I govern AI, and I build it.
Most people writing about AI governance have never shipped an agent. Most people shipping agents can't tell you what happens to legal privilege when a model reads a confidential document. I work on both sides of that line — and the same principle runs through everything below:
The model proposes. Deterministic code decides.
A language model is allowed to interpret. It is not allowed to be the thing that authorises an action. Every project here is an argument for that boundary, built rather than asserted.
PARAPET — offline email security python detection program that detects phishing and prompt injection run on a local Gemma 4 QAT model that is small enough to sit on a mobile phone. This is useful for companies in high risk industries that require private model use due to confidential data. I designed the systems architecture to mitigate the risk of the prompt injection. The model sits between two AI-free deterministic gates; output is grammar-constrained using structured data to generate a fixed verdict acting as a classifier, inference is air-gapped, and every action is reversible. It structurally breaks the lethal trifecta — untrusted input, sensitive data, and outbound capability rather than relying on an LLM with too many scopes or permissions. Built with George Chung for GDG Cloud HK's Build with Gemma. MIT.
Agentic Kinetic — an agent for developing and tracking a personalized pK profile for critical medications. Tacrolimus, a drug taken daily that acts as an immunosupressant to prevent organ rejection is import but complications can arise and while the patient feels fine they can't tell if they are at risk of losing a transplanted kidney due to the drug's narrow therapeutic index. Too high a drug concentration leads to kidney damage, too low a concentration leads to organ rejection. The drug level is measured monthly via blood samples, but a lot of factors can impact drug levels daily. Agentic Kinetic re-fits a pharmacokinetic model to build blood testing timing for an individual patient based upon their inputs so their doctor can track their baseline medication, then once established the patient uses this customized pK profile to predict their daily levels and escalates to a clinician when a deterministic gate says the predicted interval crosses a boundary a clinician wrote. This is a unique application of agentic AI that solves a problem that data science can't solve due to a wide range of patient population factors including genetics, cytochrome P450 expression, food reducing absorption, anemia affecting measurement, patients that forget and skip doses, etc. This was developed as part of the AI Tinkerers OpenAI Hackathon Agents, Everywhere on 12 September 2026. All data synthetic.
Making AI Guardrails Understandable and Testable: A Framework Illustrated by a Simulated Bond Market — In order to advance AI safety research into shaping public policy, the development of technical controls needs to have a clear purpose, evidence, and limitations that are understandable for the people responsible for using and overseeing them. We propose a practical framework to connect a specific risk and realistic failure mechanism to a guardrail, an evaluation, and a decision that shows a duty of care. Our intention is to contribute a reusable method for researchers, enterprises, governments, and regulators to review the same safety solution at differing levels of technical detail. We develop an illustrative framework via a simplified bond-market simulation wherein dealer agents have different incentives and opportunities to communicate that may lead collusion to occur. Rather than focusing on what the agents say they are doing and trusting that, we focus on their messages, actions and decisions to determine to if detection methods can show where their behaviours show that we should not trust them. In the real world, multiple parameters must be considered to accurately model quantitative detection of collusion and some asset classes are far more complex. Collusion is not reflected directly via price only but in volume, bid-ask spread, and timing. We use the bond markets as they are complex to focus on key factors with simplification to focus on how guardrails can be built to monitor collusive intent, which must be distinguished from convergence on the same goal. We used AI-assisted trade validation and dataset preparation to run randomized simulations of 4 different scenarios to determine if we can detect the intent to collude. By giving the same records to two isolated LLM reviewers, that accept matching labels for testing and validation, we can identify unusual patterns that can be escalated to a Human-in-the-Loop reviewer. We also built a separate internal activation detector for future work to explore the option of using this novel evaluation method in open source models that enterprises may deploy in a private deployment. To ensure our detection method actually works, we used matched randomization to run our "collusion" example against a nearly identify "no collusion" example to isolate the differences we would like to detect in repeated episodes. We then used independent agents label the data without seeing each other's answers so that we could trust the labels. We reserved some test cases that were hidden until the end to check the method and validate it. We generate a detector that is useful in catching collusion at a rate that allows the people who need to use this (a compliance officer, internal auditor, regulator) can intervene to prevent harm and a person responsible for oversight (manager, external auditor, board director) can understand how it is used to identify and flag risks, without a data scientist standing over their shoulder. The method is particularly relevant or a wide range of guardrails in the real-world, where statutory laws and regulations already exist and firms may adopt a guardrail to prevent harm but have no meaningful method to actual detect if a guardrail may have been circumvented. For example, a guardrail may be employed to prevent discriminatory bias in a dataset, however agents may adapt their communication to employ stenography by using word choices that secretly bypass the guardrail. This paper offers a worked method to connect technical safety research to oversight decisions, that enterprises are already required to adopt.
AI Governance Training for Board Directors — an 8-week programme for directors, audit committees and compliance officers who have to govern AI without becoming technologists. Your organisation is already using AI. You're already liable.
Selected analysis:
- The Pentagon–OpenAI Deal: Why "Safety Stacks" Are a Fiduciary Risk for Every Board
- The NATO–OpenAI Trust Gap: Cloud Act & Fiduciary Risk for Board Directors
- Data Sovereignty & AI Privacy Kill Switches
More at aiboardcourse.com/insights.
AI, privilege and confidentiality across jurisdictions. What actually happens to legal privilege when confidential material is put into an AI system — and why the UK, US and Hong Kong do not give the same answer. The public conversation stops at the EU AI Act; the privilege question is where boards get hurt, and it is barely mapped outside the EU.
Board and advisory work on AI governance · speaking and writing on AI, privilege and data sovereignty · collaborators on agent infrastructure · hackathon teams.