Speakers: Stephen Sennett (V2 AI)
Track: Leadership
We spent three months rebuilding a regulated enterprise's development lifecycle around agents, then worked out how much of the governance we had added was doing real compliance work. Less than we assumed.
Across APRA's prudential standards, the ISM, SOC 2 and ISO 27001, the same four obligations recur: traceability, change management, testing proportionate to change, and independence between whoever makes a change and whoever approves it. Not one says how an engineer should get to a change.
A specification records what you intended, not what happened. The trace already exists — the session, the tool calls, the commit that carries them — and unlike a document, an auditor can re-run it.
I will show what we kept, what we tore out, and the thing nobody has solved: every separation-of-duties rule I can find governs "persons". An agent that implements and approves its own change breaches it today.
https://data.webdirections.org/ai-engineer-sydney/sessions.json#88aeb7c0-147a-4e6a-874c-6eff9efeeff2
Full text on webdirections.org
.