Insights
Notes from the field
Infrequent writing on authorization, accessibility, and how intelligence work is actually delivered.
- WF-INS-2025-02 Security
A software bill of materials is a control, not paperwork
If you cannot list what you shipped, you cannot answer for it when a component is found vulnerable.
- WF-INS-2025-01 Delivery
Cutover is a control, not an event
Replatforming a public service is judged by what the public never noticed.
- WF-INS-2025-07 Security
Continuous authorization is a delivery practice
ATO is not a ceremony at the end of a project. It is the way environments, identities, and releases are operated.
- WF-INS-2025-06 Intelligence
Generated output does not ship without human review
Retrieval and models can accelerate operators. They cannot be the last control before a citizen or a commander sees a result.
- WF-INS-2025-05 Delivery
Report the result the program was accountable for
Vanity metrics survive a review. Operational results survive an audit.
- WF-INS-2025-03 Delivery
Accessibility is an authorization requirement
Section 508 and WCAG AA are not a late polish pass. They belong in the same gate as security and operations.
- WF-INS-2025-04 Security
Least privilege is a data question before it is a network one
Zero trust starts with what a person is allowed to see, not with where the packet came from.