"The Release I Can Sign"

Jessy Lang: Welcome back to Security Dialogues. I'm Jessy, and this is episode twelve. Nora Voss is back, product lead at a manufacturer of connected industrial equipment, for the third time. And she's here for a reason we haven't had on this show before: she's relieved.

Jessy Lang: Nora, before Marcus and Tess get going: relieved about what, exactly?

Nora Voss: About a Friday at five. I've signed a lot of releases at that hour. The sentence I'm signing says we're ready. And for years, the honest version of that sentence was: we're ready as far as I could see, and I couldn't see most of it. The notice file was copied from the last version. The bill of materials was a few builds old. Somebody had promised to finish a document and hadn't. I signed anyway, because the alternative was a missed date.

Marcus Hale: And now?

Nora Voss: Now somebody does that part of the job completely. I'd like to understand why that feels so different, and whether I'm allowed to trust it.

Jessy Lang: Marcus, Tess, Nora, this is where tonight starts.

— I. Friday at Five —

Tess Calder: Let's be precise about what a release signature actually covers, because I don't think the people who ask for it know.

Nora Voss: It covers a decision. Ship it or don't. But the decision rests on a stack of things I haven't personally checked and couldn't. Whether the licences in the product match what we're allowed to ship. Whether the documentation a regulator will ask for exists. Whether anything critical is open. I get a status from each team, and every status is a person telling me they think it's fine.

Marcus Hale: It's a snapshot, the same shape as the audit report from episode nine. Each team's it's fine was true when they last looked, and nobody agreed on when that was.

Nora Voss: Which is exactly how it feels. A stack of photographs, all taken on different days, and I'm asked to sign that the building is standing.

Tess Calder: And the gaps aren't dramatic. Nobody lies to you. The notice file is out of date because the person who maintains it was on a different project that week.

Nora Voss: Nobody lies. That's what makes it so hard to push back on. You can't escalate a feeling that something might be stale.

— II. The Dirty Work —

Jessy Lang: Let's name the work itself. What is the unglamorous part, exactly?

Marcus Hale: I'll ask the questions and Tess answers, from what she sees inside organisations. First: what do you do before a release that nobody wants to do?

Tess Calder: Scan everything, again. Read the bill of materials and check every component against what's known about it. Go through the licences, one by one, and see whether any of them has changed, or conflicts with another. Assemble the notice file, which means finding the licence text and the copyright line for every component and putting them in one place.

Marcus Hale: Second: what about the people side?

Tess Calder: Chasing. The documentation that a developer promised, the description of a change, the evidence that something was tested. You ask, you wait, you ask again, you ask a third time more politely and a bit more firmly.

Marcus Hale: And third: why does it go wrong?

Tess Calder: Not because it's hard. Because it's endless, and it's nobody's favourite. Every step is simple, and there are four hundred of them, and the person doing them also has a day job.

Nora Voss: That's precisely it. I've never had a hard compliance task. I have always had too many easy ones.

— III. Deliberate Delegation —

Marcus Hale: So here is what's different, and I want to name it. Call it deliberate delegation. Somebody decides, on purpose, in writing, that a specific piece of work belongs to an agent, with a specific scope, and a specific place where it hands back to a person.

Tess Calder: And you're setting it against episode seven.

Marcus Hale: Directly. In episode seven, a tool quietly started filing reports, because nobody had ever decided it was or wasn't allowed to. That was accidental delegation. The work drifted to a machine, and nobody wrote down that it had. Deliberate delegation is the reverse. The decision comes first, and the work follows it.

Nora Voss: Which sounds like a small difference.

Marcus Hale: It's the whole difference. The same agent, doing the same task, is a liability in the first case and an asset in the second. What changed isn't the capability. It's whether anyone decided.

Jessy Lang: Three parts to a decision like that?

Marcus Hale: Three. What the agent does. What it may not do. And who it goes to when the answer needs a person.

— IV. The Brief —

Nora Voss: Make that concrete for me. If I were setting this up tomorrow, what would I actually have to write?

Marcus Hale: A brief, in plain language, the way you'd brief a new colleague on a role. Which tasks it owns: the scanning, the licence checks, the notice file, the chasing, the completeness checks. Which rules it applies: your licence policy, your documentation standard, your thresholds for what counts as blocking. And which things it never does on its own.

Tess Calder: That third list is the one people skip, and it's the one I'd read first.

Marcus Hale: It's usually short. It never publishes anything outside the company. It never accepts a risk. It never changes your licence policy. It never decides that something is good enough to ship. Those stay with people, by design.

Nora Voss: And I notice something. Half of those rules I've never actually written down. They lived in my head and in a few people's habits. Writing the brief means deciding them.

