September 2026
Scarcity migration and half-life review
Review where scarcity sat, where it sits now, and which change will move it next.
Under IP in a World of Abundant Intelligence
Test this theory
Design Pattern · September 2026
Alpha to Rights decision memo
Match each scarce asset to the narrowest control that can protect and commercialize it.
Under From Product to Rights
Apply this pattern
Design Pattern · September 2026
Infringement observability review
Test whether important use can be observed and evidenced without assuming access to a competitor's private systems.
Under From Product to Rights
Apply this pattern
Design Pattern · September 2026
Commercial discovery and IP optionality checklist
Plan customer learning, demonstrations, and publication without casually surrendering useful options.
Under From Product to Rights
Apply this pattern
Design Pattern · September 2026
Invention provenance record
Keep a dated record of human insight, source material, AI assistance, experiments, decisions, and claimed contribution.
Under From Product to Rights
Apply this pattern
Design Pattern · September 2026
Alpha to Operate dependency and rights map
Map the rights owned and the rights still needed to build, sell, deploy, manufacture, distribute, or license a product wedge.
Under From Product to Rights
Apply this pattern
Design Pattern · September 2026
Open and closed architecture map
Decide which layers should be open, standardized, licensed, proprietary, secret, or patent protected.
Under From Product to Rights
Apply this pattern
Design Pattern · September 2026
Native Alpha reconstruction
Read a patent family backward to recover the insight, present scarcity, and possible modern use.
Under Patent to Alpha
Apply this pattern
Design Pattern · September 2026
Claim-to-product map
Translate a claim or technical principle into a current workflow, buyer, product wedge, and demand experiment.
Under Patent to Alpha
Apply this pattern
Operating Theory · September 2026
Founder-to-IP matching matrix
Test whether an operator's knowledge, access, data, rights, and timing make an underused asset more practical.
Under Patent to Alpha
Test this theory
Design Pattern · September 2026
Portfolio decision packet
Put rights, customer value, evidence, cost, observability, and the next commercial action in one review.
Under Patent to Alpha
Apply this pattern
Design Pattern · September 2026
Commercialization mode decision memo
Force competing cases for building, attaching, licensing, selling, holding, opening, or abandoning an asset.
Under Patent to Alpha
Apply this pattern
Design Pattern · September 2026
Care delivery readiness map
A review of patient, caregiver, clinician, site, supply, data, payment, and exception readiness before an intervention enters routine care.
Under Therapeutic Enablement
Apply this pattern
Design Pattern · September 2026
Failure mechanism map
Locate where a regulated intervention fails, what can be measured, and which party can change the binding condition.
Under Therapeutic Enablement
Apply this pattern
Operating Theory · September 2026
Treatment readiness index
Test whether a composite readiness measure can improve treatment timing or selection without hiding weak dimensions.
Under Therapeutic Enablement
Test this theory
Design Pattern · September 2026
Therapy orchestration record
Specify the measurements, transitions, timing, decisions, and exceptions in an adaptive treatment sequence.
Under Therapeutic Enablement
Apply this pattern
Design Pattern · September 2026
Health system condition map
List every independent condition that must hold for an intervention to reach repeatable use.
Under Market and System Conditioning
Apply this pattern
Design Pattern · September 2026
Hospital adoption engineering
Map the people, evidence, approvals, work, and support needed to move from sponsored pilot to routine institutional use.
Under Market and System Conditioning
Apply this pattern
Operating Theory · September 2026
Adoption latency score
Estimate the time from first evidence to first use, repeat use, and routine use without pretending institutional clocks disappear.
Under Market and System Conditioning
Test this theory
Design Pattern · September 2026
Risk bearer map
Show who carries clinical, product, data, implementation, cybersecurity, financial, operational, and reputational risk.
Under Market and System Conditioning
Apply this pattern
Design Pattern · September 2026
Care model decision package
Bring the hypothesis, evidence, economics, rights, uncertainty, failure case, and next decision into one reviewable record.
Under Evidence, Economics, and Rights
Apply this pattern
Design Pattern · September 2026
Evidence debt register
Make stale, weak, unsupported, single-source, and unresolved claims visible before they quietly drive decisions.
