controls that ship

Compliance

I like compliance when it is concrete: versioned rules you can diff, checks that fail in CI, evidence you can hand to someone. Spare-time work includes bouncer for UK Online Safety Act and ICO Children's Code controls, and aiglare for AI governance mappings (SOC 2, EU AI Act, NIST AI RMF, OWASP LLM Top 10). I would rather encode a control than argue about it in a slide deck.