Claude Code runs A/B tests on your workflow, and one variable turns them off
Claude Code runs A/B tests from a remote flag service that release notes never mention. How to see yours, switch them off, and why vendors should say so.
Read the post
Security, GRC & GenAI written from the field.
I'm Chad Norman. I've spent 15-plus years in IT, at startups, SMBs and enterprises, working across infosec, cyber, cloud architecture and, lately, GenAI. Along the way I collected 30-odd IT certifications; like diamonds, they're not all equally cut. This is where I write down what I've learnt, and what I think about it.
Hi, I'm Chad.
InfoSec · CloudSec · Threat hunter
From threat hunting to cloud security, with a habit of tinkering with GenAI and automation. The opinions here are my own.
Now
Writing here, building with GenAI and agents, and working out how to secure them.
- Security
- GRC
- GenAI
- POPIA
- LLM security
- Zero trust
- No tracking
- No cookies
- No pop-ups
- Just RSS
Latest writing
Fresh from the field
The newest posts, in date order.
Just-in-time access shrinks an agent's window, not its reach
Short-lived credentials limit how long an AI agent holds access, not what it can do. Put hard limits in code first, then shorten the tokens.
Read the post
Cloudflare's free plan is where your first project should live
This blog runs on Cloudflare's free plan for R0 a month. What a developer starting out gets there, what they still own, and where the deal stops.
Read the post
Hello world
A sample post that shows how posts render on this site. It will be replaced.
Read the post
Give your AI workflows the least autonomy that works
Autonomy is a permission you grant a model, not a feature it has. Five levels for AI workflows, and how to pick the lowest one each step can live with.
Read the post
Topics
Three things I write about
Notes
Notes from the desk
Short ones: things I learnt, links worth reading, quick takes.
Your coding agent can hold the lethal trifecta too
Simon Willison's lethal trifecta applies to the agent on your laptop. Three questions to ask before you add the next MCP server.
Follow along
No newsletter. No pop-ups. Just RSS.
Every post and note, in full, in the feed reader you already use. No email address and no tracking pixel.
- Postschadnorman.fyi
/rss.xml - Noteschadnorman.fyi
/notes/rss.xml