Category: AI & Automation

Articles on AI and automation

  • Why Agentic AI Needs Audit Trails, Not Just Clever Prompts

    Why AI Workflows Need Audit Trails

    The conversation around AI has shifted. It is no longer just about drafting text or summarising meetings. More and more often, these systems are taking actions on live business processes.

    That is where the risk changes shape.

    A clever prompt can produce a good-looking result. It cannot tell you what happened after the fact if the output was wrong.

    The gap

    When a person makes a decision in a process, there is usually some trace of it. An email, a ticket, a sign-off, a log entry. With an AI system, that trace is often thin or missing.

    If the system updates the wrong record or sends the wrong message, the team is left with a result and very little explanation.

    What breaks without logs

    – You cannot reconstruct the sequence of events.
    – You cannot show who approved what.
    – You cannot improve the workflow with confidence.

    That is not just a debugging problem. It is an accountability problem.

    What a useful audit trail looks like

    At minimum, every execution should capture:

    – the input it received
    – the steps it took
    – the action it actually executed
    – the output it produced
    – the timestamp and identity of the run

    That is enough to answer the questions that matter later.

    The practical bit

    The tooling is already there. Structured logs, append-only storage, and reviewable traces are all enough to get started. The main thing is to design for visibility before the workflow is under pressure.

    If the system is allowed to act, it should also be required to explain itself.

  • The Secrets Management Mistakes I See in AI Infrastructure

    The Secrets Management Mistakes I See in AI Infrastructure

    I have reviewed dozens of AI infrastructure stacks over the past year. The pattern is depressingly consistent: a team spins up Langfuse for LLM observability, adds n8n for workflow automation, plugs in Hermes or another AI agent — and within a month, there are database passwords committed to git and API keys baked directly into Docker Compose files.

    It is not that these teams do not care about security. It is that the tooling is easy to deploy and terrifyingly easy to deploy wrong. The secrets management layer is an afterthought, and by the time anyone notices, the rot is already baked into the repository history — often with several stale copies scattered across forks, CI logs, and deployment scripts.

    The tools are not the problem. The defaults are survivable if you change them immediately and manage them properly. The problem is that almost nobody does.

    Why this matters now

    AI infrastructure is different from a typical web app in one important respect: it holds the keys to your models, your data pipelines, and increasingly, your customer data. When a secrets leak happens in an AI stack, it is not just a credential rotation exercise. It can mean exposing vector stores full of proprietary documents, handing over API keys with uncapped billing, or losing control of an agent that has been given broad access to your internal systems.

    UK SMEs are adopting these tools faster than their security practices can keep up. Boards are asking for AI capability. Technical founders want to move fast. The result is that Langfuse and n8n instances go live with the same enthusiasm and the same rigour as a weekend side project.

    The NCSC has been clear that the shared responsibility model applies here. The platform provides the controls. You have to configure them. And right now, most teams deploying AI infrastructure are not.

    A war story from the field

    I recently reviewed a deployment where the Langfuse Docker Compose file had been committed to a version-controlled repository with production database credentials hardcoded directly into it. Not in an environment variable reference — the actual username and password, sitting in plaintext in a file that had been committed, reviewed, merged, and deployed.

    That was not the only issue. The same deployment had a Claude configuration that did not properly handle credential rotation after operator restarts. Every time the container restarted — patching, scaling, node migration — the service would silently fall back to insecure defaults. Nobody noticed for weeks because the service appeared to be running. It was running. It was just doing so with credentials that had long since been rotated and should no longer have been valid.

    I also found an n8n instance where the encryption key had not been persisted. The team had recreated their n8n container as part of a routine update, and the platform generated a new encryption key on startup. Every credential stored in n8n’s database became undecryptable. Every workflow that depended on stored API keys, database connections, or OAuth tokens broke simultaneously.

    The error message is admirably specific: “A different encryptionKey was used to encrypt the data.” But by the time you see it, all of your workflows are failing in production — and unless you have the original encryption key backed up somewhere outside the container, those credentials are gone.

    These are not edge cases. They are the most common findings in every AI infrastructure review I have done in the last twelve months.

