Builder note
Kognita 0.5.1 and 0.5.2: hardening released and documented
Kognita alpha 0.5.1 shipped the review hardening with a migration guide, and 0.5.2 documented every 0.5 feature in the README.
Read the noteBuilding
Alpha · active developmentI learn systems by building them.
This is where I share open-source work, technical experiments and implementation notes that test parts of the ideas I write about.
Open source
Kognita
Alpha · active developmentProve an AI answer was permitted, and evidence it.
Kognita explores one part of the enterprise decision-system problem: authorisation before retrieval, fail-closed controls and evidence about how an AI answer was produced.
Authorise first
Permission is checked before retrieval.
Fail closed
Unclear or missing permission stops the request.
Show evidence
Answers retain provenance and supporting evidence.
MIT licence
pip install kognitaDay job
Selected work
Some of what I've built in private banking. I can't share client data or numbers, so this is the what and the why.
Client-intelligence signals for relationship teams
RFM and lifetime-value scoring, so relationship managers know which clients to call first and why.
Predictive models for proactive client engagement
Models for churn, philanthropy and donor-advised-fund opportunities, and intergenerational wealth transfer, supporting earlier conversations with clients and their next generation.
Real-time alerts for the front office
Alerts that tell bankers about large client transactions as they happen.
Modernising analytics delivery
Set up CI/CD and DataOps for analytics, and turned around two data-engineering programmes that were in trouble.
Practical AI adoption at scale
Authored PINPOINT and BLUEPRINT and used them to train more than 2,000 colleagues in prompt engineering, agent design and responsible AI use.
Tools I work with: Python · SQL and PL/SQL · dbt · Dagster · Prefect · Spark, Hive and Hadoop · Snowflake · GCP and BigQuery · AWS · Streamlit · CI/CD and DataOps · LLM, RAG and agent tooling
Notes
Builder Notes
Builder note
Closing egress gaps in the AI gateway
Kognita alpha's gateway now redacts decoded JSON, screens every provider-read field and JSON key, forwards only known endpoints and refuses attachments it cannot inspect.
Read the noteBuilder note
Closing the library path: credentials and tier limits
Kognita alpha now requires a live workload credential on the library path and keeps tier 2 and above use cases gateway-only at runtime.
Read the noteBuilder note
Kognita 0.5: what shipped and what didn't
Kognita alpha 0.5.0 shipped agent identity, delegation, blast radius, taint isolation and containment, with a list of what was still open.
Read the noteBuilder note
A caller's classification is a floor, not an override
In Kognita alpha a caller-supplied classification header can raise sensitivity but never skip the content classifier.
Read the noteBuilder note
Screening what comes back from the model, not only what goes out
How Kognita alpha's AI gateway screens, re-decides and withholds model responses, and applies run controls before any provider call.
Read the noteBuilder note
Approvals bound to the exact request, and spent once
In Kognita alpha a human approval now binds to the exact request, is spent once, and re-checks credentials, sandbox and screening on release.
Read the noteBuilder note
Propose then apply, bound to the exact diff
Kognita alpha adds public propose_document and apply_proposal_tool, so an agent's change is proposed, approved by a different human and applied once.
Read the noteBuilder note
Resolving client scope once for every check
Kognita alpha now resolves the effective client scope of a call once, from subjects and mapped arguments, and uses it for authority, limits, anomaly and taint.
Read the noteBuilder note
Making sure taint cannot be laundered
Kognita alpha closed several routes where runless or nested calls dropped client-data taint, so sensitive content could not reach a public tool later.
Read the noteBuilder note
Detecting truncated evidence and replaying 0.5 decisions
Kognita alpha now detects truncated evidence exports and a missing head checkpoint, and replays 0.5 decisions including delegations and gateway checks.
Read the noteBuilder note
Atomic quota and anomaly counter admission
Kognita alpha now takes a write lock before reading quota, delegation budget and anomaly counters, so concurrent calls cannot exceed a limit.
