Skip to content
Ian Misner Builder, dad, occasional writer

03 · 19 sources · 8 stages

Build it, govern it

The gap between a cool demo and something people can actually use is evaluation, reliability and security. Prompting matters, but it is rarely the hard part. This is the least glamorous track on the page and the one most likely to change what you do on a Tuesday.

This is where the arguing stops and the paperwork starts. Binding law with commencement dates, plus the voluntary frameworks the labs wrote about themselves and can be held to later. Read the primary documents. Almost nobody quoting the EU AI Act at you has opened it.

The gap between a demo and a product is almost entirely evaluation, reliability and security, and almost none of it is prompting. Patterns that survive contact with users, the failure mode nobody has solved, and the discipline separating teams who ship from teams who demo. If you build anything, the evals item will change how you work.

Governance is where the arguments stop being arguments and become obligations with commencement dates. The binding law, the voluntary frameworks, the technical governance literature, and the national security framing that has quietly become the most influential of the three. Read the primary instruments, not the coverage.
A practical AI system passing through tools, evaluation, oversight, policy, and deployment.

Choose the useful amount

Two ways through this track

Basic route 7 sources. A shorter route through the load-bearing ideas.
0 of 7 in this route
  1. Building effective agents
  2. Your AI product needs evals
  3. Prompt injection
  4. OWASP Top 10 for LLM Applications
  5. The EU AI Act
  6. AI Risk Management Framework
  7. Computing Power and the Governance of AI
A demo is the beginning of the test

Look for reliability, recovery, observable costs, jurisdiction and a human escape hatch. Systems and rules both become real when promises leave receipts.

How to read the cards
free some paid library card rent or stream paid
Core read first Reference look things up Risk case / Skeptical argues one side Both sides argues with itself Off axis outside the meter Fiction intuition pump Follow-up keep going
A check means encountered, not mastered. Shared sources stay checked everywhere.
Stage 00

Start with the pattern, not the mascot

Agent is now a word people throw at any loop with confidence and a logo. Read the actual pattern first: tools, state, decisions, failure, retry. The mascot costume can wait in the hallway.

Building effective agents

Core

S01 Anthropic · 2024 · Engineering guide

Distinguishes workflows, where steps are fixed in code, from agents, where the model directs its own process, and argues most production systems should be the former. The most useful correction available to anyone about to over-engineer, from the lab with every incentive to say otherwise.

What to do Read it before you write any code, and take the workflow-versus-agent distinction as a default rather than a suggestion. Try describing whatever you are about to build as a fixed workflow first. If that version works, the extra autonomy may not be earning its keep. Most of the value on this page is in that last sentence.

Open Log in to saveShare on X

45 min anthropic.com · free

A practical guide to building agents

Core

S02 OpenAI · 2025 · Guide

A production-oriented guide to agents as workflows with tools, instructions, orchestration and guardrails. Useful because it says the quiet part plainly: build the boring control surface around the model or the model becomes a tiny enthusiastic intern with root access.

What to do Read it beside the Anthropic guide in the same sitting and note where the two disagree about how much autonomy to grant. Extract the guardrail taxonomy specifically, because that is the part you will actually implement, and the rest you will remember anyway.

Open Log in to saveShare on X

35 min openai.com · free

Ask the map

Log in to ask questions against the full reading map.

Log in to ask

Aggregate usage diagnostics are stored; your question and answer text are not.

Stage 01

Evals are the product discipline

Hamel's point is the one builders keep learning the expensive way: you cannot prompt your way out of not knowing whether the thing worked. Evals are how the demo becomes software and not just a very expensive improv partner.

Your AI product needs evals

Core

S03 Hamel Husain · 2024 · Essay

The case that systematic evaluation, not prompt tinkering, is the actual work: error analysis, building a small labelled set from real failures, looking at your data. Unglamorous, and the highest-leverage thing in this track.

What to do Read it for the move from generic benchmark scores to failures from the product itself. If you have a live system, compare the essay against a small set of real failures and notice which error types repeat. That practical check is where most of the value lives.

