![](assets/kapernikov-logo.png)

# Workshop Agentic AI

**Moving your organisation into the agentic era — thoughtfully**

Kapernikov · 20 August 2026 · Pepibru, Anderlecht

---

<div style="position:absolute; inset:0; display:flex; flex-direction:column; align-items:center; justify-content:center; gap:26px">
  <div style="font-size:40px; font-weight:700; color:#fff">Open these slides on your phone</div>
  <img src="assets/qr-slides.svg" style="position:static; max-width:none; max-height:none; width:500px; height:500px; background:#fff; padding:22px; border-radius:18px">
  <div style="font-size:26px; font-weight:600; color:rgba(255,255,255,0.92)">agentic-coding-workshop.ac.kapernikov.com/executive</div>
</div>

---

# Who is Kapernikov

**Data and AI for engineering environments.**

- We build **Data intensive applications for rail and offshore**.
- We **co-create**. Our engineers work inside your team, and the code, the IP and the expertise stay with you.
- Belgian, multilingual, AI-forward. Leuven and Brussels.

<div style="margin:86px auto 0; max-width:1140px">
 <div style="font-size:17px; letter-spacing:1.5px; text-transform:uppercase; font-weight:600; color:#818281; margin-bottom:26px; text-align:center">Trusted by infrastructure managers and their suppliers across Europe</div>
 <div style="display:flex; align-items:center; justify-content:center; gap:35px; filter:grayscale(1)">
  <img src="assets/logos/infrabel.svg" style="height:34px; width:auto; max-width:none; max-height:none; margin:0">
  <img src="assets/logos/delijn.svg" style="height:34px; width:auto; max-width:none; max-height:none; margin:0">
  <img src="assets/logos/prorail.svg" style="height:29px; width:auto; max-width:none; max-height:none; margin:0">
  <img src="assets/logos/blue-c.png" style="height:32px; width:auto; max-width:none; max-height:none; margin:0">
  <img src="assets/logos/geoxyz.svg" style="height:30px; width:auto; max-width:none; max-height:none; margin:0">
  <img src="assets/logos/umicore.svg" style="height:26px; width:auto; max-width:none; max-height:none; margin:0">
  <img src="assets/logos/argon.png" style="height:30px; width:auto; max-width:none; max-height:none; margin:0">
 </div>
</div>

---

# What you can buy from us

<div style="display:flex; gap:34px; justify-content:center; align-items:stretch; max-width:1140px; margin:14px auto 0">
 <div style="flex:1; border-top:5px solid #1D6E88; background:#f6f7f8; border-radius:8px; padding:20px 24px; text-align:left">
  <h2 style="margin:0 0 12px; font-size:1.22em; line-height:1.2; color:#1D6E88">Data-intensive applications, agents first class</h2>
  <p style="margin:0 0 12px; font-weight:600">The agent is part of the platform, not bolted on afterwards.</p>
  <ul style="margin:0; padding-left:1.1em; line-height:1.35">
   <li>Your data in one <strong>governed</strong> place, with history and lineage.</li>
   <li>A powerful but <strong>isolated</strong> agent — hosted, or fully local when data can't leave.</li>
   <li>An agent that <strong>understands your business and your data</strong>.</li>
  </ul>
 </div>
 <div style="flex:1; display:flex; align-items:center; justify-content:center">
  <img src="assets/illustrations/s04-agent-builds-dashboard.png" style="max-height:340px; margin:0">
 </div>
</div>

---

# What you can buy from us

<div style="display:flex; gap:34px; justify-content:center; align-items:stretch; max-width:1140px; margin:14px auto 0">
 <div style="flex:1; display:flex; align-items:center; justify-content:center">
  <img src="assets/illustrations/s05-operational-work.png" style="max-height:340px; margin:0">
 </div>
 <div style="flex:1; border-top:5px solid #ba2415; background:#f6f7f8; border-radius:8px; padding:20px 24px; text-align:left">
  <h2 style="margin:0 0 12px; font-size:1.22em; line-height:1.2; color:#ba2415">Agentic AI in your operational processes</h2>
  <p style="margin:0 0 12px; font-weight:600">We put agents to work where the work actually is.</p>
  <ul style="margin:0; padding-left:1.1em; line-height:1.35">
   <li>Administration, analysis, integration, knowledge management — <strong>not just the dev team</strong>.</li>
   <li>We find where it pays, and build it with your people.</li>
   <li>The guardrails and the review discipline come with it, not after it.</li>
  </ul>
 </div>
</div>

---

# Our goals for today

<div style="display:flex; background:#f6f7f8; border-radius:8px; overflow:hidden; margin-left:0">
  <div style="width:8px; background:var(--kpv-petrol); flex:none"></div>
  <div style="display:flex; align-items:baseline; gap:26px; padding:26px 30px">
   <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:1.75em; line-height:1; color:var(--kpv-petrol); width:170px; flex:none">Know</span>
   <span style="line-height:1.4"><strong>A look under the hood.</strong> What an LLM really does, what an agent adds — and what follows from that in practice.</span>
  </div>
 </div>

