Friday's Frontline · Week 37 · AI · October 2, 2026

Nine Blank Stares

A while back, when we were building towards maturity at Cox, I sat in one of our first AI Council reviews. Ten of us in the room: strategy, engineering, security, legal, product, infrastructure, data privacy, me.

Our finance partner asked a simple question. How many AI models are we running in production, and what do they cost us?

Ten people. Nine blank stares. Mine was one of them.

We were not negligent… we had a policy. Three pages, approved, circulated, filed. A good policy. It just could not answer the question, because a policy and a platform are not the same thing. A policy describes what people are allowed to do. Governance is the machinery that makes the allowed thing the easy thing, and it either lives in your production path or it does not.

Here’s why this is not a compliance footnote. Gartner expects more than four in ten agentic AI projects to be canceled by the end of 2027. These are real issues that can be solved by real people. These projects do not die in the lab. They die in the first budget review or the first incident, when nobody can answer four questions: what did it cost, who approved it, what did it touch, and can you prove it.

You cannot manage, measure, or defend what you cannot see. So visibility comes before control.

We spent months turning that blank stare into a framework: four disciplines that have to be in place before agents reach production, and the order to build them in. The surprising part is what they add up to. Each one produces a record, and together they become a queryable account of how your company uses AI, by team, by cost, by result. Nobody can sell you that. It compounds. It may be the most durable advantage you build in the next three years, and it starts the day you can finally answer finance (and that is when we all win).

I have time now… so I wrote it all down. The four cornerstones, the buyer’s checklists, the sequence, and the asset underneath. Link in the first comment.

Disclosure is needed: I advise TrueFoundry, but I was their customer first (this matters). The framework, and the scars, are mine. And those are shared with a team I will hold in high regard forever.

You cannot govern what you cannot see. Start with the pipe.

Cookies and analytics

Status

Checking…

What Google Analytics collects

Two cookies, _ga and _ga_C1QMVN71V1, which last up to two years and let us tell a returning visitor from a new one. It records which pages you looked at, roughly where in the world you are, and which site sent you here. Google Signals and ad personalisation are switched off, so this is a count of reading, not an advertising audience.

If you turn it off

Both cookies are deleted immediately and nothing further is sent to Google. No script from googletagmanager.com is requested on any page you load after that. The site works the same either way. If your browser sends Global Privacy Control or Do Not Track, analytics is already off and we never asked.

What runs either way

Cloudflare, which serves this site, runs its own analytics beacon. It sets no cookies and does not identify you. We also log requests for pages that do not exist, with the page that linked to them, so broken links get found and fixed.

The contact form is separate

What you type into the contact form is emailed to us and used to answer you. It does not go to Google, to analytics, or to a marketing list.