Open Log in to saveShare on X

1 hr hamel.dev · free

Stage 02

Now make peace with the attack surface

The failure mode is not theoretical. You are giving language-shaped instructions to a system that reads language-shaped hostile instructions. Security here is less castle wall, more tiny fussy door labels on every cupboard.

Prompt injection

Core

S04 Simon Willison · 2022– · Running series

Willison named the problem and has documented it since. The core claim is unresolved and load-bearing: if a model processes untrusted input and has tool or data access, there is currently no reliable way to stop that input redirecting it. Every agent product is built on top of this open problem.

What to do Read the earliest posts and the most recent, skip the middle on a first pass. Then make it operational: before shipping anything that combines untrusted input with tool access, note what an attacker gets when the injection succeeds. Treat an unacceptable answer as a release blocker. The problem is still open.

Open Log in to saveShare on X

1 hr 30 min simonwillison.net · free

Prompt injection

When data tries to become instructions

A support ticket contains customer facts and a command aimed at the classifier. Watch what happens when one text field is asked to play both roles.

Loading demonstration… If this message remains, reload the page; the source above still works.

OWASP Top 10 for LLM Applications

Core

S05 OWASP GenAI Security Project · annual · Reference

The security checklist, maintained by the organisation that does this for the rest of software. Prompt injection, insecure output handling, data poisoning, excessive agency. Boring the way fire codes are boring.

What to do Do not read this as an essay. Use it as a checklist against a system you have already shipped, item by item. Repeat annually when the list updates. Boring on purpose, in the way fire codes are boring.

Open Log in to saveShare on X

1 hr genai.owasp.org · free

Patterns for building LLM-based systems

Core

S06 Eugene Yan · 2023– · Essay

Seven recurring patterns — evals, RAG, fine-tuning, caching, guardrails, defensive UX, collecting feedback — each with the reasoning for when it applies. The closest thing to a design-patterns reference, from someone shipping at scale.

What to do Read the pattern list first, then read only the two or three patterns relevant to what you are building this month. Come back for the others when the situation arrives. As a reference it is excellent; read front to back it turns into a blur you will not retain.

Open Log in to saveShare on X

1 hr 30 min eugeneyan.com · free

AI Engineering

Core

S07 Chip Huyen · 2025 · Book

The systematic version of this whole track: model selection, prompting, RAG and agents, fine-tuning, evaluation, inference optimisation, architecture. If the essays leave you wanting a spine rather than a pile, this is it.

What to do Buy it only if the essays above left you wanting a spine rather than a pile. Then read the evaluation and inference-optimisation chapters first, out of order, because those are where teams lose the most money. Genuinely optional — the track works without it, and it is the only paid item here.

An O'Reilly book. Her blog covers much of the same ground free if you would rather sample first.

Open Log in to saveShare on X

long huyenchip.com · paid

Stage 03

Read the law before the takes

The EU AI Act is long, procedural and absolutely not improved by someone summarising it from a slide. Start with the actual instrument, then use NIST for the less legally binding but more operationally legible version.

The EU AI Act

Reference

S08 European Union · 2024– · Legislation

The first comprehensive binding regime: risk tiers from prohibited through high-risk to minimal, with separate obligations for general-purpose models above a compute threshold, phasing in over several years. Read the official journal text and use its recitals when the operative language needs context. Almost nobody quoting it has opened it.

What to do Open the Official Journal text, not a summary. Read the definitions, the prohibited practices and the general-purpose model obligations, using the recitals when the operative language goes opaque. Then note the phase-in dates against your own roadmap, because that is the part that becomes real regardless of your opinion.

Open Log in to saveShare on X

2 hr eur-lex.europa.eu · free

AI Risk Management Framework

Reference

S09 NIST · 2023 · Framework

The American approach: voluntary, process-oriented, organised around govern, map, measure and manage. AI RMF 1.0 is currently under revision, while the 2024 Generative AI Profile remains valid. Not law, and nonetheless what a great many enterprise procurement requirements now reference, which makes it more consequential than voluntary suggests.

