Insights
Longer essays on second-line thinking — applied AI governance, data governance, cyber risk, and regulated-business judgement, each drawn from work I have actually owned and built.
Most governance lives in documents nobody can execute. The shift that matters — and the one agentic AI now forces — is codifying policy so classification, retention, lineage, and access are enforced by the system at every layer, not asserted in a PDF.
Read articleI built the governance layer I would want to sign off on as a risk owner — deny-by-default guardrails, an append-only audit trail, and AI-security evals mapped to the OWASP LLM Top 10 and NIST AI-RMF — and put it on GitHub.
Read articleMost hospitality software leaves the hard part — governance — to spreadsheets and memory. Bord.Room treats tenant isolation, data governance, and a contemporaneous compliance record as architecture — now in pre-production with a single pilot tenant, on a build designed for secure multi-tenant operation from the start.
Read articleMost organisations don't have a data problem; they have a governance-of-data problem. At Auto & General I work the gap with requirements-led tooling selection, a working OpenMetadata POC, records control, and PMO discipline.
Read articleThere is a meaningful difference between advising on risk and carrying it. As the accountable Principal of a mortgage brokerage, I owned NCCP, Best Interests Duty, Privacy Act, and AML obligations under real consequences.
Read articleM&A sounds like a big-end-of-town discipline. At the SME scale you are the entire deal team, and every diligence gap is a personal liability. Acquiring Prova Pizzeria taught me cross-domain risk from the inside.
Read articleA security control framework is only as good as a senior leader's ability to act on it. At the Queensland Police Service, my work turned the ISM from a compliance document into a basis for IAM/PAM investment and procurement decisions.
Read article