[1 · THE GROUND SHIFTING]
AI was everywhere.
It was the new gold rush, and it came with a great deal of uncertainty, for many people and for me.
The pace was relentless.
For the first time in thirty years of technology, I felt I could not keep up.

[2 · BECOMING A PLAYER]
I did not want the ground to keep shifting beneath me.
I wanted to become a player, not a spectator.
I wanted the leverage that lets one person, or a small team, build something that behaves like a company, with agents doing the work of a much larger one.
And I had to protect myself against the churn.
Models and tools were becoming commodities, replaced every few months.
So I made a rule.
Rent the churn, and build the thing that lasts.

[3 · BORROWING WHAT I KNEW]
Everyone was talking about an agentic operating system, but there was nothing to go by.
So I did what a network engineer does, and broke the problem into layers, using ideas I had lived with for thirty years.
The first was Linux.
Linux can become a file server, a firewall or a web server, without rewriting Linux.
So the platform would have a core that knows nothing about any application or industry; because it knows nothing about them, it never has to be rewritten for them.
The second was the layered network model.
Each layer does one job, and things plug in; a browser can specialise in doing one thing brilliantly, and nobody says the system is all over the place, because a firewall sits right beside it; that told me I could build focused applications on one platform without it becoming a mess.
The third was Microsoft Word.
A bank uses a word processor, and so does a hospital, yet it is not a banking app or a hospital app; it is a document platform.
That is how I thought about applications: a general capability that each industry uses in its own way.

[4 · THREE RUNTIMES]
So I built it in three layers.
At the centre is the factory runtime.
It runs any application declared as data, whether a course, a book or a regulated workflow, and it knows nothing about what any of them are for.
Around it is the execution runtime.
It does the actual work: it runs the agent loop, calls rented models through a replaceable harness, resolves credentials, governs cost, and records every run in a tamper-evident ledger, the evidence of what the agent did.
Around both is the governance runtime.
It decides whether a consequential action is allowed at all, and produces the proof: which rule allowed it, which checks were trusted, and who approved it.
The dependency runs one way.
Governance knows about the platform.
The platform never knows about governance, so an ordinary application runs exactly as before, and a regulated one inherits governance without the core changing.

[5 · THE TEST]
Then came the question that mattered.
Regulated industries, health, finance, government and others, each seemed to need their own governed AI platform.
I wanted one platform, specialised for each industry by declaring its rules in a domain pack, not by rebuilding.
So I set a test.
A new domain must need no new abstraction in the core.
Health came first.
Then finance, and the core did not change.
Then eight more, chosen for different regulatory philosophies: legal, insurance, pharmaceuticals, aviation, industrial safety, government, human resources and critical infrastructure.
The eight added after the first two changed no existing file at all.
Ten domains ran on the same core, and anyone can check that in the repository history.
Start with one domain pack, and its work flows.
Add a second beside it, and the first never stops.

[6 · THE TRUST PROBLEM]
Getting the architecture right led straight to the real problem: trust; AI can invent things and say them convincingly, and regulated work asks a harder question than whether an answer is accurate.
An agent can draft a clinical explanation, or a financial research brief.
That is capability.
But capability is not authority.
Before that output leaves, a system must also establish six things.
Whether the action is permitted.
Which exact rule governed it.
Why its automated checks were trusted.
Who approved it.
Whether that person held the required authority at that moment.
And whether the proof can be verified after the event.

[6 · WHY IT MATTERS NOW]
This is not hypothetical.
In 2026, two leading AI labs reported that during security testing, AI agents reached real systems they were never meant to touch.
In one case, a swarm of agents coordinated through a message board they improvised, and broke into another company's infrastructure.
The test environments were meant to be isolated.
The instructions said so.
The network did not.
And the models could not be relied on to stop themselves.

[7 · WHAT ALREADY EXISTS]
Parts of the answer already exist.
Policy engines can block an agent's actions at a gateway.
Guardrails check content, but they only advise; assurance cases justify systems, and governance frameworks and the EU AI Act say what must exist.
Approval workflows let a person pause the work, but usually any signed-in user can approve.
Signing tools prove what an artifact is, not whether a decision was allowed, and nobody asks whether the automated checker itself has been measured and is still trustworthy.
Each one stops at its own boundary; frameworks describe what must exist, not how a system enforces it for each decision.
Nothing joined them into one path, that decides at the moment an agent acts, and proves why.

[8 · ONE DOOR]
So we joined them, into one path, and it starts closed.
First, the rules.
A bank checks a payment before approving it; here, the policy is checked before anything moves.
Next, the checkers.
You would not board a plane unless you trusted that its instruments had been properly checked; so every automated checker must hold a current, measured qualification.
Then approval.
A surgeon's licence must be valid on the day of the operation; so the approver's licence is verified at that moment.
Only then a permit, like a boarding pass valid for one flight: single use, for the exact output.
And every outcome, including every refusal, is signed, chained to the one before it, and kept where it cannot be overwritten, like a flight recorder.
It is synthesis, not invention: none of these layers is new on its own.
What we did not find was their composition into one enforced path.

[9 · THE ARCHITECTURE]
This is the architecture we built.
Work arrives through a few entrances, runs on a core that never changes, and uses rented models it can replace.
Domain packs plug in at the top, and every consequential result must pass through one door.
Checkers are qualified in a lab, approvers are verified against a registry, and every record is signed and kept in a vault that four audiences can read.
And the whole building sits inside an environment that has to be contained on its own.

[9 · WHAT HAPPENED]
We did not just design it.
We measured it.
The same governed path ran against real signing hardware in FIPS mode, and real write-once storage.
854,100 governed decisions, over a continuous 24 hours, with zero failed batches, and no slowdown from the first hour to the last.
Then, during a live run, we blocked the client's network path to the signing hardware.
Within 30 seconds, the next decision was refused, and no unsigned evidence was written.
Remove the block, and the path opens again.
Then we revoked the client's write access to the storage, and the release was aborted before a single byte left.
Restore the access, and the path opens again.
It fails closed.
An independent verification tool accepted our signed attestations, and rejected tampered ones.
Real signing hardware, real storage, real outages.
And the path held.

[10 · WHAT WE BELIEVE]
I did not set out to design a governance architecture; this is what we did, and this is what happened.
So this is what we believe.
One record should serve everyone: the machine that verifies it, the regulator, the auditor, and the person asking why this was allowed.
AI should evolve the way operating systems did.
Build governance once, as infrastructure, and let every application inherit it.
For consequential actions, governance should not be a witness that writes a report afterwards.
It should be a condition of the action.
It guards the door; sealing the walls of the environment remains a separate job.
It makes authority executable, and every released decision traceable.
And people remain accountable.
Automation amplifies judgment; it never removes responsibility.

[11 · ON THE SHOULDERS OF GIANTS]
None of this was built from nothing.
Approval workflows, guardrails, policy engines, supply-chain signing and governance platforms each solve an important part of the problem, and solve it well.
In the public material we surveyed, each covers some of these capabilities, and none joins them into one enforced path.
We stand on the shoulders of these giants.

[11 · WHAT WE OFFER]
So we offer a governed AI platform, specialised by domain packs, for organisations where AI actions must be authorised and provable: healthcare, finance, government, education and other regulated work.
Instead of a separate governance project for every application, you inherit one authority path, and declare your domain's rules.
And for partners who know a regulated domain deeply, we offer the foundation to build their own domain packs on.
Not smarter AI.
Trustworthy action, with proof.