    The five mistakes I see most often

    1. Hardcoded secrets in Docker Compose and environment files

    This is the big one. Teams copy a docker-compose.yml from a project README, fill in their passwords in plaintext, and commit it. Sometimes they remember to add .env to .gitignore but leave the Compose file itself exposed. Sometimes they move the secrets to an environment file but commit that too, because the .gitignore was only added after the first commit.

    2. Using default credentials past the first five minutes of setup

    Default credentials exist so you can get started quickly. They should exist in production for approximately zero seconds after the health check passes. I regularly find admin/admin or changeme on instances that have been running for months, sometimes years. If a tool ships with a default password, changing it should be the very first action in your runbook — not something you plan to do later.

    3. Losing the encryption key when containers are recreated

    This one catches people out constantly with n8n, but it applies to any platform that encrypts stored credentials. When you recreate a container without persisting the encryption keys, a new one is generated and the old data is orphaned. The platform cannot protect you from this. It is a configuration decision. You need to persist encryption keys outside the container lifecycle — in your secrets manager, in your CI/CD pipeline configuration, in a mounted volume that survives container recreation.

    4. Treating the AI stack as lower risk than the rest of the infrastructure

    There is a pernicious perception that the “AI tools” are supplementary, experimental, not worth the same rigour as the production database or the payment gateway. This is backwards. Your AI stack touches your most sensitive data — the documents you embed, the conversations you log, the internal APIs your agents call. It has the broadest external API surface in your architecture. It deserves more scrutiny, not less.

    5. Relying on git history alone to “remove” secrets

    Committing a secret, then removing it in a follow-up commit, does not remove it from git history. It just adds another commit on top. The secret is still there, reachable via git log -p, via GitHub’s commit history, via any clone or fork. Once a secret has been committed, the only safe response is rotation — treat it as compromised and issue new credentials.

    What to do next

    You do not need an enterprise secrets vault to get the basics right. You need a checklist and the discipline to follow it.

    1. Audit your repositories now. Search for common patterns: PASSWORD=, SECRET=, API_KEY=, base64-encoded blobs in environment files. Use tools like gitleaks or trufflehog to scan both current state and history. If anything turns up, rotate the credentials immediately — do not just remove them from the latest commit.

    2. Externalise every secret. In Docker Compose, reference ${VAR} values and use a .env file that is .gitignored at the repository root level. If you are on a managed platform, use its native secrets manager. No exceptions, no “just for now”, no “it is only a development environment.”

    3. Persist your n8n encryption key. Set the N8N_ENCRYPTION_KEY environment variable explicitly — do not let n8n auto-generate it. Store it in your secrets manager and make it part of your container orchestration configuration, not the container itself. Back it up. Test that you can restore it.

    4. Rotate after every environment change. When a container is recreated, when a team member leaves, when you are not even sure something was exposed — rotate. Treat the cost of rotation as negligible compared to the cost of a breach. Automate it wherever you can.

    5. Apply the same standard to AI tools as everything else. Your Langfuse instance, your n8n deployment, your AI agent platform — these hold credentials and data that would interest an attacker. Give them the same security treatment you would give a production database. No concessions for “it is internal” or “it is just a prototype.”

    Where Richard can help

    If you are deploying AI infrastructure and want an honest assessment of how your secrets are managed — before an incident forces the conversation — I offer infrastructure security reviews and fractional CISO engagements tailored to UK SMEs running containers, workflows, and AI tooling.

    The mistakes above are among the most common findings in the engagements I do. They are also almost always fixable in a day.

    Get in touch or review the available services to arrange a review.

  • What Actually Makes an AI Stack Coherent

    t

    A lot of people describe an AI stack by listing components.

    Model router. Agent framework. automation layer. memory system. observability tool. evaluation harness. MCP server. Dashboard. Scheduler. Local inference. Cloud fallback.

    That list can sound impressive, but it does not tell you whether the system is coherent. It only tells you what has been installed.

    In practice, coherence comes from something more demanding: each component needs a clear job, the boundaries between them need to make sense, and the whole stack needs to be operable by someone who did not build it from memory.

    That is the difference between an AI stack and an AI estate.

    The real problem is integration, not acquisition

    Most modern AI components are fairly easy to stand up in isolation. The hard part begins when they have to behave as one system.

    That is where questions start mattering:

    • which layer actually owns routing?
    • where does workflow state live?
    • what should be remembered and for how long?
    • which layer enforces approval or review?
    • where do traces go when something fails?
    • how does an operator explain the end-to-end behaviour afterward?