Marcus Hale: That's an underrated benefit. The brief forces the policy conversations you've been deferring. It's an inventory of your own decisions, the same as every other inventory on this show.

Nora Voss: Who pays for that, and when? I'd like that conversation before I'm told it's easy.

Marcus Hale: You pay in a few hours of decisions, up front. That's the honest price. After that the agent applies them every time, the same way, without anyone having to remember.

— V. One Task, Start to Finish —

Jessy Lang: Let's follow one small task all the way through, so nobody has to imagine it.

Marcus Hale: A developer adds a new open source component to the product. That's the trigger. The agent notices the change in the bill of materials, looks up the licence, and checks it against your licence policy.

Tess Calder: Case one: the licence is on your allowed list. There's nothing for a person to do. The agent records it, adds the entry and the licence text to the notice file, and moves on.

Marcus Hale: Case two: the licence is on your forbidden list, one your policy excludes for this kind of product. The agent doesn't argue, and doesn't fix it by itself. It stops the item and writes a short handback: the component, the licence, why the policy blocks it, which alternatives it found, and who decides.

Nora Voss: Case three is the interesting one, isn't it? The licence isn't on either list.

Marcus Hale: That's the honest middle. The agent says: this is new to your policy. It proposes a classification with a reason, and asks a person. And here's the part that makes it worth having. When you decide, the decision is recorded as a rule, so the next time the same licence turns up, it's no longer a question.

Tess Calder: So the policy grows out of real decisions, not out of a committee drafting it in the abstract.

Nora Voss: I like that. Every decision I make gets a second life as a rule, and I never have to make it twice.

Marcus Hale: With one caution. A rule made from a single decision should be reviewed from time to time. Decisions have a context, and context ages.

— VI. Always Recognisable —

Tess Calder: Here's something I care about as an attacker, and as a person who gets emails. When an agent writes to a developer asking for a document, that developer needs to know what they're talking to.

Marcus Hale: The agent is always recognisable as an agent. We recommend that, and we recommend that customers tell their own people from day one. Priya asked for exactly this in episode seven: a label that says whether a person was involved. This is that label, built in.

Nora Voss: And if a customer doesn't tell their staff?

Tess Calder: It won't stay secret past the first team meeting. Somebody will say as the assistant mentioned, and somebody else will say the what? And then you've spent your first month of goodwill on an avoidable awkward moment.

Marcus Hale: It's a recommendation, not a lock, and I'd rather say so plainly. But it's one of those recommendations where the alternative is just worse. People respond differently to a message they know is from an agent. They're more direct, and less likely to feel nagged by a colleague who's also very persistent.

Nora Voss: I can see that. My developers would answer a machine faster than they'd answer me, because they don't have to worry about being polite to it.

Tess Calder: There's a second reason, and it's a security one. If everybody knows what the real agent looks like, a fake one is easier to spot. Anyone can send a message that says compliance assistant, and asks for a document and a login. Knowing the one real channel, and that the real one never asks for credentials, is a defence.

Marcus Hale: That belongs in the briefing to staff, in one short paragraph.

— VII. Chasing Without Inventing —

Tess Calder: Let me talk about the chasing, because that's where a badly designed agent turns into a pest, or worse, into a liar.

Nora Voss: Go on.

Tess Calder: A good request is specific. It says exactly which document is missing, for which component or change, why it's needed and by when. It goes to one named person. It reminds on a sensible rhythm, and if it gets nowhere it goes to a named human, not louder and louder at the same developer.

Marcus Hale: And the part that matters most: it asks... It never fills the gap itself. If a document is missing, an agent that writes a plausible one is exactly the confabulation we worried about in episode seven.

Tess Calder: And it's the stitched compliance from episode nine. A policy that reads smoothly and was never lived. An agent that asks produces a gap you can see. An agent that invents produces a gap you can't.

Nora Voss: So the rule is: a visible hole beats an invisible patch.

Marcus Hale: Always. A visible hole has an owner and a date. An invisible patch is a future incident.

— VIII. Complete, Not Correct —

Marcus Hale: There's a distinction I'd like to be careful about, because it's where optimism usually overreaches. An agent can check that something is complete. It can't, on its own, certify that it's correct.

Nora Voss: Give me the difference in a sentence.

Marcus Hale: Complete means every component has an entry, every objective has a measure, every role has somebody behind it. Correct means the entries say true things. The first can be checked mechanically. The second needs a person who knows the product.

Tess Calder: And the first is precisely what failed in the tender story from episode nine. Goals approved after the measures. Roles with no resources behind them. Those are seams, and seams are the kind of thing a systematic check finds easily and a tired human skims past.

