My Bookmarks & Notes for May 2026

Setting up new Herms Agent for a small team of 10. Email communication. Fully isolated and whitelisted. Using GPT 5.5 as model.

AI is not your friend

Jer Crane is the founder of PocketOS.

He is also someone who has no idea how LLMs work and should not be allowed near a production environment until he learns.

Instead of focusing on the (many) errors in judgment, I instead look at how basic AI governance would have prevented this comedy of errors.

My Bookmarks & Notes for April 2026

The words “Fireside Chat” are starting to cause panic attacks. Especialy when combined with “FedRAMP or CMMC”. CMMC in 2026.. still a nothingburger.

HOWTO: Teach users to correctly pick a Sensitivity Label

Teaching users how to correctly choose a sensitivity label is one of the most critical parts of any Microsoft Purview implementation.

The labels themselves may be technically configured correctly, but the deployment will still fail if users do not understand how to apply them. First impressions matter. The process needs to feel simple, predictable, and easy to explain, even when the underlying classification model is not always intuitive.

I have always used what I call the Sensitivity/Audience Rule.

3:00AM SOC2 is useless so now what?

It’s 3:00 AM and a client CIO is absolutely raging mad. I can almost feel little bits of spit hitting me through the monitor as she screams into her laptop (they now require face-to-face communications). Vendors are submitting vibe-coded reports that are so uniformly bad that you can easily identify Claude vs. ChatGPT down to the model version.

I know why I am on this call. Why are there 8 other people here?