Privacy and data protection - helping business and teams with compliance ops. GDPR consulting - dm or connect via pinned contacts.
En la Unión Europea
Joined August 2023
- Tweets681
- Following62
- Followers19
- Likes339
Pinned Tweet
Process mapping & privacy advisory for compliance, for 'AI', for GDPR.
Email / [email protected]
SimpleX / smp10.simplex.im/a#aX_Syf7tJ…
1
586
Would make sense system and legal wise if customer facing systems have multiple roles and robust IAM (who can read/edit, confirm purchases or terminate customer relationship) per business case:
- user (human)
-- delegated AI #1 (via MCP)
-- delegated AI #2 (via 'computer control')
-- delegated human (power of attorney)
Each role has diff. account credentials, actions are logged, approval flow can be set up.
3
1
150
teapawt.net/ResilientCyber/status/…
Something in the lines of 'business requirements' for such set up
Agentic IAM is still one of the most pressing problems in our industry, and NIST just published their Design Tenets for Agent Identity Management Systems.
A few of the items that jumped out to me are distinct, cryptographically verifiable identities for agents that are separate from human users and service accounts, a clear chain of trust when agents act on behalf of users or organizations, least and zero standing privilege, and cryptographically signed mandate statements that define intended outcomes and constraints for agent actions.
In my opinion least and zero standing privilege is going to be the most elusive, as people and organizations lean into the utility of agents in the security vs. utility tradeoff.
It was hard enough for human users and in cloud, and it's going to be even harder to constrain autonomous agents that can drive business outcomes.
nist.gov/blogs/cybersecurity…
9
Awesome tools!
What if you utilize /statecharts x pele.run (by @kepano) to
a) explain your privacy policy to end-customer customer (well, actually to customer's 'AI' assistant)
b) validate code with /statechart skill in pstack by @poteto to identify where privacy rules or engineering principles might break
1
40
Future not so far was actually present day
teapawt.net/philwinkle/status/2116…
In a future not so far away, basically tomorrow, people can replace "You'll be hearing from my lawyer.." with "You'll be hearing from my bot!"
Right, @bot?
13
One common thing we noticed among the service provider layer of AI is that there's not much to troubleshoot on in case of errors.
To consider when outsourcing (time) critical tasks.
12
'Automated' use of services is one business case, but backoffice wise a big win from data accessiblity.
5
In a future not so far away, basically tomorrow, people can replace "You'll be hearing from my lawyer.." with "You'll be hearing from my bot!"
Right, @bot?
Covering critical processes has decent ROI for most companies regarding GDPR compliance.
Graph made with Pele by @kepano
5
Good and simple info from @vasuman.
These steps for help or become bottlenecks for GDPR or privacy compliance stuff:
".. And having one architecture layer underneath all of those AI agents."
This is tough/huge topic, but something the team can already consider before 'AI transition'.
"Deciding which decisions that the AI agent can make versus where you need human input, and making that decision based on both the risk and the cycle time to make the decision. The agent proposes, a person makes the call, and every action is reversible and traceable."
Classic legal/data protection team input for this, hardlimits, grayzones + governance.
"Running the AI agents in shadow mode, in live with your volumes, and comparing their output to the people doing the process now. And not paying out anything they produce until you're absolutely sure that the AI agents are doing what they're supposed to be doing."
Going 'live' to soon or with little testing will likely tangle up your resources for troubleshooting and stalls projects. Also raises incident and risk counters which lead to not accurate sentiment of the AI risks.
What has to go right for AI to actually show up as positive in your P&L:
- Having the right sponsors: someone from the C suite, with a budget that they can spend and, very importantly, the involvement of the owners of the processes that you're going to be automating. And, also, the early involvement of key stakeholders, like legal, information security, IT, and finance.
- Really understanding the as-is processes that you're going to be automating: this requires process mining of the systems of record, and an understanding of the detail of each process, who's involved, all of the variations, and the volumes and the cycle times.
- Understanding the baseline of the process and the metric that you're going to measure to understand how much value you're creating: are you looking at time saved, cost saved, revenue increased after spending the tokens, or risk reduced, and agreeing the key KPIs that you're going to measure.
- Re-engineering the processes, as you automate them. Usually, you'll end up with about five steps, of which four of them will be automated using AI. And use plain code wherever plain code works.
