I'm Kenneth, and I build things that matter.

Electricity sat around for decades before it showed up in ordinary houses. The generators worked fine. What took so long was everything wrapped around the generator, the fuses and the insulation and the grounding and eventually a written code, because the early wiring burned houses down and nobody was going to run current through the wall behind their kid's bed on a promise. The safety work is what actually put power in every home, and we mostly remember the people who built the dynamos.

AI is sitting in that same gap right now, and it is going to stay there until someone does the boring part.

We have handed these systems the same reach we give employees. They read email, open files, pull customer records, change and delete work, and they do all of it in seconds across systems that were never built to tell them no. Companies did this because they were genuinely afraid of being left behind, which is a rational thing to be afraid of, and the result is that most of them cannot tell you what AI is running inside their own walls, what it can touch, or whether they could stop it before it did something they can't take back.

I run OpsCompanion, where we build Standpipe. It sits on the device, shows you every AI tool running across your machines, and governs what each one is allowed to see, send, and do. It runs on your hardware instead of ours because I don't think you have contained anything if the containment belongs to a vendor. You have moved the problem to a landlord.

I put this argument up here on June 2nd in Go West, Nerd., and the part I still believe is that context is king, so the only sovereignty question worth asking is where your context lives and who owns the box the inference runs in. Two weeks later Google published Beyond Zero in ACM Queue, arguing that zero trust comes apart under AI agents and that authorization has to shrink all the way down to the individual action. Cloudflare followed in August with the Agent Access Model, arguing that enforcement belongs in the harness and the network and never in the prompt. Both are correct, and I was glad to read them, and both stop one step short, because if the thing doing the enforcing is rented then the boundary is rented too.

None of this is security for its own sake. A billion people are about to point real computational power at their money, their health, their marriages, and their kids, and they will have to hand it their entire context, because that is the only way any of it gets useful. They will not do that until the box is theirs, and honestly they should not. The fuse box is what made electricity domestic. Something has to play that role here or AI stays a thing that large companies rent and ordinary people are quietly harvested by.

Before this I did infrastructure at Cloudflare on R2, was an early engineer at Balto, advised startups around St. Louis, and did technical due diligence for VCs. I have been the one paged at 3am.

What I keep turning over is whether we get this layer built before the first genuinely catastrophic consumer-scale incident or after it. Everything I know about the last twenty years of software says after. I would like to be wrong, and Standpipe is my attempt at being wrong.

Find me on x (twitter), reddit, instagram, and LinkedIn. My DMs are open.