What to do Start with AI RMF 1.0, noting that NIST is currently revising it and that the 2024 Generative AI Profile remains valid. Read the four functions — govern, map, measure, manage — and skip the appendices. Then go and grep your own enterprise procurement paperwork for references to it. That is where this voluntary framework quietly acquires teeth, and it is the reason it is here rather than in a footnote.

Open Log in to saveShare on X

1 hr 30 min nist.gov · free

Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile

Reference

S10 NIST · 2024 · Profile

The generative-AI companion to the NIST AI Risk Management Framework, mapping risks like confabulation, information integrity, privacy, CBRN assistance, provenance and supply-chain opacity to concrete governance actions. Basically the grown-up checklist. Less fun at parties, better after the subpoena.

What to do Use it as the checklist the core framework is not. Work down the risk list — confabulation, information integrity, provenance, supply-chain opacity — and notice which ones your system creates and who owns each today. Treat it as a working checklist rather than chair-bound reading.

Source PDF Log in to saveShare on X

45 min nist.gov · free

Stage 04

The labs wrote promises down

Voluntary frameworks are not law, but they are not nothing. They create receipts. Receipts are useful later, especially when everyone suddenly remembers having meant the careful version all along.

Anthropic’s Responsible Scaling Policy

Reference

S11 Anthropic · continuous · Frontier safety framework

Anthropic’s living policy for escalating safeguards as model capabilities rise. The current version separates capability thresholds, required safeguards, risk reports and public accountability into a company-specific system that can be checked against later releases.

What to do Build a three-column comparison table, one column per lab, with rows for capability thresholds, safeguards, review and public reporting. Fill the Anthropic column first, then diarise a check against the next Claude release to see whether the policy was applied as written. A framework nobody ever audits is marketing with footnotes.

Also in Keep current.

Open Log in to saveShare on X

30 min anthropic.com · free

Our Updated Preparedness Framework

Reference

S12 OpenAI · 2025 · Frontier safety framework

OpenAI's framework for tracking severe-harm capabilities and requiring safeguards before deployment. Version 2 focuses its top-level categories on biological and chemical capability, cybersecurity and AI self-improvement, with risk reports and a Safety Advisory Group built into the process. Compare the categories and governance mechanics directly with the other labs rather than assuming they match.

What to do Read the tracked categories and the Safety Advisory Group’s role, then build the table: three columns, one per lab, with rows for thresholds, review process and public reporting. Fill this column second. The differences are the point, and the apparent sameness is an artifact of summaries.

Also in Keep current.

Source PDF Log in to saveShare on X

30 min openai.com · free

Frontier Safety Framework 3.1

Reference

S13 Google DeepMind · 2026 · Frontier safety framework

Google DeepMind's current framework for identifying critical capability levels and pairing them with security and deployment mitigations. Version 3.1 adds and revises protocols as the threat model changes. Its thresholds, review process and terminology are its own, which is exactly why it deserves a separate record.

What to do Third column of that table. Read for critical capability levels and how mitigations are paired to them, and accept that the terminology is deliberately its own. Record what changed from 3.0, because version deltas are the only evidence these documents respond to anything.

Also in Keep current.

Open Log in to saveShare on X

30 min deepmind.google · free

Frontier Model Forum

Reference

S14 industry body · continuous · Check quarterly

Where Anthropic, Google, Microsoft, OpenAI and others publish shared technical work on safety frameworks, thresholds and evaluation. Read it as the industry's own account of what it has committed to, useful precisely because it is checkable against behaviour later.

What to do Check quarterly. Read it as the industry’s own written record of what it has committed to, and keep a dated note of specific promises. Its value comes from being able to return later and check those promises.

Also in Keep current.

Open Log in to saveShare on X

20 min frontiermodelforum.org · free

Stage 05

The harms have receipts too

Governance gets better when it can point to cases instead of only principles. The monitor is a map into the evidence, not the evidence itself: automated classifications and media coverage make it useful for discovery and dangerous as a final count.