Under Evidence, Economics, and Rights
Apply this pattern
Design Pattern · September 2026
Cheapest next test
Reduce the most important uncertainty with the least time, money, access, and patient exposure reasonably required.
Under Evidence, Economics, and Rights
Apply this pattern
Operating Theory · September 2026
Evidence ladder
Rank evidence by the scarce real-world commitment it reflects, from public signal through replicated outcome.
Under Evidence, Economics, and Rights
Test this theory
Design Pattern · September 2026
Care delivery opportunity screen
Test whether patient access, workflow control, payment, outcomes, technology absorption, and learning support a care business.
Under Care Delivery as the Product
Apply this pattern
Design Pattern · September 2026
Technology absorption decision
Choose whether a care organization should build, buy, license, partner for, or consume a technical component.
Under Care Delivery as the Product
Apply this pattern
Operating Theory · September 2026
Outcome margin model
Test whether a redesigned care pathway can retain value created through lower cost, better outcomes, or changed risk.
Under Care Delivery as the Product
Test this theory
Design Pattern · September 2026
Public signal evidence ledger
Keep sourced observations separate from calculations, interpretations, AI inferences, hypotheses, and commercial claims.
Under Public Signal Intelligence
Apply this pattern
Design Pattern · September 2026
Public healthcare opportunity graph
Connect conditions, populations, spending, providers, evidence, products, payment, rights, pathways, and commercial activity.
Under Public Signal Intelligence
Apply this pattern
Design Pattern · September 2026
Cross-signal scorecard
Compare spending, science, translation, delivery, policy, rights, and commercial movement without hiding confidence.
Under Public Signal Intelligence
Apply this pattern
Design Pattern · September 2026
Evidence freshness register
Set the useful life, refresh schedule, and decision trigger for every public signal used in active research.
Under Public Signal Intelligence
Apply this pattern
Design Pattern · September 2026
Work Unit record
Describe one piece of work by its purpose, evidence, authority, risk, handoffs, and accepted outcome.
Under Labor as Code™
Apply this pattern
Design Pattern · September 2026
The worker contract
State what a worker may do, what evidence it must use, when a person reviews it, and how it fails safely.
Under Labor as Code™
Apply this pattern
Design Pattern · September 2026
Labor as code
Make work inspectable, assignable, testable, versioned, and governable before attempting broad automation.
Under Labor as Code™
Apply this pattern
Design Pattern · September 2026
Packet workers before execution workers
Start by preparing evidence for a person, then grant narrow action only after review data supports it.
Under Labor as Code™
Apply this pattern
Operating Theory · September 2026
The title trap
A role name hides the scope, authority, evidence, exceptions, and outcomes that determine whether work can move.
Under Unbundling Work, Credentials, and Liability
Test this theory
Design Pattern · September 2026
An AI credential
Represent trust as evidence about a narrow capability, approved sources, authority, incidents, and recertification.
Under Unbundling Work, Credentials, and Liability
Apply this pattern
Design Pattern · September 2026
Credential Exposure profile
Count where credentialed time, authority, supervision, and liability enter one accepted outcome.
Under Unbundling Work, Credentials, and Liability
Apply this pattern
Design Pattern · September 2026
Liability Decomposition map
Separate who creates, controls, authorizes, owns, transfers, and finances risk at each stage.
Under Unbundling Work, Credentials, and Liability
Apply this pattern
Design Pattern · September 2026
Work Origin and Incentive map
Find whether work serves the outcome or was created by a rule, incentive, boundary, or information failure.
Under Unbundling Work, Credentials, and Liability
Apply this pattern
Design Pattern · September 2026
Burden Payer and Burden Imposer matrix
Show who requires work, who performs it, who pays, who benefits, who waits, and who can change it.
Under Unbundling Work, Credentials, and Liability
Apply this pattern
Design Pattern · September 2026
Workforce Composition map
Assign work across people, AI, rules, software, systems, devices, services, and governance as one operation.
Under AI Workforce™, Native Alpha™, and Recomposition
Apply this pattern
Design Pattern · September 2026
Native Alpha Capability map
Find where a person's or organization's unusual capability materially changes an accepted outcome.