- Building AI agents that work with all of the systems that you've already got in place, like Salesforce, NetSuite, SAP, ServiceNow, Dynamics, et cetera, so that you don't have to move to a new system, or have people log into a new system. And having one architecture layer underneath all of those AI agents.
- Deciding which decisions that the AI agent can make versus where you need human input, and making that decision based on both the risk and the cycle time to make the decision. The agent proposes, a person makes the call, and every action is reversible and traceable.
- Running the AI agents in shadow mode, in live with your volumes, and comparing their output to the people doing the process now. And not paying out anything they produce until you're absolutely sure that the AI agents are doing what they're supposed to be doing.
- Identifying the 5% to 10% of your people who are already using AI, and getting them to be the AI ambassadors and evangelists, and then training all of your people on how they work with the AI agents, and explaining how their jobs will change.
- Having a plan for 7 months from now, where you own all of the AI agents that have been developed, all of the data, all of the evaluations, all of the logs, they're all in your cloud, and they're built to be agnostic to any particular AI model.
We do all of these at Varick. Partner with us below:
6
Compliance teams can do the same or support such approach, if you can get over or avoid corporate OCD 😉
A retired NASA engineer who had worked on the Space Shuttle program for 25 years was hired by SpaceX at age 62. He described the first week as the most disorienting experience of his professional life.
At NASA, a design change required 3 meetings, 2 committees, a review board, and 6 to 18 months of documentation. At SpaceX, his new supervisor said "if it works, build it. If it doesn't, change it by Friday."
He sat at his desk after the first day and called his wife. He told her he felt like a man who had been swimming with ankle weights for 25 years and someone just cut them off. He could move. He could decide. He could build something in the morning and test it in the afternoon. The constraint that he had accepted as the nature of aerospace engineering turned out to be the nature of bureaucracy.
Within 6 months he had contributed to more design iterations than he had completed in his last 5 years at NASA. Not because he was working harder. Because the time between having an idea and testing the idea collapsed from months to hours. The same brain. The same knowledge. A different operating system.
He described a specific moment where he proposed a modification to a Raptor engine component. At NASA, the proposal would have entered a queue. At SpaceX, the modification was machined by the end of the day and tested by the following morning. He watched his idea become a physical object in 18 hours. At NASA, 18 hours would not have been enough to schedule the first meeting to discuss whether to schedule a meeting.
He told an interviewer: "I didn't get smarter when I went to SpaceX. I got faster. The intelligence was always there. The system was in the way."
The difference between SpaceX and NASA is not talent. NASA has extraordinary talent. The difference is the time between a thought and a test. SpaceX compresses it. NASA elongates it. The same engineer produces 10x more at SpaceX than at NASA because the bottleneck was never the engineer. It was the meetings about the meetings about the work.
1
6
not per se documentation, but information kept when needed.
For example, instead of separate risk, governance etc, the relevant compliance output is at the same place of the business.. Sales team working on project, project doc is in Confluence or similar. Adding compliance stuff directly to that project where it's governed helps to keep it accessible and verifiable. Takes a lot of time and energy for someone to look for separate documents or file repos for compliance items.
5
Effective and actually quite nice to use for inhouse or external customer collaboration. Instead of slack/teams/email or 'meeting notes' on what needs changing>
html.fileverse.io/
Well done team @fileverse !
Risk/opportunity wise one should not expect much regulatory attention on IPFS privacy matters any time soon, unless seen as something where context of on/off ramps need to be 'controlled'.
Meaning you unlikely to be in the scope of specific recommenced guidelines (🇪🇺🇺🇸🌍), more likely some elements get targeted similar to VPN and E2E chat 'providers'
Good showcase of dynamics/architecture for team or company information sharing.
Underlying basics + toggle data privacy UI like fileverse.io
Perhaps more useful in the context of moving fast vs migrating legacy data and approach.
7
Good showcase of dynamics/architecture for team or company information sharing.
Underlying basics + toggle data privacy UI like fileverse.io
Perhaps more useful in the context of moving fast vs migrating legacy data and approach.
> be responsible for the company data protection compliance
> company has many public/shared email inbox and lists
>> create a rule: IF 'sender', 'to' OR 'cc' includes a domain belonging to state authority related to your compliance area, FW the email to your team's inbox / kanban etc.
>> can provide guidance/track and monitor potential issues before first response
4