Insights
Things we learned the expensive way, written down so the next team does not have to — 48 notes and counting.
Six weeks of screenshotting, chasing colleagues, and reconstructing what happened last March is not audit preparation. It is a data collection project run under a deadline.
Continue reading: Evidence needs a home before the audit, not during itAn audit log with an UPDATE statement anywhere near it is a report. The value comes entirely from the fact that nothing can be changed after the fact.
Continue reading: Append-only is what makes a trail a trailSOC 2, ISO 27001, and a customer security questionnaire ask for the same evidence in different words. Collecting it three times is how compliance eats a quarter.
Continue reading: Map controls once, report against many frameworksA remediation tracker where everything is open, unassigned, and undated is a list of things you have written down rather than a list of things being fixed.
Continue reading: Findings need an owner and a date, or they are just observationsSending a manager a list of forty permissions they do not understand produces a signature, not a review. The control passes and the access stays wrong.
Continue reading: Access reviews that are not rubber stampsTesting a control once a year tells you it worked on one day. What you want to know is whether it worked on all the other days.
Continue reading: Continuous monitoring beats the annual snapshotWithout a scored test set, every prompt change is judged by whether the last three examples looked better. That is not iteration, it is drift.
Continue reading: Write the evals before you write the promptAn agent running with the service account can do anything the service can. The blast radius of a bad tool call is then the whole system.
Continue reading: Give the agent its own credentials, scoped downWhen the answer is wrong, the instinct is to blame the model. Nine times out of ten the right passage was never in the context to begin with.
Continue reading: RAG fails at retrieval, not at generationAn agent that can call tools can call them forever. Without a hard budget, one malformed input becomes an overnight bill and a rate-limit ban.
Continue reading: Put a ceiling on the loop before you ship itEvery agent hands over to a person eventually. If that transition loses the context, the customer repeats themselves and the agent has cost you goodwill, not saved it.
Continue reading: Design the handoff before the happy pathA demo agent calls one API. A production agent needs scoped credentials, cost ceilings, an eval suite, and a person to escalate to. That scaffolding is most of the work.
Continue reading: The harness is the agentChecking availability and then writing the booking is two statements. Under concurrency that gap is where the double-booking lives.
Continue reading: Overbooking guards that actually holdPushing availability to the OTAs is the easy half. Knowing when your number and theirs disagree is the half that prevents walk-outs.
Continue reading: Channel sync that reconciles instead of driftingA guest bill is not a total. It is a set of postings with owners, and the moment two people pay for parts of one stay, a single amount column stops working.
Continue reading: Folios that split without a spreadsheetA room marked clean twenty minutes ago is not information. During checkout rush the front desk needs the state now, not the state at last refresh.
Continue reading: Housekeeping status is a real-time problem disguised as a CRUD screenStoring a price per room per night works until the first minimum-stay promotion, and then you are writing a rules engine in the pricing query.
Continue reading: Rate plans are rules, not rowsIf closing the day requires someone to be awake, click through a wizard, and hope nothing was mid-transaction, the close is not a process. It is a ritual.
Continue reading: The night audit should be boringAn agent that keeps talking after the caller starts speaking is not a slow agent. It is a rude one, and callers hang up on rude.
Continue reading: Barge-in is not a feature, it is table stakesDeciding the caller has finished speaking is a guess made in under a second. Guess early and you interrupt; guess late and the pause feels like a dropped line.
Continue reading: Endpointing decides how the agent feelsA speech pipeline validated on studio recordings meets narrowband, packet loss, and codec artefacts on the first real call.
Continue reading: Telephony audio is 8kHz and your model was not trained on itThe caller has already explained themselves once. If the human who picks up starts with "how can I help", the agent has cost you the call.
Continue reading: A transfer that loses context is worse than no agentCallers judge a phone agent in the first second. Model quality barely registers if the pause before it speaks is too long.
Continue reading: In voice AI, latency is the productVoice systems generate the most sensitive data you hold and the most useful debugging artefact you have. Those two facts are in tension and both are non-negotiable.