Under AI Workforce™, Native Alpha™, and Recomposition
Apply this pattern
Operating Theory · September 2026
Native Alpha density review for work
Test whether scarce capacity is moving toward work where unusual capability changes or compounds the result.
Under AI Workforce™, Native Alpha™, and Recomposition
Test this theory
Design Pattern · September 2026
Preserve, Amplify, Encode, or Reject
Choose how to handle a claimed differentiated capability after testing what makes it valuable.
Under AI Workforce™, Native Alpha™, and Recomposition
Apply this pattern
Design Pattern · September 2026
Transition and Cutover plan
Move from the current operation through shadow work and narrow authority while keeping rollback available.
Under AI Workforce™, Native Alpha™, and Recomposition
Apply this pattern
Design Pattern · September 2026
Capability Formation map
Identify which repeated work creates future judgment and replace that learning path before automation removes it.
Under AI Workforce™, Native Alpha™, and Recomposition
Apply this pattern
Design Pattern · September 2026
Patient and Caregiver Labor map
Count unpaid calls, forms, portals, travel, record gathering, repeated explanations, and home work around care.
Under AI Workforce™, Native Alpha™, and Recomposition
Apply this pattern
Design Pattern · September 2026
Operational truth
Trace an operational claim to independent evidence and distinguish intended, reported, recorded, inferred, observed, and verified state.
Under Operational Truth™, Risk, Liability, and Outcomes
Apply this pattern
Design Pattern · September 2026
Evidence Supply Chain
Keep every consequential operational claim connected to its source, custodian, transformations, and useful life.
Under Operational Truth™, Risk, Liability, and Outcomes
Apply this pattern
Design Pattern · September 2026
Outcomes acceptance testing
Test whether the intended real world result occurred within stated quality, safety, time, cost, and evidence limits.
Under Operational Truth™, Risk, Liability, and Outcomes
Apply this pattern
Design Pattern · September 2026
Authority progression and recertification
Increase authority only after evidence and reduce it automatically when material conditions change.
Under Operational Truth™, Risk, Liability, and Outcomes
Apply this pattern
Design Pattern · September 2026
Dependency and Common Mode Failure map
Show which workers share models, sources, policies, tools, identities, vendors, and people so one fault cannot spread unseen.
Under Operational Truth™, Risk, Liability, and Outcomes
Apply this pattern
Design Pattern · September 2026
Graceful Degradation plan
Define how consequential work continues or stops when AI, data, tools, identity, or outside services are unavailable or untrusted.
Under Operational Truth™, Risk, Liability, and Outcomes
Apply this pattern
Design Pattern · September 2026
Causal Evaluation plan
Choose enough comparison to tell whether a recomposed workflow caused the claimed change.
Under Operational Truth™, Risk, Liability, and Outcomes
Apply this pattern
Design Pattern · September 2026
Rights Provenance record for encoded work
Track ownership and permitted use of know how, data, worker contracts, prompts, tests, evidence, and operating records.
Under Operational Truth™, Risk, Liability, and Outcomes
Apply this pattern
Design Pattern · September 2026
Minimum viable company Eidolon
The smallest institutional reflection that changes AI output: what the company does, how it is organised, who decides, what it sells, and what it will not claim.
Under Eidolons: working digital reflections
Apply this pattern
Design Pattern · September 2026
The person and the role are two records
Keep a role specification and a person's Eidolon as separate linked objects so work is not written for an office as though it were a personality.
Under Eidolons: working digital reflections
Apply this pattern
Design Pattern · September 2026
The customer Eidolon and its limits
Enough reflection of an account that anyone can prepare before acting, bounded by confidentiality terms, privacy obligations, and contractual restrictions.
Under Eidolons: working digital reflections
Apply this pattern
Design Pattern · September 2026
The competitor Eidolon evidence line
Mark every competitor claim as observed, disclosed, reported, or inferred, so analysis built on it cannot quietly promote a guess.
