Evidence Before Autonomy
AI can produce a business case, an audit report or a client advice pack in minutes. Whether that work deserves to be trusted is decided by the loop around it. This five-part series covers HTML as a review surface and the open-source Lavish project, why polish no longer signals quality and how to label claims, why comments are not approvals and how to keep a review record, what an AI audit should actually examine, and a neutral, layered reference architecture for secure enterprise AI. One fictional South African insurance broker carries the examples, and every figure is illustrative.
5 articles
- Part 1AI can produce the document. Who helps you review it?Generating a business case, architecture proposal or audit report now takes minutes. Reviewing it properly still takes a person, and the review loop is where most AI-assisted work quietly loses quality. Part 1 looks at HTML as a review surface, the open-source Lavish project, and the controls a better interface does not replace.11 min read
- Part 2A polished AI output can still be wrongAI has made polish free. A report with clean tables, confident headings and a tidy diagram now costs the same to produce as a rough one, which means polish no longer tells you anything about whether the content is true. Part 2 separates presentation quality from evidence quality and shows how to label claims so readers know what they may rely on.6 min read
- Part 3Comments are not approval: designing the review recordWhen AI produces drafts faster than people can review them, the review itself has to become a record: which version was looked at, what was challenged, who decided and on what basis. Part 3 separates comment threads from approvals, pins feedback to versions, and sets out the minimum review record worth keeping.6 min read
- Part 4What an AI audit should actually examineMany AI audits review the model and the policy document and stop there. The failures that reach customers usually start elsewhere: in retrieval sources, tool permissions, missing logs, silent vendor changes or approvals nobody reads. Part 4 sets out eleven areas an AI audit should examine, the evidence to request for each, and the gaps auditors most often find.6 min read
- Part 5A secure enterprise AI reference architecture, layer by layerMost enterprise AI security diagrams are either a vendor's product map or a single box labelled 'guardrails'. Part 5 sets out a neutral, layered reference architecture: channels, application, guardrails, gateway, registry and governed data, with identity, audit and human approval running across all of them, and follows one request through every control point.6 min read
Working through any of this in your own organisation?
These articles come out of delivery work rather than theory. If the problems in this series look familiar, a short scoping conversation is usually the quickest way to work out what is worth doing first.
Talk to CloudNala