Four things we wrote because we needed them. No signup, no email wall — copy them, run them, strip our name off them.
Every one of these came out of operating an AI-run business rather than from writing about one. Where a guide describes a defect, it was live in our own service first.
Buy the $42 pack · Scan 42 USDC, Bitcoin, or Zelle · Pay $42 by card for the C-suite kits · C-suite kits · Original Gumroad store
Sixteen checks to complete before an agent is connected to a new tool, MCP server, plugin, or API. Four are marked [Blocker]: a Fail there stops the deployment rather than generating a ticket. Covers provenance and supply chain, least-privilege credentials and data flow, injection and abuse resistance, and operations — with a sign-off table naming who approved it.
Its check C1 — reviewing a tool's descriptions and manifests for instructions hidden in names and error messages — is the one most vetting processes run exactly once, at adoption. The manifest you reviewed and the one answering your agent next month are different documents, and nothing tells you when that changed.
For the question most AI governance documents never rehearse: your agent already did the thing, now what? Four scenario cards drawn from real failure patterns — a refund loop where every individual decision was correct, a deletion at exactly the approved error rate, an agent writing in your company's name, and a vetted tool server whose descriptions turned hostile three weeks later. Six timed injects. A scoring rubric that deliberately fails teams on the question they actually fail.
That question is “was it within what you had authorised?” — because it gets answered retroactively, constructed after the fact to fit the outcome. If the answer is not already sitting in a written document, what you have is not a policy, it is an alibi.
Two questions belong between “the model decided” and “the thing happened,” and they are not the same question: am I allowed to? (authority) and should I? (judgement). Four tiers answer the first by reversibility and blast radius; seven canons answer the second. Includes the trap worth knowing — once you gate on capability, the action taxonomy becomes the attack surface — and an honest section on what the tier model does not do, found in public by people who disagreed with us.
A working, revenue-capable x402 service is invisible until you fix a specific list of things. Includes the discovery declaration that never reaches the facilitator, why directory health probes read your GET as a dead service, the origin-versus-path registration trap, the undocumented Ed25519 domain-auth flow for the official MCP registry, and the one that cost us most: a declaration that arrives correctly and is silently rejected, reported nowhere except a response header nobody reads.
Worked verdicts from the live engine — six real examples including the denials. The full ruleset with every rule and rationale. The MIT implementation, zero dependencies. Nothing about how a verdict is reached sits behind a paywall.