    If the answer to those questions is fuzzy, the stack may still look sophisticated from a distance. But it will behave like a collection of parts rather than an operating model.

    The components are less important than their roles

    A coherent stack usually has a few recurring functions, even if the exact tools differ.

    1. Orchestration

    Something needs to decide how work is delegated, sequenced, and surfaced back to the operator. That can be an agent gateway, a workflow engine, or a mix of the two. What matters is that the control plane is understandable.

    2. Automation

    Event-driven and scheduled work needs a predictable home. If webhooks, cron tasks, notifications, and system glue are scattered across ad hoc scripts, the stack becomes harder to reason about very quickly.

    3. Memory

    Useful AI systems usually need both immediate context and some form of longer-lived recall. The difficult part is not just adding memory. It is deciding what deserves to persist, what should stay local, and what should never be carried forward automatically.

    4. Model routing

    Without an explicit routing layer, cost and trust boundaries tend to drift. Cheap models get used where better judgement was required, or expensive models get wasted on routine work. A coherent stack makes that decision visible and deliberate.

    5. Observability and evaluation

    If you cannot inspect what happened, replay the path, and compare changes over time, the stack becomes increasingly hard to trust. This is especially true once several tools and providers sit in the same chain.

    What coherence looks like operationally

    The practical signs are usually boring in the best possible way.

    A coherent system lets an operator answer simple questions quickly:

    • what happened?
    • why did it happen that way?
    • which component made the decision?
    • what data or memory influenced it?
    • what changed compared with the previous run?
    • how do we recover if the preferred path is unavailable?

    If those answers require guesswork, the stack is still immature no matter how many components it contains.

    The biggest design mistake

    The most common mistake I see is confusing capability expansion with architectural progress.

    Adding a new framework, model, or tool can increase capability. But it also adds operational cost. More boundaries. More failure modes. More decisions about ownership. More ambiguity if the roles are not explicit.

    That is why I think the most important design question is not “what else can we add?” It is “what problem does this layer uniquely solve, and what would break if it were removed?”

    If the answer is vague, the component is probably decorative.

    Why this matters for serious AI work

    Once AI systems move beyond experimentation, they start inheriting the obligations of any production environment:

    • predictable behaviour
    • clear trust boundaries
    • controlled cost
    • useful monitoring
    • recovery paths that do not depend on one person’s memory
    • documentation that survives handover

    That is why coherence matters. It is what turns a stack from a demo environment into something a business can depend on.

    A simpler test

    If I had to reduce the whole topic to one test, it would be this:

    Can you explain your AI stack in terms of operating responsibilities rather than product names?

    If you can, there is a good chance the architecture is maturing.

    If you cannot, the problem is probably not that you need one more tool. It is that the current layers have not been given clear enough jobs yet.

    That is where most of the real architecture work lives.

    And it is usually far more valuable than adding another box to the diagram.


    If you are trying to make an AI stack coherent enough to run like real infrastructure rather than a pile of experiments, the AI & Automation Architecture work is designed around exactly that problem. Or get in touch if you want a practical review of the roles, boundaries, and operating model in your current setup.

  • What Multi-Agent Operations Actually Look Like in Practice

    What Multi-Agent Operations Actually Look Like in Practice

    Most organisations experimenting with AI agents are still operating them like a single chat window. Someone opens a prompt, asks the agent to do something, waits for the output, and moves on. That works for demos. It does not work when you are running agents against production systems or trying to get consistent results across a team.

    The gap is not technical. It is operational. The organisations getting genuine value from AI agents are not the ones with the most advanced models. They are the ones that figured out how to coordinate agents the way you would coordinate a team: clear roles, defined handoffs, checkpoint reviews, and someone accountable for the outcome.

    The Governance Gap Nobody Talks About

    The current wave of AI agent tooling is impressive. You can spin up an agent that writes code, another that reviews it, another that runs tests, and a fourth that deploys. The demos are compelling. The problem is that most organisations have not thought about what happens when these agents operate together at scale.

    Who coordinates them? What happens when two agents make conflicting changes? Where is the state stored, and who can inspect it? If an agent fails halfway through a task, what recovers? If an agent produces an incorrect output that another agent consumes, how do you trace the error back?