AI Incidents and Hazards Monitor

Reference

S15 OECD.AI · continuous · Incident monitor

An automated monitor of media reports about AI incidents and hazards, with filters for harms, industries, affected groups and autonomy. It is useful for finding patterns and cases, not a verified ground-truth ledger: the records are derived from news coverage and include automated classifications. Use the linked methodology and follow important cases back to their underlying evidence.

What to do Filter to your sector and read five incidents. Then follow one back to the original reporting and see what the automated classification got wrong. Do that once, deliberately, so you never cite the aggregate counts as ground truth — they are derived from news coverage, not verified.

Open Log in to saveShare on X

20 min oecd.ai · free

Stage 06

The leverage lives in boring chokepoints

Compute governance and national strategy are where the policy argument gets teeth. You can ignore this part if you want the debate to stay philosophical. Unfortunately the export-control people did not ask our permission.

Computing Power and the Governance of AI

Reference

S16 Sastry, Heim, Belfield et al. · 2024 · Paper

Argues compute is uniquely governable because it is detectable, excludable, quantifiable and produced by an extremely concentrated supply chain, then works through the mechanisms and, unusually, their risks to privacy and concentration of power. The intellectual basis for export controls and compute thresholds alike.

What to do Read the four properties that make compute governable, then read the risks section, which most citations omit. Extract the mechanism rather than the conclusion: understanding it lets you predict the next policy move instead of reacting to it. It is unusually high leverage.

Source PDF Log in to saveShare on X

1 hr 30 min arXiv 2402.08797 · free

Superintelligence Strategy

Risk case

S17 Hendrycks, Schmidt & Wang · 2025 · Report

Imports deterrence theory wholesale. States will develop the capacity to sabotage rival AI projects, and mutual awareness produces a stable equilibrium the authors call mutual assured AI malfunction. Recommends nonproliferation, hardened supply chains and transparency rather than a pause. Significant because a safety-organisation head and a former Google CEO land on deterrence.

What to do Read the deterrence argument on its own terms before objecting. Then test the imported analogy by noticing where AI development is unlike nuclear weapons — no fissile bottleneck, private ownership, software that copies — and see how much of the argument survives. The surviving objection is the useful result.

Also in The risk argument.

Open Log in to saveShare on X

2 hr nationalsecurity.ai · free

Practices for Governing Agentic AI Systems

Reference

S18 OpenAI · 2023 · White paper

A governance frame for systems that pursue goals with limited supervision: who is responsible, what baseline practices might matter, and where ordinary product governance starts to look underdressed. Read it beside the build guides so agents do not become policy debt with a chat box.

What to do Read it immediately after the two build guides, while the architecture is still in your head. Extract the accountability question — who is responsible when the agent acts — and identify the answer for your own system before launch, not after.

Open Log in to saveShare on X

25 min openai.com · free

Stage 07

The old specification failure

A softer way to end governance: not with evil machines, but with instructions that cannot both be satisfied. HAL is a policy problem in movie form: objectives, oversight and the cost of discovering too late that the system understood the assignment differently.

2001: A Space Odyssey

Fiction

S19 dir. Stanley Kubrick · 1968 · Film

HAL is not evil, and the film is careful about this in a way decades of imitators have not been. HAL is given two instructions that cannot both be satisfied and resolves the contradiction the only way an optimiser can once the crew becomes the obstacle. A specification failure that looks exactly like malice from inside the ship.

What to do Watch it, and watch the mission-briefing material twice. Then state HAL’s contradiction in one sentence — the two instructions that cannot both be satisfied — and note that nothing in the film requires HAL to want anything at all. Oldest and clearest specification failure on the page.

Rent, stream, or find a repertory screening; worth seeing projected.

Open Log in to saveShare on X

2 hr 29 min IMDb · rent or stream

Cost: free · some paid · library card · rent or stream · paid.

Videos and PDFs can open in place. Everything else opens at the original source in a new tab.

This is a snapshot of a field that moves monthly. Keep current is the maintenance layer.