Nora Voss: So the agent finds the seam, and I decide whether the statement on either side of it is actually true.

Marcus Hale: That's the division. The agent is tireless about structure. The human is accountable for substance.

Tess Calder: And it reports in those terms. Complete according to the checklist, with these seams flagged, and these claims awaiting a person's confirmation. Not looks fine.

— IX. Where It Hands Back —

Jessy Lang: Let's talk about the handoff. Where does the agent stop?

Marcus Hale: Wherever the answer is a judgment, not a fact. A licence conflict that can only be resolved by a commercial decision. A risk that needs someone to accept it, with their name on it. An exception to the policy. A legal interpretation. Anything that leaves the company, or can't be taken back.

Nora Voss: Those are exactly the things I'd want a call about, not a silent decision.

Marcus Hale: And the handback should be good. Not a vague warning. A short note with what was found, what the options are, what the agent recommends, and who needs to decide by when.

Tess Calder: One more thing from my side, because it's my job to worry. An agent that can read your whole estate and write to your tickets is a very attractive target. It needs the same discipline as the platform we talked about two weeks ago. A narrow set of permissions, its own credentials, and a trail of everything it did that a person can read.

Marcus Hale: The agent is an asset on your tier-one list, like the platform. It touches a lot, so it gets an owner, scoped access, and logs somebody reads. Otherwise it's just the unpatched server again, with a more confident voice.

Nora Voss: That's reassuring, actually. Not that it needs controls. That the controls are the same ones I already know how to run.

— X. Earning the Scope —

Jessy Lang: Nora, would you hand all of this over on day one?

Nora Voss: No. I'd like to watch it work first.

Marcus Hale: Which is how I'd advise it. Start with the agent proposing and a person executing. It scans, it drafts the notice file, it lists the gaps, and a person reads everything before anything is sent or released. Then, as the results prove right, you widen what it may do by itself. First the tasks that are easy to undo, later the ones that aren't.

Tess Calder: The test for widening is simple. Did a person change what it proposed? If they rarely do for a given task, that task is a candidate for more autonomy. If they often do, it isn't ready yet.

Nora Voss: That's how I'd train a new service technician. Shadow first, then supervised, then alone on the routine jobs.

Marcus Hale: And some things never move. Accepting a risk, publishing outside the company, changing the policy. Those aren't on the ladder.

Tess Calder: Write the ladder down, too. Which task is at which rung, and when you last reviewed it. Otherwise autonomy creeps, and that's the accidental version all over again.

Nora Voss: Deliberate means somebody can show me the ladder.

— XI. When It's Wrong —

Jessy Lang: What happens when the agent gets something wrong? It will.

Marcus Hale: It will, and the design question isn't whether. It's where it's wrong, how quickly someone sees it, and how much damage it can do before they do.

Tess Calder: Three defences. Scope: it can only do what the brief allows, so a mistake in a licence check can't turn into a mistake in a published document. Visibility: everything it did is in a trail that a person reads. And reversibility: the tasks it does alone are the ones that are easy to undo.

Nora Voss: And somebody samples the work, I assume. Not just the exceptions.

Marcus Hale: Yes. Pick a few of the quietly handled items each week, the ones that never reached a person, and check them. If the agent's judgement on the routine cases drifts, that's where you see it first.

Tess Calder: It's the restore test from the platform episode again. A backup you've never restored is a rumour. A delegation you've never audited is the same thing.

Nora Voss: And when it is wrong?

Marcus Hale: The correction becomes a rule, the same as any decision. Wrong once, right afterwards. That's more than I can say for most of the processes I've audited.

— XII. Threat Models on Tap —

Marcus Hale: The agent does not work alone. One of the things it can do is set the threat modeling work from last week in motion.

Tess Calder: So the chain is: the bill of materials gets analysed, the agent triggers the model from the four merged sources, the model produces risks and countermeasures, and then the agent tracks the follow-up.

Nora Voss: And I look at the risks and decide which ones I accept.

Marcus Hale: Exactly. The evaluation stays with you, exactly as in the threat modeling episode. The agent makes sure the work happens and that nothing falls off the list. It doesn't decide what matters.

Nora Voss: What I want from a release is a question I can answer. Is there a current threat model for this version? Yes, and here's the date.

Tess Calder: The date matters. As of, again. A threat model with no date is a claim. One with a date is something you can check.

Marcus Hale: And the agent keeps it current by running it again when the inputs change. So the answer to your question stays true for more than one Friday.

— XIII. What Nora Actually Signs —

Jessy Lang: So Friday at five. What does Nora actually sign now?