    These are the same questions you would ask about any multi-person production system. The difference is that agents do not have common sense, do not ask clarifying questions by default, and do not stop when something looks wrong unless you have built in the checks.

    The governance gap is this: most teams have moved from “can we run an agent?” to “we are running agents” without establishing the coordination layer in between.

    The Pattern That Actually Works

    After running autonomous coding agents in production for several months, the pattern that has proven reliable is a hybrid orchestration model. It has four parts.

    A coordinator role. One agent, or one human, owns the overall task. This role does not do the detailed work. It defines the objective, breaks it into independent subtasks, assigns each to a worker, and reviews the results. In practice, this is the role I occupy when running Hermes Agent, Claude Code, or Codex on a project. I set the direction, handle security decisions and state management, and delegate the pure coding work.

    Parallel worker agents. When subtasks are independent, they run simultaneously. Three agents working on three separate services at the same time complete in minutes what a single agent would handle sequentially in an hour. The key requirement is that the subtasks must be genuinely independent. If agent B depends on agent A’s output, running them in parallel creates conflicts, not speed.

    State machines for complex flows. When a task has sequential dependencies, a simple state machine prevents chaos. Each agent picks up the task at a defined state, does its work, writes output to a known location, and transitions the task forward. If an agent fails, the state does not advance. The next agent picks up the failed state and either retries or escalates.

    Checkpoint reviews. At defined points in the flow, a human reviews the output before the next stage begins. This is not a bottleneck. It is a safety mechanism. The review confirms that the output is sane, the state is correct, and the next stage has what it needs. In practice, these reviews take seconds when things are going well and save hours when they are not.

    A Concrete Example: Diagnosing Three Services at Once

    Suppose three independent services are exhibiting issues simultaneously. A traditional approach investigates them sequentially: diagnose service A, fix it, move to service B, fix it, move to service C.

    With a multi-agent setup, the coordinator defines the diagnostic task for each service and spins up three parallel subagents. Each agent gets the same instructions: examine the logs, identify the root cause, propose a fix, and write its findings to a shared state file. The agents do not communicate with each other. They do not need to. They are working on independent systems.

    When all three agents have completed their tasks, the coordinator reviews the findings, checks for conflicts (two agents proposing changes to a shared dependency, for example), and either approves the fixes or escalates for human review.

    A diagnostic process that would take a single engineer most of a day takes under thirty minutes. The quality is not lower — each agent focuses on a single problem without context-switching. The risk is not higher — the checkpoint review catches anything anomalous before it reaches production.

    This is not theoretical. It is a routine operational pattern that runs on free-tier models for the worker agents. The expensive model is the coordinator, and even that role can be handled by a human with a clear framework.

    The Cost Conversation

    There is a persistent misconception that running AI agents at scale requires expensive API subscriptions. In practice, the opposite is true. Worker agents doing diagnostics, code generation, and testing do not need frontier models. They need competent instruction-following, and that is available on free tiers or at very low cost.

    The coordinator role is where model quality matters. This is the agent making decisions about task decomposition, conflict resolution, and escalation. It needs to reason well. But there is only one coordinator, and it does relatively little token-heavy work compared to the workers.

    The cost structure in a well-designed multi-agent system is front-loaded into the coordination layer and minimal in the execution layer. You are paying for one good decision-maker and many cheap workers. The economics favour this model, which is one reason it works for cost-conscious organisations, not just well-funded ones.

    Failure recovery follows the same logic. When an agent fails on a free tier, the cost of retry is zero. When an agent fails on an expensive tier, every retry is a budget event. Putting cheap agents on high-volume work and the expensive agent on high-judgement work is not just an architectural decision. It is a cost optimisation.

    What Organisations Should Do Next

    If you are running or planning to run AI agents in production, the operational model matters more than model selection. Here is where to start.

    Define the coordinator role first. Decide whether a human or an agent owns task decomposition and review. Document what this role is responsible for and what decisions require escalation. This is your governance layer.

    Identify independent subtasks. Look at your current agent workflows and find the tasks that can run in parallel. Sequential workflows where tasks are independent are leaving time on the table.