<div style="display:flex; background:#f6f7f8; border-radius:8px; overflow:hidden; margin-left:64px">
  <div style="width:8px; background:var(--kpv-tangerine); flex:none"></div>
  <div style="display:flex; align-items:baseline; gap:26px; padding:26px 30px">
   <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:1.75em; line-height:1; color:var(--kpv-tangerine); width:170px; flex:none">Judge</span>
   <span style="line-height:1.4"><strong>What it is worth, and where.</strong> What makes a good project ? When can it be trusted ?</span>
  </div>
 </div>

<div style="display:flex; background:#f6f7f8; border-radius:8px; overflow:hidden; margin-left:128px">
  <div style="width:8px; background:var(--kpv-primary); flex:none"></div>
  <div style="display:flex; align-items:baseline; gap:26px; padding:26px 30px">
   <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:1.75em; line-height:1; color:var(--kpv-primary); width:170px; flex:none">Act</span>
   <span style="line-height:1.4"><strong>Where to start, and what to put around it.</strong> Architecture, legal aspects, risks, best practises.</span>
  </div>
 </div>

</div>

---

# Agenda (2.5 hours)

| # | Section |
|---|---------|
| 1 | Foundations — what an LLM is, why context matters |
| 2 | From chatbots to agents — what they are, where they run, who for |
| 3 | Agents applied — a quick primer (weaknesses, your role, skills) |
| 4 | Risks and legal aspects |
| 5 | Agents in your organisation — from software dev to every function |
| 6 | Impact on HR — hiring, training, wellbeing |

Note:
- 14:00–16:30
- 2.5 hours this time, up from 2 — the extra half hour goes to section 6, which got skipped last time

---

# 1. Foundations

## What an LLM is, and why context matters

---

# An LLM is a next-token predictor

</div>

Note:
TOKEN LOOP (animated — press → to step through it; 3 predict→append cycles):

- Observation: no memory between runs — each step re-reads the whole sequence from scratch

- The rest of this section unpacks how a single prediction actually works
  (attention), then where that ability comes from (training).

---

# Step 1 — words become vectors

![w:868 h:328](./assets/ail-88f94262.svg)

</div>

Note:

* Words become vectors (fixed size)
* Word -> Vector = embedding
* Embedding = learned (typically : similar meaning = similar vector)
* Tokens

---

# Step 2 — one attention head looks

![w:735 h:562](./assets/ail-2372ffed.svg)

</div>

Note:

* Words refined with context
* Attention: we "mix" word vectors but not equally (matchmaking)
* Here: looking at words in vicinity. Learning role

---

# Step 3 — a deeper layer resolves meaning

![w:735 h:562](./assets/ail-29bfb246.svg)

</div>

Note:

* Same mechanism in next layer.
* Words are no longer embeddings, they changed.
* But now further reach, more semantically.

---

# Step 4 — the last token gathers the answer

![w:735 h:562](./assets/ail-c6527fc2.svg)

</div>

Note:

* what was 'it' now gained meaning
* Information to predict next word is assembled in last position.
* Attention is a budget: each tokens share adds up to 1. (softmax)

---

# Step 5 — read out the next word

![w:817 h:333](./assets/ail-508d903e.svg)

</div>

Note:

* Last word has everything it needs to predict next.
* Dot product with whole vocabulary -> softmax
* We pick (almost) most likely
* After this, repeat and predict another word
* This is simplified: more layers, more complex topology, larger vectors, tokens.

---

# Pretraining: where the knowledge comes from

* Trained to **predict the next token** on a vast dataset
* **Knowledge** is a side-effect of getting good at that game
* That knowledge is **frozen** at training time

</div>

</div>

Note:
Bridge from the attention chapter (open with this):
- Last slide: model gathers what it needs, predicts next word. Why is it GOOD at it?
- Training: billions of next-word predictions, each bad one punished, weights nudged.
- Knowledge / grammar / reasoning fall out as a side-effect of the prediction game.

Pretraining:
- Like reading most of the library, getting very good at "what word comes next" — can't do that without absorbing how world, language, code work.
- The expensive stage: months of compute over huge corpora → a "base model" (knowledgeable, not yet helpful).
- Frozen weights: no learning from your conversation, no memory between sessions, knowledge cutoff. Newer/private info must go in the context window.
- Exec takeaway: knowledge is real but static and generic. Your proprietary/current/confidential data is NOT in there — you provide it.

---

# Fine-tuning: from knowledge to instrument

A raw next-token predictor just **continues** text — it rambles, imitates, doesn't reliably *help*.

A second, much smaller stage trains it on **human feedback**: follow instructions, be useful, stay on task, refuse harmful requests.

**Pretraining builds the knowledge; fine-tuning turns it into a useful instrument.**

Watch the side-effect: it's trained to be *agreeable* — it rarely says "I don't know," and will give confident, plausible-but-wrong answers.

