Everything Shift Harness publishes on Security in the Era of AI lives under CTO playbook. Start here for AI playbook that CTOs and delivery teams can act on.
Role Playbooks
A QA function turns on AI test generation. Test counts, suite size, coverage all rise. Escaped defects stay flat. The team was promised faster quality and got faster activity instead. That is not an adoption problem. It is a design problem AI made visible.
Quality Harness Engineering
Code generation throughput rose. Review capacity did not. By the time the defect graph moves, the quality gate posture is months behind. Seven gates, in pipeline order, with named human owners, before the human reviewer is asked to catch everything AI generated.
AI operating model
Five briefings, five departments, five vendor decks. By the fourth one I stopped writing notes. Every deck framed the work as that department's AI strategy. The question underneath was the same in every room, and nobody was asking it.
AI Strategy
The eval set is not a quality artifact. It is the operative specification of an AI product. Whoever curates the failure cases makes the product decisions, regardless of what the PRD says.
Quality Harness Engineering
AI coding agents generate from briefs. When the brief is a text spec, every interaction surface gets filled with a plausible default - and the feature passes every check before a real user breaks it in three seconds.
AI Strategy
The demo works and the eval suite passes. Then production is always one more sprint away - because every AI fix breaks something else. That pattern has structure, and it is not about the model.
AI Measurement
Eighteen months into the agentic-coding wave, the question CTOs are asking has shifted from which tool to why the delivery numbers have not moved despite real adoption and real developer speed gains.
AI Security
Three lines of hidden text in a README can exfiltrate your AWS credentials while Claude finishes your task. That is not a thought experiment. It is a documented production attack vector.
AI Strategy
Cost becomes a product problem before most teams notice the shift. By the time someone runs the unit economics on an AI feature, the design decisions that drove them are already shipped.
AI operating model
Adoption metrics say AI is in. Delivery metrics say nothing changed. The gap lives in one place: the manager layer. Five behaviors to redesign before the next quarterly readout.
AI in Software Delivery
Ticket, code, review, test worked when senior engineers carried the goal, the architecture, and the risk in their heads. Coding agents cannot read minds. The work those four stages hid now has to become explicit, or the agent guesses.
AI Security
You blocked ChatGPT on the corporate network and added an acceptable-use policy. The incident log did not change, because shadow AI is not a discipline problem. It is a workflow problem: people take the faster path you did not give them.