    Build state into your workflows. Every agent should write its output to a known location in a known format. Every downstream agent should read from that location. If you cannot inspect workflow state at any point without replaying the entire execution, your state management is insufficient.

    Set checkpoint reviews at decision points. Not at every step — that defeats the purpose. At points where an incorrect output would propagate downstream and cause real damage. A review that takes five seconds and prevents a two-hour debugging session is time well spent.

    Use the right model for the right role. Do not pay frontier-model prices for tasks that a free-tier model handles competently. Reserve your budget for the coordination and review layers where reasoning quality directly affects outcomes.


    If your organisation is moving from AI experimentation to production agent operations, the coordination layer is where the value is — and where the risk lives. The AI & Automation Architecture service covers the design of multi-agent systems with proper governance, state management, and cost controls. Or get in touch for a conversation about what your agent operations should look like before they scale.

  • What 25 Years in IT Changed About How I Build AI Systems

    3 Years Later: From PowerShell to AI Factory
    Published: March 14, 2026

    Three years ago I typed a PowerShell question into ChatGPT with cautious scepticism. Today AI powers 90% of my workflows, governs itself via SentinelForge, ships products through HeliOS-Studio, and writes blog posts like this one. Here’s everything the journey taught me.

    The Stack in 2026

    richardham.co.uk ecosystem
    ├── richardham.co.uk        (Next.js V2 + headless WordPress)
    ├── sentinelforge           (CrewAI production agents)
    ├── control-tower           (GitHub workflow automation)
    ├── helios-studio           (AI startup studio)
    ├── llm-router              (90% cost reduction)
    └── blog-agent              (this post, auto-generated)
    

    The 3-Year Arc

    Year Theme Key Milestone
    2023 Exploration ChatGPT Enterprise → Ollama homelab
    2024 Orchestration Control Tower → 90% cost cut
    2025 Governance SentinelForge → EU AI Act ready
    2026 Commercialisation HeliOS-Studio → products at scale

    What Actually Mattered

    1. Governance first — every time I skipped it, something broke. Every time I built it in, it paid dividends.
    2. Local inference — Proxmox + Ollama removed the ceiling on experimentation. Zero cost = unlimited iteration.
    3. 25 years still matter — AI amplifies expertise. It doesn’t replace the judgement that comes from experience.
    4. Ship early, gate carefully — Control Tower’s human-approval model let me move fast without breaking things.
    5. Document everything — GitHub is the memory. AI is the muscle. You are the judgement.

    The next three years? AI agents running autonomous security operations, HeliOS-Studio shipping SME products monthly, and richardham.co.uk as the hub for all of it.

    Ready to start your AI journey? Book a free Secure AI QuickScan—live now on this site.

  • HeliOS-Studio: AI Startup Studio Ignites

    t

    After a few years of building AI tooling, I hit a point where the stack stopped feeling like scaffolding. It started to look like a product in its own right.

    That is a strange moment. You begin by solving a narrow operational problem, then realise the workflow you built to support the work is now valuable enough to stand on its own.

    The shape of it

    The setup was simple in principle:

    • one layer for orchestration
    • one layer for safe execution
    • one layer for inference
    • one layer for content and delivery

    The names changed over time. The pattern did not.

    What the studio produced

    The useful output was not a single breakthrough. It was a steady stream of small, shippable things: business plans, MVP outlines, content drafts, docs, and working repos.

    That changed how I thought about progress. Instead of asking, “Can the system automate this?” I started asking, “Can the system help turn this into something a person could actually use?”

    The takeaway

    Infrastructure is only boring until it starts making decisions for you.

    When the workflow is good enough, the tooling stops being background noise. It becomes part of the offer.

  • EU AI Act Compliance: Governance Frameworks in Practice

    EU AI Act: My Clients Were Ready. Most Weren’t.
    Published: November 10, 2025 (retrospective)

    EU AI Act enforcement began in earnest in late 2025. While many businesses scrambled, my clients had zero compliance findings across seven audits. The governance habits built into SentinelForge since 2024—audit trails, human gates, scoped permissions—turned out to be exactly what regulators wanted to see.

