Doctrine
Three documents, revised rather than replaced. Doctrine is what an institution writes when the boundary has moved and the rules have not caught up.
The documents
- From air gap to zero trustThe air gap was never really about separation. It was about there being nothing to reach. Connectivity did not have to cost you that; opening inbound ports did.
- Governing agentic systemsAn autonomous agent holding credentials is an access problem before it is a model problem. None of the major frameworks was written for this.
- Cloud spend is attack surfaceUnowned resources are unpatched resources. Cost management read as a control discipline rather than a procurement exercise.