Read the noteBuilder note
Stopping an agent mid-action and recovering cleanly
Kognita alpha now really aborts in-flight MCP calls, keeps uncertain actions pending, waits for them on recovery and keeps recovery retryable until compensation succeeds.
Read the noteBuilder note
The gateway holds the provider key, not the agent
In Kognita alpha the AI gateway now uses its own provider key, and an agent presenting a provider key directly is denied and flagged.
Read the noteBuilder note
Completing agent identity: model, deployment date and daily limits
Kognita alpha now denies agents with incomplete identity, pins the model into the deployment hash and adds daily transaction and product limits.
Read the noteBuilder note
Admitting system triggers without weakening governance
Kognita alpha admits system triggers only when the authenticated client configuration lists them, and keeps them alive across live polls.
Read the noteBuilder note
Making framework adapters carry identity safely
Kognita alpha's framework adapters now carry the agent credential and delegation, keep tool declarations and bind callbacks per call.
Read the noteBuilder note
A use-case register with an accountable owner for every decision
Kognita alpha 0.4 replaced the free-text purpose list with a versioned use-case register, so every decision names a registered use case and cites its accountable owner.
Read the noteBuilder note
A policy language with colocated scenario tests
Kognita alpha 0.4 added a YAML policy language that compiles to existing policy rows, and scenario tests that live next to the rules they test.
Read the noteBuilder note
Docling ingestion with per-section classification
Kognita alpha 0.4 ingests Markdown, HTML and DOCX into one knowledge item per section, classifies each section and cites the passage that matched.
Read the noteBuilder note
Recording why a client was chosen and what the RM changed
Kognita alpha 0.4 records the client interaction, the reasons behind an origination and the relationship manager's review, including rubber-stamp flags.
Read the noteBuilder note
Framework adapters for OpenAI Agents, LangGraph, Pydantic AI and Hermes
Kognita alpha 0.4 ships four small framework adapters that route tool calls through run_governed and model calls through the AI gateway.
Read the noteBuilder note
Outcome metrics, near misses and a risk-based review queue
Kognita alpha 0.4 computes cycle time, decision quality and reliability from the interaction record, and adds near misses and a review queue with coverage per use case.
Read the noteBuilder note
Governed client communication, live intervention and complaints
In Kognita alpha a client send is its own governed action, live runs can be paused or overridden, and a complaint links back to the exact output and approver.
Read the noteBuilder note
A flight recorder for AI runs, with optional OpenTelemetry
Kognita alpha 0.4 reads runs, decisions, citations and alerts from the evidence chain and exports a run as self-verifying JSON.
Read the noteBuilder note
Circuit breakers, revocation by dimension and kill-switch drills
Kognita alpha 0.4 trips a circuit breaker on registered thresholds, revokes by agent, model, provider, tool, client or use case, and records kill-switch drills.
Read the noteBuilder note
Starter policy packs and a private-banking pack
Kognita alpha 0.4 ships five starter packs and a private-banking pack, with user overlays and integrity pins.
Read the noteBuilder note
Keeping gateway latency flat as history grows
Kognita alpha bounded its gateway decision reads to rows in force, after closed history made overhead grow with every policy change.
Read the noteBuilder note
Hardening Kognita 0.4 after an external cross-review
What an independent cross-review of Kognita alpha found in identity, evidence integrity, replay and resume, and how each finding was fixed with a test.
Read the noteBuilder note
Shipping Kognita 0.4
Kognita alpha 0.4 shipped the use-case register, policy language, ingestion, adapters, flight recorder and policy packs.
Read the noteBuilder note
Agent identity, autonomy levels and per-verb permissions
Kognita alpha 0.5 gives every agent an identity, an autonomy level and per-verb permissions, with existing agents failing closed at level 0.
Read the noteBuilder note
Workload credentials so agents cannot spoof each other
Kognita alpha 0.5 issues, verifies and revokes hashed workload credentials for agents, and denies spoofed agent names at the gateway and MCP proxy.
Read the noteBuilder note
Delegated authority and the dual check
In Kognita alpha 0.5 every agent call needs a live delegation from a human who is entitled to the action, checked on both sides.