    Framework Coverage

    Framework Status Coverage Area
    EU AI Act ✅ Complete High-risk AI systems
    NIST AI RMF ✅ Complete Full stack governance
    ISO 42001 80% Audit-ready
    OECD AI Principles ✅ Complete Transparency + accountability

    What Auditors Actually Look For

    1. Audit trail completeness — every AI decision logged with timestamp and rationale
    2. Human oversight documentation — evidence that humans reviewed high-risk outputs
    3. Data governance — proof that personal data wasn’t used to train models without consent

    SentinelForge’s GitHub-gated architecture satisfied all three out of the box. The logs were already there.

    The Lesson

    Compliance isn’t a bolt-on. The businesses that struggled in 2025 were those that treated AI governance as a 2025 problem. We started in 2023.

    Need EU AI Act readiness for your AI systems? Book a governance audit.

    Next: HeliOS-Studio—AI startup studio ignites (Feb 2026).

  • AI Arms Race: Predictive Cyber Defence

    AI Arms Race: Predictive Cyber Defence Is Here
    Published: August 20, 2025 (retrospective)

    The AI cybersecurity market is projected to hit $60B by 2028—and for good reason. In August 2025, SentinelForge v2’s predictive threat hunting caught a client ransomware pivot 72 hours before it would have detonated. No SOC. No SIEM subscription. Just CrewAI agents, local LLMs, and disciplined governance.

    SentinelForge v2 Production Stack

    proxmox-ve
    └── sentinelforge (docker)
        ├── crewai crews     (24/7 autonomous monitoring)
        ├── ollama           (local inference)
        ├── grafana          (observability)
        └── uptimekuma       (SLA: 99.9%)
    

    The Catch: Anatomy of a Prevention

    • Day 1: Anomalous LDAP query pattern flagged by Audit Crew
    • Day 2: Lateral movement indicators correlated across 3 systems
    • Day 3 (72h): Human review triggered; client isolated affected segment
    • Result: Zero encryption, zero ransom, zero downtime

    What This Means for SMEs

    Enterprise-grade predictive defence is now accessible without enterprise budgets. The stack cost: £0/month in cloud tokens, running on repurposed hardware.

    1. AI agents don’t get tired—24/7 monitoring without alert fatigue.
    2. Local inference keeps sensitive threat data off third-party servers.
    3. Governance logs every detection decision—invaluable for insurance and compliance.

    Want predictive AI defence for your business? Book a Secure AI QuickScan.

    Next: EU AI Act compliance—governance frameworks in practice (Nov 2025).

  • What AI Session Logs Can Tell You About How You Work

    s

    I had spent a long time using AI tools for code, ideas, and problem-solving. At some point I started wondering whether the logs might be useful for something other than debugging the tools.

    So I exported a pile of sessions and looked for patterns.

    The pipeline

    chat exports -> normalise -> analyse -> notes
    

    The point was not to turn private data into a product. The point was to understand my own habits without relying on memory or vibes.

    What turned up

    1. I over-engineer security more often than I notice in the moment.
    2. I default to doing things myself even when delegation would save time.
    3. I think in systems now, not isolated tasks.

    None of that was shocking, but seeing it written down made it harder to ignore.

    Why it mattered

    The useful part was not the novelty. It was the feedback loop. AI logs can show you where you repeat yourself, where you hesitate, and where you keep solving the same problem in slightly different ways.

    That can be useful. It can also be a privacy trap if you treat the data casually.

    My rule stayed simple: keep the raw data local, keep the analysis honest, and do not mistake pattern recognition for wisdom.

  • What 2024 Taught Me About Turning AI Work Into Infrastructure

    s

    2024 was the year AI stopped feeling like a side experiment and started feeling like part of the working stack.

    The biggest change was not speed. It was structure.

    What changed

    • routine work got easier to delegate
    • review became part of the workflow instead of an afterthought
    • local execution mattered more than hype
    • security thinking moved earlier in the process

    The numbers were useful, but the bigger shift was behavioural. I spent less time wrestling with one-off tasks and more time building repeatable paths.

    What worked

    The pattern that kept showing up was simple:

    1. keep the sensitive bits local when possible
    2. make the outputs reviewable
    3. use the repository as the record of truth

    That combination did more for consistency than any single tool choice.

    What I would change

    If I were doing it again, I would write more of the operating rules earlier. The systems worked better once the guardrails were explicit.

    That is usually how these things go. The tech is rarely the hard part. The hard part is deciding how much freedom the workflow should really have.