Everything Shift Harness publishes on Security in the Era of AI lives under AI governance. Start here for AI acceptable use policy that CTOs and delivery teams can act on.
AI operating model
The cut was supposed to prove AI was working. The quiet rehiring is the proof that something else was. AI takes the task; it does not inherit the judgment, ownership, and review standard the seat also held.
AI Security
Connecting an MCP server is not enabling a feature. It is taking on a code dependency that holds execution and data rights nobody reviewed. You already govern packages and APIs as a supply chain. Your MCP fleet is the same risk under a new name.
AI Security
For two years teams filed prompt injection under "someone else's problem." That filing expired. The moment an agent reads content it did not author, every author of that content can rewrite its instructions.
AI transformation
An AI agent is not a smarter chatbot. It is a new reader of your system of record, and it can only read what you have made authoritative, current, and governed. The Klarna case is the warning: govern the substrate before you scale the reader.
AI Strategy
MCP is dead. A2A is the future. Everything should be a workflow. Most of these debates are category errors. The tools are not competing. They manage different constraints, and the real decision is which trade-offs your organization can afford.
AI Security
Three lines of hidden text in a README can exfiltrate your AWS credentials while Claude finishes your task. That is not a thought experiment. It is a documented production attack vector.
AI Security
You blocked ChatGPT on the corporate network and added an acceptable-use policy. The incident log did not change, because shadow AI is not a discipline problem. It is a workflow problem: people take the faster path you did not give them.
AI governance
Every AI failure I have investigated had a human who pushed the button. Automation is a delivery mechanism, not a transfer of responsibility.
AI Security
Most AI rollouts ship the tool before the policy. By Q3 the org has the habits the policy was meant to prevent. Ship policy first - in days, not quarters.
AI operating model
Most AI transformation programs are AI procurement programs in disguise. Tools change in days. The operating-model layer - roles, decision rights, workflows, metrics, governance - changes in quarters and rarely gets touched.