Continue reading: Recording, consent, and the transcript you will need laterA consent checkbox records that someone agreed to something once. It cannot tell you what they agreed to, for how long, or whether they have since changed their mind.
Continue reading: Consent is scoped, timed, and revocableWriting every record view to a table satisfies the requirement. Detecting the receptionist who looked up a celebrity requires something to actually look.
Continue reading: Access logs nobody reads are not a controlA note corrected in place destroys the record of what the clinician actually saw when they made the decision. That record is the point.
Continue reading: Clinical records are append-only, including the mistakesA booking needs a clinician, a room, equipment, and sometimes an interpreter — all free at once. Checking one and hoping is how double-bookings happen.
Continue reading: Clinic scheduling is a constraint problem wearing a calendarMost rejections are not clinical disputes. They are a missing field, a stale policy number, or a code that expired — all knowable before submission.
Continue reading: Claims fail on data you already hadPostcode, date of birth, and sex identify most people uniquely. Removing the obvious fields produces data that feels anonymous and is not.
Continue reading: De-identification is harder than dropping the name columnThe argument against it is always "we'll add it later". Later means a migration under load, with real money already wrong in production.
Continue reading: Use double-entry from day one, even for a prototypeEvery payment integration eventually double-charges someone. The fix is not better retry logic, it is making the second attempt provably free.
Continue reading: Idempotency keys are not an optimisationFloating point is fine for physics and wrong for currency. The bugs it causes are small, constant, and impossible to explain to an auditor.
Continue reading: Money belongs in integersIf finding out you disagree with the bank needs a spreadsheet and a bad afternoon, you have not finished building the payment system.
Continue reading: Reconciliation is a product feature, not a back-office choreProcessing a webhook inline means a provider retry, a deploy, or a slow query can silently cost you an event you cannot get back.
Continue reading: Webhooks need a log, not a handlerA verified flag cannot express "documents submitted, one rejected, awaiting re-upload, provisionally allowed to transact up to a limit".
Continue reading: KYC is a state machine, not a booleanA quantity column tells you what you think you have. A movement log tells you how you got there, which is the only thing that helps when it is wrong.
Continue reading: Stock is a ledger, not a numberThe moment two deliveries of the same SKU have different expiry dates, stock stops being one number per product and becomes one per batch.
Continue reading: Batch and expiry are not attributes of a productMulti-location is not a column. It is a different question — stock is no longer "how many" but "how many, where, and can it get there in time".
Continue reading: Adding a second warehouse changes every query you haveA scanner types faster than most forms can handle. If the round trip is 400ms, a picker scanning fifty items an hour is waiting twenty seconds for nothing.
Continue reading: Barcode scanning is a latency problem, not a hardware problemClosing the warehouse for two days once a year finds every error at the point it is oldest, least explainable, and least fixable.
Continue reading: Cycle counts beat the annual stocktakeSuppliers short-ship, back-order, and split deliveries. A PO that is either open or received cannot describe what actually arrived.
Continue reading: Purchase orders need partial receipts from day oneEvery student in the cohort loads the same page in the same ten minutes. Average traffic tells you nothing about the only moment that matters.
Continue reading: Results day is a load test you are not allowed to failA student moves classes in November. Every grade, attendance record, and report already written has to remember which group they were in at the time.
Continue reading: Cohorts are not just a group idA student's connection drops for forty seconds during a timed assessment. What your system does in those forty seconds decides whether the exam is defensible.
Continue reading: Online exams fail on the network, not the questionsA teacher changes one weighting in March. Every derived grade, predicted outcome, and progress flag downstream is now stale, and nothing tells anyone.
Continue reading: Gradebooks need a recalculation storyMost systems answer "can this teacher see this student". Safeguarding asks a harder question — who must never see this, and who must always be told.
Continue reading: Safeguarding changes your permission modelEvery school system syncs students, staff, and timetables from somewhere else. All of it changes at once, in the two weeks nobody is available to fix it.
Continue reading: LMS integrations break in AugustNext step
The posts are the free version. The engagement is the same reasoning applied to your codebase.
Replies within one working day