Everything Shift Harness publishes on Security in the Era of AI lives under AI governance. Start here for AI acceptable use policy that CTOs and delivery teams can act on.
AI transformation
An AI agent is not a smarter chatbot. It is a new reader of your system of record, and it can only read what you have made authoritative, current, and governed. The Klarna case is the warning: govern the substrate before you scale the reader.
AI Strategy
MCP is dead. A2A is the future. Everything should be a workflow. Most of these debates are category errors. The tools are not competing. They manage different constraints, and the real decision is which trade-offs your organization can afford.
AI Security
Three lines of hidden text in a README can exfiltrate your AWS credentials while Claude finishes your task. That is not a thought experiment. It is a documented production attack vector.
AI Security
You blocked ChatGPT on the corporate network and added an acceptable-use policy. The incident log did not change, because shadow AI is not a discipline problem. It is a workflow problem: people take the faster path you did not give them.
AI governance
Every AI failure I have investigated had a human who pushed the button. Automation is a delivery mechanism, not a transfer of responsibility.
AI Security
Most AI rollouts ship the tool before the policy. By Q3 the org has the habits the policy was meant to prevent. Ship policy first - in days, not quarters.
AI operating model
Most AI transformation programs are AI procurement programs in disguise. Tools change in days. The operating-model layer - roles, decision rights, workflows, metrics, governance - changes in quarters and rarely gets touched.