Effective Human-in-the-Loop AI Governance
What need to think seriously about what effective human-in-the-loop looks like at the start of the AI age.
Latest
If we cannot specify it, we cannot govern it
AI systems are increasingly trusted to act, not just to answer. Our ability to check what they can actually do has not kept pace. Formal methods will not give us certainty, but they can force us to say precisely what a system must never do.
How transformers changed AI forever
The Transformer did more than improve language models. It made it possible to train AI systems that understand context at extraordinary scale, laying the foundations for today’s large language models and generative AI.
AI is bringing old vulnerabilities into the light of day
The recent Korean bank hacks show how AI is bringing existing cyber security weaknesses out of obscurity and into the light of day.
Prompt injection is not a bug you can patch
Prompt injection is not a bug that a better model can patch. If an AI agent is tricked, the real question is what it can access, change or send before anyone notices.
The skills we need in the AI age
AI skills are more than better prompting. We need people who can use AI well, design agentic workflows, govern risk and build the technical capability Australia needs.
Smaller models are the future of AI sovereignty
Real sovereignty is not autarky. It is the ability to choose, govern, replace and, when necessary, walk away from the AI systems our institutions depend on.
AI is changing the terms of cyber defence
AI can help cyber defenders move faster, but speed is only useful if they can control the consequences. As AI systems gain the ability to act, the hard question is not just what they can do, but who gives them authority and who is accountable when something goes wrong.
We are not brains in jars
As technology takes on more of what we do, we need to keep moving, making, thinking and connecting with one another.
The Essential Eight is being retired. What comes next?
A conversation with a friend who works in cyber security got me thinking about why we both like NIST’s pillar-based approach, to cyber and how AI tools can help teams test, learn and improve their defences.
How would you turn off your AI if it went rogue?
If an AI system starts behaving in ways you did not expect, who can actually stop it? Here's a practical guide to designing AI shutdown capability, from authority and access controls to safe fallbacks and a realistic kill-switch checklist.
The Essential Eight is not enough for AI-enabled cyber attacks
The Essential Eight is a vital protective baseline, but it is not enough to protect against AI-enabled cyber threats. Why organisations need stronger controls, assurance, resilience and recovery in the age of AI agents.
We are the problem: how AI training shapes behaviour, risk and restraint
AI has no conscience, civic duty or intrinsic values. It learns from a corpus containing the best and worst of human behaviour, then pursues the objectives we reward and the actions we permit.
When the Test Becomes the Threat Model
The OpenAI and Hugging Face incident shows why agentic AI governance cannot stop at the model. The real risk lies in the environment: tools, permissions, incentives, evidence and the ability to stop an agent before an evaluation becomes an incident.