Under Eidolons: working digital reflections
Apply this pattern
Operating Theory · September 2026
Staleness and expiry
Facts age at different speeds. Date them, give the fast ones a review interval, and treat an unreviewed reflection as an unknown rather than a truth.
Under Eidolons: working digital reflections
Test this theory
Design Pattern · September 2026
Permissions across linked Eidolons
When one reflection links to another, decide what a reader inherits, what it must request, and what it may never see.
Under Eidolons: working digital reflections
Apply this pattern
Operating Theory · September 2026
Fidelity under acceptance testing
Judge a reflection by the work it improves. Add one fact, rerun the task, and keep the fact only if the accepted outcome gets better.
Under Eidolons: working digital reflections
Test this theory
Design Pattern · Sep 10, 2026
Reimbursement-first device discovery
Find the reimbursed problem before designing anything. Coverage, coding, payment, and utilization are public, so whether anyone will pay is a research question with a documented answer, not a bet taken after two years of engineering.
Under Consumer tech for medical grade devices
Apply this pattern
Operating Theory · Sep 10, 2026
The commodity component assumption
Do not design bespoke electronics unless a commodity part is demonstrably inadequate for the claim being made. The burden of proof sits with the custom design, the same way Zero Neo puts it on new software.
Under Consumer tech for medical grade devices
Test this theory
Design Pattern · Sep 10, 2026
What is actually medically specialized
Separate component availability from medical performance. The part being cheap says nothing about calibration, accuracy, reliability, safety, cybersecurity, manufacturing controls, or evidence. Confusing the two is how consumer-grade thinking hurts patients.
Under Consumer tech for medical grade devices
Apply this pattern
Design Pattern · Sep 10, 2026
The phone is part of the device
Architectures where a smartphone or wearable is a component of the medical device, not a companion screen. It removes hardware and adds obligations, and the trade is only worth making with both sides written down.
Under Consumer tech for medical grade devices
Apply this pattern
Design Pattern · Sep 10, 2026
Regulatory execution as an AI workforce
The regulated development system, described as work rather than paperwork: research, drafting, traceability, orchestration, evidence management, and audit support, with qualified professionals holding every judgment and approval.
Under Consumer tech for medical grade devices
Apply this pattern
Operating Theory · Sep 10, 2026
Continuous traceability instead of reconstruction
The chain from clinical need to post-market observation should be current every day, not rebuilt in the weeks before a submission or an audit. Reconstruction is where the errors enter.
Under Consumer tech for medical grade devices
Test this theory
Operating Theory · Sep 10, 2026
Where the device thesis should be rejected
The rejection criteria, written before we get attached to anything. Novel materials, exotic sensing physics, sterile manufacturing, life-sustaining risk, and trial-scale evidence requirements all put a category outside this thesis.
Under Consumer tech for medical grade devices
Test this theory
Operating Theory · Sep 10, 2026
The Dashboard Is a Symptom
Tile walls, module sidebars and worklists are the visible residue of software that could not reason. Zero dashboard is not a visual preference; it is what an interface looks like once the ranking moves inside the system.
Under Zero Dashboard Experiences
Test this theory
Design Pattern · Sep 10, 2026
The Briefing as Home Screen
The home screen is a narrative of what changed since the last review: what the system handled, what failed, ranked developments, one intervention worth making, and an evidence link on every claim.
Under Zero Dashboard Experiences
Apply this pattern
Design Pattern · Sep 10, 2026
Decisions, Not Alerts
One ranked stream of judgment calls, each carrying a recommendation, calibrated confidence, reasoning, evidence, the policy in force, the downside if wrong, the alternatives considered, a deadline and the role required to authorize it.
Under Zero Dashboard Experiences
Apply this pattern
Design Pattern · Sep 10, 2026
Populations Without Tables
Clustered groups of patients and a conversational explorer replace the filter-and-sort grid. Patients are grouped by what they need operationally, and the grouping itself can be interrogated.
Under Zero Dashboard Experiences
Apply this pattern
Design Pattern · Sep 10, 2026
The Patient Story Replaces the Chart Page
A narrative generated around the question currently being asked, with timeline lanes that draw missing data as missing, and explicit reasoning about which care program actually fits.