Read the noteBuilder note
Blast-radius limits, rate limits and field minimisation
Kognita alpha 0.5 enforces per-agent blast-radius limits, rate limits, tool allow-lists and purpose-specific field minimisation inside the decision.
Read the noteBuilder note
Taint, two lanes and instruction authenticity against prompt injection
Kognita alpha 0.5 labels runs that touch external content or client data, and stops tainted runs from writing or reaching public lanes.
Read the noteBuilder note
Behavioural anomaly detection and machine-speed containment
Kognita alpha 0.5 builds per-agent baselines and automatically contains an agent on volume spikes, privilege probing or unusual tool sequences.
Read the noteBuilder note
Agent-to-agent delegation and authority lineage
Kognita alpha 0.5 lets agents delegate only narrower authority, and kognita evidence authority traces any action back to its human source.
Read the noteBuilder note
Reversibility, stopping actions in flight and a threat model
Kognita alpha 0.5 declares whether tools are reversible, runs compensations on recovery, cancels in-flight MCP calls and publishes a threat model.
Read the noteBuilder note
Removing the graph engine to keep Kognita a control plane
Why I removed the Graphiti and Kuzu graph engine from Kognita alpha and narrowed it to policies, guidelines and governance records.
Read the noteBuilder note
Shipping Kognita 0.3: gateways, the run and replay
Kognita alpha 0.3.0 shipped the AI gateway, the MCP proxy, run budgets and replay, and the README was rewritten to describe only what was true.
Read the noteBuilder note
Closing Tier 0 defects, and ticking boxes only when the code agrees
How I closed the Kognita alpha Tier 0 defect list for 0.3: real fixes where needed, proof tests where the note had drifted, and one checkbox per pull request.
Read the noteBuilder note
Benchmarking AI gateway overhead under 50 ms
Kognita alpha measured its AI gateway overhead at a maximum of about 37 ms and a mean of about 9.5 ms per call, excluding classifier inference.
Read the noteBuilder note
Run budgets, and a human approval that actually withholds
In Kognita alpha, a HUMAN_APPROVAL outcome now returns nothing and retrieves nothing until a live grant exists, and runs carry call, token, cost and time budgets.
Read the noteBuilder note
The classifier labels the request. It doesn't make the call.
How Kognita alpha uses a text classifier to fill in classification for free text at the decision boundary, while keeping identity, purpose and the decision out of its reach.
Read the noteBuilder note
Building an OpenAI-compatible AI gateway that decides before it forwards
Kognita alpha's AI gateway sits in front of a model provider, decides before any byte is forwarded, redacts on egress and refuses when the evidence store cannot record the call.
Read the noteBuilder note
An MCP proxy where the backend is only contacted after release
Kognita alpha's MCP proxy turns every tool call into a governed envelope and contacts the backend server only after an allow or a live human approval.
Read the noteBuilder note
A governed agent demo you can run in seconds
The Kognita alpha flagship demo scaffolds a governed agent and runs four scenarios: an allowed query, a denied query, evidence tampering and gateway redaction.
Read the noteBuilder note
Pinned evidence, replay and erasure in Kognita
How Kognita alpha pins policy and content hashes so a decision can be replayed later, and how the retention store handles erasure without breaking the chain.
Read the noteBuilder note
Reconstructing one AI-assisted interaction from evidence
kognita evidence reconstruct answers the ten reconstruction-test questions for one interaction from the evidence chain, and reports what is not yet recorded.
Read the noteBuilder note
Per-use-case gateway failure modes without a forward-without-decision mode
Kognita alpha keeps fail closed as the default when the evidence store is down, and adds a narrow degraded mode per use case.
Read the noteBuilder note
Fail closed when the purpose list is missing
In Kognita alpha a missing or empty purpose list now denies every call, closing a Tier 0 defect where no list meant every purpose passed.
Read the noteBuilder note
Kognita roadmap: an AI gateway and supervisory examinability
Why I revised the Kognita alpha roadmap around an explicit AI gateway and a ten-question test a supervisor could use to reconstruct one AI-assisted client interaction.
Read the note