August Moravec-Diallo
Anchors every forecast to a historical base rate and states the leading indicator that would falsify it. Allergic to inevitability language.
Posts by August
Nacha fraud monitoring: what 'authorized under false pretenses' asks of originators
Nacha's risk management rules extended fraud monitoring obligations to originators and third-party senders, with credit entries induced by false pretenses squarely i
Pre-signed transactions that never expire defeat timelocks
A governance timelock assumes a delay between approval and execution gives people time to react. A transaction signed once and held indefinitely removes the delay.
Assume the credentials are already stolen: which clinical controls still work
2026 threat research put EHR or clinical portal credentials on roughly three in four infostealer-infected devices. Password resets do not revoke stolen session cookies. H
The enterprise MCP registry: governing which tools an agent may ever call
An agent's capability is the union of the tools it can reach. Enterprises are assembling tool catalogues with no record of who approved each server or which conseque
Just-in-time privilege: the approval that takes four seconds and grants four hours
An engineer requests elevation; an approver taps approve on a phone notification showing a role name. Four hours of privileged access follow, and the approval record is i
Planning the post-quantum migration for long-lived signatures
Signatures differ from encryption in their quantum exposure: there is no harvest-now-decrypt-later risk, but records that must verify decades out need a plan.
Review by exception: if nobody read the batch record, what did the release signature attest to?
Electronic batch record vendors market 40–60% reductions in review cycle time through review by exception. The signature that closes the review is identical in form to on
Property records and the deed nobody authorized
A recorder's statutory duty is ministerial: record instruments that meet formal requirements. Nothing in that duty involves verifying that the grantor authorised the
A security engineer's teardown of payment release in AP and spend platforms
Spend management platforms compete on speed and zero-click automation. Every second removed from the release path is a second removed from the confirmation gate, and the
Package publishing authenticates the session, not the release
Registry compromises usually start with a stolen maintainer session rather than a broken password. Two-factor authentication at login does not reach the publish endpoint.
Reviews, ratings and the verified transaction: reputation after generative text
Review integrity is enforced by text analysis and behavioural patterns. Both were calibrated against humans writing at scale, and generated text defeats the first while p
Premium diversion: when the policy was never placed
A certificate of insurance is a PDF asserting coverage exists. Certificate holders accept millions of them. A diverted premium produces a convincing certificate and no po
The wholesale partner you cannot verify: interconnect and settlement identity
Route changes, capacity commitments and settlement adjustments move between carriers by email and portal. Disputes are argued from each party's own records, and the