Under Zero Dashboard Experiences
Apply this pattern
Design Pattern · Sep 10, 2026
Graduated Autonomy
Autonomy is granted per workflow across four levels, from observe to operate within policy, against measured shadow-mode agreement, with drift monitoring and a rollback path. A single global autonomy score is unsafe.
Under Zero Dashboard Experiences
Apply this pattern
Design Pattern · Sep 10, 2026
Evidence as the Product
A flight recorder for every recommendation and action: what happened, who initiated it, what data was used, which policy and model version were in force, what a human changed on review, and whether it was later judged helpful, neutral or harmful.
Under Zero Dashboard Experiences
Apply this pattern
Design Pattern · Sep 10, 2026
Simulation as an Operating Surface
Enrollment changes, staff departures, program shifts, cadence and threshold changes and autonomy increases are run against the operation before they are made, with assumptions, uncertainty and risks shown rather than a single number.
Under Zero Dashboard Experiences
Apply this pattern
Design Pattern · Sep 10, 2026
Month-End Is an Evidence Problem
Billing readiness presented exception-first: what is ready, what is blocked and why, what conflicts with policy, and what is documented but should not be billed. The system never asserts final eligibility and never submits a claim.
Under Zero Dashboard Experiences
Apply this pattern
Design Pattern · Sep 10, 2026
The Executive Narrative Without KPI Tiles
Leadership reporting written as prose that states the causal claim, with measures, believed drivers and confidence in support, and an explicit section on what remains unknown.
Under Zero Dashboard Experiences
Apply this pattern
Operating Theory · Sep 10, 2026
The Labor Curve
A rules-based operation has no mechanism to break the link between panel size and headcount. An AI-native one does, but the first two quarters of a migration cost more, not less, and the curve only bends where shadow-mode agreement supports widening autonomy.
Under Zero Dashboard Experiences
Test this theory
Design Pattern · Sep 10, 2026
Typed Utterances and Honest Uncertainty
Every statement the system makes carries a type: observation, inference, recommendation, automated action, human-approved action, unresolved uncertainty, or prohibited action. Missing data is rendered as missing, and standing constraints hold at every autonomy level.
Under Zero Dashboard Experiences
Apply this pattern
Operating Theory · Sep 10, 2026
Migrating Off an Incumbent
Import, reconcile, parallel run, readiness score. What cannot be reconciled is listed individually rather than rounded away, and shadow-mode disagreement clusters reveal where the operation is unready before anyone cuts over.
Under Zero Dashboard Experiences
Test this theory
Operating Theory · Sep 10, 2026
What This Line of Research Does Not Claim
No proven outcome improvement without a connected analytics warehouse; disagreement concentrating in recent medication changes; projections that remain projections. The limits stated plainly, in one place.
Under Zero Dashboard Experiences
Test this theory
Operating Theory · 2026-09-15
Unknown is red
If nobody can show that a control works, score it as failing. Amber and blank let an untested control sit quietly beside a tested one.
Under The dangers of security theatre
Test this theory
Operating Theory · 2026-09-15
The tool was purchased. Was it tested?
Procurement produces a deployment date. Nothing in the ordinary purchase process produces evidence that the tool changes an attack outcome in this environment.
Under The dangers of security theatre
Test this theory
Design Pattern · 2026-09-15
What a findings dashboard leaves out
Counting open findings measures the discovery process. It says nothing about detection speed, containment, or recovery, and it falls when scanning stops.
Under The dangers of security theatre
Apply this pattern
Design Pattern · 2026-09-15
Deletion is the sharpest privacy test
A verified end-to-end deletion exercises the data map, the vendor list, the backup policy, and the derived-data problem at once. Few organisations pass it on the first attempt.
Under The dangers of data privacy theatre
Apply this pattern
Operating Theory · 2026-09-15
Consent language without enforcement is a claim about intent
If withholding consent does not change what a system does with a record, the consent mechanism only keeps a record of the choice. It does not enforce it.
Under The dangers of data privacy theatre
Test this theory
Operating Theory · 2026-09-15
Backups are usually out of scope, and usually full of the data
Retention and deletion policies often exclude backups for practical reasons. The exclusion is defensible. Leaving it unstated in the notice is not.