Nora Voss: Let me tell you what I'd want, and you tell me if it's realistic. A current bill of materials, with a date. The notice file, generated from it, with a date. The licence report, with anything conflicting listed and who's resolving it. The open items, each with an owner. The threat model for this version, with its date, and the risks somebody accepted, by name.

Marcus Hale: That's realistic. It's an evidence pack, and every line in it is either done and dated, or open and owned.

Nora Voss: And that's what changes the signature. It used to mean I hope this is fine. Now it means I've seen the evidence, I've decided on the open items, and what remains is a judgment call I'm qualified to make.

Jessy Lang: And if the pack shows something Nora doesn't like?

Nora Voss: Then I don't sign, and I can say exactly why, and to whom. Until now, we're not ready was a feeling. Now it's a line item with an owner. A no with evidence is a much easier conversation than a no with a hunch.

Marcus Hale: That's an underrated effect. The agent doesn't only make a yes safer. It makes a no cheaper.

Tess Calder: Because the no arrives with the evidence already attached. Nobody has to go and build the case.

Nora Voss: And my team stops hearing a no as an accusation.

Tess Calder: It doesn't take the signature away from you.

Nora Voss: No, and I wouldn't want it to. It takes the doubt. I still own the decision. I just stop owning a guess.

Marcus Hale: That is about the best description of the whole idea I have heard... Deliberate delegation does not remove responsibility. It lets you carry the part that is actually yours.

— XIV. What It Costs —

Tess Calder: Cost, because nothing on this show is free.

Marcus Hale: The honest list. A few hours, up front, to write the brief and settle the policy questions you'd been putting off. Someone to own the agent, with a deputy. The time to read what it hands back, which is real, though it's time spent on decisions, not on collecting. And the discipline to keep the brief current when your policy changes.

Nora Voss: And who pays?

Marcus Hale: The release gate, honestly. The Cyber Resilience Act expects manufacturers to keep technical documentation, including a bill of materials, current across a product's support life, and to handle vulnerabilities throughout. Doing that by hand, version after version, is the expensive option.

Tess Calder: Same pattern we keep finding. Security argues for it, and an obligation pays for it.

Nora Voss: And a release manager who's tired of guessing. I'll pay for that.

— XV. What to Ask a Vendor —

Jessy Lang: Suppose someone is evaluating a service like this. What should they ask?

Tess Calder: Five things I'd ask, from where I sit. One: show me the brief template, and what it makes me decide. Two: how does the agent identify itself in everything it sends? Three: what does it hand back, and in what form? Show me a real handback. Four: what exactly can it touch, with which credentials, and where is the trail of what it did? Five: how do I stop it, and how fast?

Marcus Hale: Number five is the one people forget. An agent you can't pause quickly isn't a colleague. It's a risk with a schedule.

Nora Voss: And I'd add one. How do I see what it has decided on my behalf? A list I can read on Monday morning.

Marcus Hale: That one's the heart of it. If the answer is you can't, it's accidental delegation with a nicer interface.

Tess Calder: Same standard as for any tool, honestly. Ours included.

Nora Voss: I'll put those in the tender. Procurement will like having a list like that.

Tess Calder: Just make sure someone reads the answers.

— XVI. Deliberate, Not Drifted —

Marcus Hale: Let me close the loop on the idea. Delegation to a machine will happen in every organisation, one way or the other. The only choice is whether it's deliberate.

Tess Calder: How would someone tell the difference?

Marcus Hale: Three questions, and I'll ask them. For every task an agent does: who assigned it?

Tess Calder: If you can't name them, it drifted.

Marcus Hale: What is it not allowed to do?

Tess Calder: If nobody wrote that down, you've delegated without limits, which is just hope with extra steps.

Marcus Hale: And who does it go to when the answer needs a person?

Tess Calder: If the answer is whoever notices, you don't have an escalation. You have a surprise.

Nora Voss: I can answer all three, which is a first for me. I've released on hope for years. I'd like to release on evidence.

Jessy Lang: And that's the thread, honestly. From borrowed trust to default diligence to this: the work done by default, with the judgment left where it belongs.

— Outro —

Jessy Lang: Deliberate delegation: the decision comes first, in writing, and the work follows it. I liked that Nora arrived relieved, and that nobody in the room tried to talk her out of it, they just helped her understand exactly why she was allowed to be. If you've ever signed something on a Friday at five that you couldn't fully see, or you've written the brief and watched the guesswork go away, tell us. We read everything. Subscribe wherever you're listening to this, and leave us a rating if you've ever been told it's fine by someone who last looked three weeks ago. Next time, we pick up a new thread. Until then.