Under the hood

I let an AI run my systems. The safety net is thirty years of boring discipline, not clever code.

There are about ten million articles telling you how somebody let an AI loose on their work. This is another one, so let me give you a reason to keep reading.

Written byBryan White
PublishedSeptember 2026
ReadAbout 5 minutes

Why listen to me

Not a hobbyist who watched a video at the weekend.

I spent thirty years in IT, at Epson, Virgin Atlantic, IBM and a few government departments. I am an ITIL Master, which is the dry art of not letting changes break things, and NEBOSH trained, which is the equally dry art of not letting people get hurt at work. These days I am a handyman in the Wairarapa who still quietly runs the web systems for a handful of small businesses.

I let an AI agent do most of the hands-on work now. It writes the code, runs the deploys, checks the backups. In months of this it has not taken anything down or leaked anything. Not because I found a clever trick, but because I pointed two extremely boring disciplines at it. And boring is exactly what you want looking after your business.

Treat it like a power tool

What a health and safety course does to the way you think.

You do not make a circular saw safe. You cannot. It is a spinning blade. What you do is build the system around it so that when it does what blades do, nobody loses a finger. Guards, training, the right stance, keeping your hand out of the line.

An AI agent is the same. It is fast, tireless and confident, and every so often it will be confidently wrong. You are not going to train that out of it, any more than you will talk a saw into being blunt. So you stop trying to make the tool trustworthy and you make the system around it safe instead. That one shift is most of the job.

The one rule, which is just change control

Anyone who has worked a service desk will recognise it straight away.

Nothing goes live without me signing it off. Not a typed "yes", not the AI deciding it feels sure. I approve the exact change with my fingerprint, on my own machine, and the system will only ever push the precise thing I approved.

The agent can build and test all day in a safe copy of everything. It cannot cross into the live systems on its own. It is a change record with an approver, the same as ITIL has drummed into IT for decades. The only difference is that the thing raising the change is an AI, and the approval is a thumbprint instead of a signature on a form.

Watch before you tighten

The other habit is patience.

I built the part that can slam the door on an unauthorised change, and then I deliberately left it propped open. For weeks it ran in watch mode, letting everything through but writing down what it would have stopped. When I read that log back, it was almost entirely me and my own routine work, not some intruder. If I had switched the door to locked on day one, the main person it would have locked out was me.

So you watch, you learn what normal looks like, and only then do you tighten. NEBOSH would call that monitoring the residual risk before you change the controls. My nan would have called it looking before you leap.

The honest part

The bits most of these articles leave out, because they are the ones that should earn your trust rather than your applause.

It is not perfect. Once, the agent pushed something to a live site the wrong way, outside the proper signed path. A genuine slip. It was caught, it was reversible, and it is the exact thing the sign-off rule is there to stop. But it happened, and anyone who tells you their setup never slips is either lucky or lying.

The door is still propped open, on purpose. The log tells me nothing bad is getting through, but I am honest enough to say that is down to discipline and being able to undo things, not the lock itself. I will turn the lock properly when the evidence says it will stop trouble rather than stop me.

And the biggest risk in the whole thing is not the AI. It is me. I am one person. If I go under a bus tomorrow, none of this runs itself yet. That is the job I am still working on, and if a safety course teaches you anything, it is to say the dangerous part out loud instead of hoping nobody notices.

Full disclosure while we are being honest: an AI helped me write this. Course it did. I then went through it taking the robot back out, which is the same job I do with everything it touches.

For the techies

No hand-waving. Here is what actually sits under the rule, honest edge cases included. Same care goes into anything I build for you.

signed‑release
Every change to a live site is a release I approve with a hardware-backed Secure Enclave key by Touch ID. The server verifies that signature over the exact bytes before it deploys, and the agent holds no signing key, so it cannot approve its own work.
two‑zones
The agent works freely in a sandbox and a full test mirror of every site. Production is read-only to it. The only path across is a signed release. Build and break in the playground, sign to go live.
policy‑broker
Every command the agent runs on a host passes a policy layer that classifies it and writes it to an append-only ledger. It runs in observe-only mode: it records what it would block without blocking, which is how you learn your own baseline before you ever enforce.
the‑near‑miss
A signed deploy hands an authorisation to that broker. It used to travel as a command-line argument, and a big change made the payload too long for the argument size limit, so the largest, most consequential releases silently skipped the check. It now streams over stdin instead. The lesson: a safety net is only as good as its own edge cases, and the dangerous ones hide in scale.
verify‑not‑trust
Nothing is "done" without evidence: the command output, the test that passed, the page loading. So far the real protection has been that discipline plus reversibility, backups and version control, more than the gate itself.
still‑observing
The enforcing switch is built and deliberately left off. The log says that flipping it today would mostly block routine, legitimate work rather than any intruder, so it stays in observe mode until the evidence says otherwise. Watched, reversible and disciplined is an honest place to sit.

Boring on purpose

None of this is groundbreaking, and I would be wary of anyone who told you their way of doing this was clever. It is old, proven discipline pointed at a new tool. If you run a small business and would rather your website, your bookings or your online orders were looked after by someone who treats them like a job site with a safety plan, not a hobby, that is what I do here.

Drop me a line