Risk Control

Failure should be boring Approval workflows are supposed to be boring. A client submits documents, a system checks the required conditions, and an approval either happens or does not happen. Boring is good. Boring means the process does not accidentally approve a case while also escalating it as problematic. The trouble begins when a workflow is written as a best-effort model of reality. Someone encodes the actions. Someone else adds an exception. A third person adds a shortcut because the quarterly dashboard prefers speed over philosophy. Eventually, a sequence exists that should not exist. It does not look like a bug when inspected locally. Each action seems defensible. The path as a whole is the problem. ...

Scale is easy to understand. Not easy to finance, of course. Nobody accidentally misplaces a GPU cluster behind the sofa. But conceptually, the industry has been comfortable with the story: more compute, more data, more parameters, more capability. Control is less photogenic. It does not fit neatly into a benchmark leaderboard. It does not produce the same executive sparkle as “our model is bigger.” It asks a colder question: when a model becomes capable enough to matter, can its behavior still be shaped under pressure, across adversarial prompts, repeated use, and operational constraints? ...

Thinking is not free. That sentence should not need explaining to anyone who has paid an inference bill, waited for a reasoning model to finish its theatrical inner monologue, or watched an AI agent spend half its budget trying to solve a task it was never going to solve. Reasoning models have become better at using more tokens. They have not automatically become better at knowing when more tokens have stopped helping. ...

A click looks harmless until it is not. In consumer software, a wrong click means opening the wrong tab, dismissing the wrong pop-up, or buying the wrong color of phone case. Annoying, perhaps. Civilization survives. In enterprise workflows, a wrong click can approve a payment, change a configuration, delete a record, or submit a compliance form with the confidence of a sleepwalker holding admin rights. ...