Briefings
Working briefings on APRA's AI expectations, CPS 230, and the engineering of governed AI — agentic systems included — written for the people who have to answer for them: CTOs, CROs and heads of risk. No hype, no vendor speak.
The first briefings are live; more are in preparation. Want one prioritised — or a private walkthrough applied to your estate? Ask us directly.
Operational-risk regulation in plain English: critical operations, tolerances, business continuity and the service providers you depend on. What APRA now expects you to evidence, and why going live was the start, not the finish.
When a bank, insurer or super fund relies on you for a critical operation, CPS 230 reaches your contract and your controls. What a material service provider has to evidence, the terms your agreement must carry, and how to stop the assurance step stalling your deals.
Vibe coding ships a prototype; it does not survive an audit. Its worst failures are silent. How agentic engineering, a real harness and binding verification gates turn probabilistic AI output into code you can evidence to a supervisor.
AI-first delivery is not giving every engineer a coding assistant. It is an operating model: humans set intent and constraints, AI produces the artefacts and the evidence, and binding gates decide what advances. How to run it across the whole lifecycle, under APRA supervision.
What the 30 April 2026 letter to industry actually requires: inventories, behaviour monitoring, lifecycle ownership, assurance. Translated from supervisory language into systems you have to build and run.
The amendments commence 1 July 2026. If an AI agent participates in a critical operation, what does operational-risk accountability look like in practice: ownership, controls, monitoring, response?
Shadow, Advisory, Controlled, Full autonomy: the methodology we use to let agents earn trust through evaluation gates, and the artefacts each gate leaves behind for your auditors.
Evidence assembly, draft narratives, recommended dispositions: the human makes every final call. Architecture notes from five years inside Tier-1 financial-crime risk systems.
Agents act, so they need identity, permissions and accountability like any other actor in your estate. What identity for non-human actors means and how to implement it without inventing a parallel IAM.
Most of what will be in these briefings, we'll happily walk through on a call — applied to your estate rather than the general case.
Before the supervision questions arrive
Thirty minutes with the founder: we built and led agentic AI to governed production inside a global Tier-1 bank, with 22+ years on Tier-1 banking platforms and five years inside financial-crime risk systems. We map where your AI plans stand against APRA’s expectations, and what the path to auditable production looks like. No pitch deck, no obligation.