Under The dangers of data privacy theatre
Test this theory
Operating Theory · 2026-09-15
The audit passed and the network was flat
Certification scope is negotiated. A clean report describes the environment that was examined against the controls that were selected, at the time of the examination.
Under Compliant Insecurity
Test this theory
Design Pattern · 2026-09-15
Keep evidence that can be reproduced
A screenshot is a claim about a moment. A stored query with provenance can be re-run by the reader, which changes what the evidence is worth.
Under Compliant Insecurity
Apply this pattern
Operating Theory · 2026-09-15
Requirements with no evidence source are more common than failed controls
When requirements are mapped to operational data sources, the largest category is usually requirements that no system can currently answer at all.
Under Compliant Insecurity
Test this theory
Design Pattern · 2026-09-15
Measure the time between each response step
Incident counts depend on how hard an organisation looks. Detection, containment, and recovery intervals can be generated on demand and compared over time.
Under Attack-and-recovery engineering
Apply this pattern
Operating Theory · 2026-09-15
Put the last demonstrated RTO beside the target
A recovery objective is a statement of intent written during planning. The useful number is the one produced by the last real restore, with the date attached.
Under Attack-and-recovery engineering
Test this theory
Operating Theory · 2026-09-15
Do not publish a resilience formula yet
People often ask for one weighted score. Publishing it before the measures are validated would give an untested formula the look of certainty.
Under Attack-and-recovery engineering
Test this theory
Design Pattern · 2026-09-15
Let machines watch; keep consequential decisions with people
Machines can watch systems and prepare evidence. People remain responsible for decisions that cannot be reversed.
Under AI-native defensive security
Apply this pattern
Operating Theory · 2026-09-15
Fluent output is not evidence
A generated security assessment reads better than a human one and is harder to doubt. Readability and correctness are unrelated properties.
Under AI-native defensive security
Test this theory
Operating Theory · 2026-09-15
Adversarial simulation may replace part of annual training
Generated, varied, current scenarios delivered continuously and measured behaviourally are a plausible substitute for a yearly module. Plausible is not proven.
Under AI-native defensive security
Test this theory
Design Pattern · 2026-09-15
Design out the memory dependency
For each control that depends on a person recalling guidance under pressure, look for a technical arrangement that makes the safe action the default or the only one.
Under Human error without human blame
Apply this pattern
Operating Theory · 2026-09-15
Phishing resistance belongs in the credential
Origin-bound, hardware-backed authentication removes a whole class of failure regardless of how convincing the message was. This is the clearest available example of design beating vigilance.
Under Human error without human blame
Test this theory
Operating Theory · 2026-09-15
The restore worked and took four days
A restore can return all the data and still come too late. Time, sequence, and hidden dependencies often cause the loss.
Under Recovery as a first-class discipline
Test this theory
Operating Theory · 2026-09-15
Credential reset at scale is required and almost never rehearsed
Serious intrusions usually end with rotating every credential, key, token, certificate, and service account. Most organisations have never attempted this even partially.
Under Recovery as a first-class discipline
Test this theory
Operating Theory · 2026-09-15
What happens if the vendor is the one compromised?
Third-party risk programs assess whether a vendor protects your data. They rarely assess the blast radius of the vendor's own access to your systems.
Under Vendor and supply-chain resilience
Test this theory
Design Pattern · 2026-09-15
Escalation paths decay quietly
Contacts leave, numbers change, portals replace phone trees, and contracts renew with different terms. An untested escalation path is an assumption with a date on it.
Under Vendor and supply-chain resilience
Apply this pattern
Design Pattern · 2026-09-15
Generate the policy from the enforced rule
Where a platform enforces a setting, produce the written policy from that configuration. Then the rule and the document cannot drift apart.
Under GRC engineering
Apply this pattern
Operating Theory · 2026-09-15
Governance runs short of time for judgment
When collecting and formatting evidence takes most GRC hours, little time remains for decisions. Automating the clerical work may give that time back.
Under GRC engineering
Test this theory