</div>

</div>

Note:
Fine-tuning:
- Instruction tuning + RLHF/RLAIF. Tiny vs pretraining, but turns a base model into "an assistant" + teaches the chat format (system/user/assistant).
- Aligns it to be helpful, honest-ish, harmless — and to follow instructions, not just continue the prompt.
- Agreeableness cuts both ways: great UX, but why models hallucinate confidently and seldom push back. Root of the "always-happy" weakness → human review stays essential.
- Exec takeaway: "helpful and confident" is trained behaviour, not evidence of correctness. Treat fluent output as a draft, not a fact.

---

# 2. From chatbots to agents

## What an agent actually is

---

# How a chatbot talks to an LLM

</div>

Note:
- The LLM is stateless.
- The growing payload across frames is the whole story.

---

# Three roles, one system

![w:760 h:410](./assets/ail-5331345f.svg)

</div>

Note:
The metaphor (say it as the picture assembles): you don't ride bareback — three things come together.
- HORSE = the LLM: raw power. Strong, fast, but doesn't know where to go.
- SADDLE + reins = the AGENT: the harness — tools, memory, a loop, reins to steer. Turns a powerful-but-undirected animal into something rideable.
- RIDER = the HUMAN: sets the destination, stays in the saddle, course-corrects.
- Point: you don't control the LLM directly — you control it THROUGH the agent. Human → agent → LLM.

Caveat (only if pushed): the agent is ACTIVE, not passive — it runs the loop, calls tools, decides. Don't oversell it as mere equipment.

---

# The Agentic Loop

</div>

Note:
- Agent strengths and weaknesses: memory, judgement, no pattern detection, always-happy.
- Key point: the human role shifts from executor to process engineer.

---

Note:
The demo, right after the loop diagram: the same loop, running for real. Feedback
from the first delivery was that a demo makes it tangible and belongs IN the deck,
not tacked on at the end.

86 seconds. Let it run without narrating every step; point at the two moments that
match the diagram — the agent choosing a tool, and the result coming back before it
answers.

Muted by default. Click to play if autoplay is blocked, and have the file locally:
videos/agent-demo.mp4 in the deck folder, also copied into the built output.

---

# Vocabulary you'll keep hearing

<div style="display:flex; flex-wrap:wrap; gap:18px 34px; justify-content:center; align-items:baseline; max-width:1060px; margin:40px auto 0; line-height:1.0">
<span style="font-size:2.6em; font-weight:800; color:#c0392b">context</span>
<span style="font-size:2.4em; font-weight:800">token</span>
<span style="font-size:1.95em; font-weight:700; color:#2c7a8c">context window</span>
<span style="font-size:1.8em; font-weight:700">attention</span>
<span style="font-size:1.5em; font-weight:600; color:#c0392b">context engineering</span>
<span style="font-size:1.6em; font-weight:600">hallucination</span>
<span style="font-size:1.4em; font-weight:600">prompt</span>
<span style="font-size:1.3em; color:#2c7a8c">time to first token</span>
<span style="font-size:1.1em; color:#6b7378">temperature</span>
<span style="font-size:1.05em; color:#6b7378">next-token prediction</span>
<span style="font-size:1.0em; color:#2c7a8c">context rot</span>
<span style="font-size:0.95em; color:#6b7378">embedding</span>
<span style="font-size:0.95em; color:#2c7a8c">context dilution</span>
<span style="font-size:0.9em; color:#6b7378">system prompt</span>
</div>

Note:
Vocabulary checkpoint — recap each term in a line.
- Taught by now: token, context, attention, next-token prediction, temperature.
- "You'll hear these" (matter in tooling & billing): context window, context dilution, context rot, time to first token, context engineering.
- Others: prompt, system prompt, embedding, hallucination.

---

# 3. Agents applied — a quick primer

## Where the agent stops, and you begin

---

# What an agent can't do

* **Limited memory** — doesn't learn from past failures, limited context window
* **Notoriously bad at judging** — is this good enough? Are we optimizing what should not exist?
* **Doesn't identify structural issues** — an agent is always happy and never says "I can't continue working this way"
* **Time doesn't exist** — a LLM can not feel time

> Key to successful agent usage is taking these limits into account

Note:
- "Always happy" ties back to §1 fine-tuning (trained to be agreeable → confident, plausible-but-wrong). Call that callback out loud.

---

# Know your role

| Human (long-term memory) | | Agent (fast executor) |
|--------------------------|:-:|----------------------|
| Build agent knowledge base | → | Complete tasks despite no LT memory |
| Make goals agent-verifiable | → | Work autonomously |
| Identify and correct friction | → | Get better over time |
| Implement safeguards and checks | → | Be trusted with bigger tasks |

**The asymmetry:**
- **Agent:** fast execution, able to check, cheap implementation, no memory across sessions
- **Human:** slow execution, able to judge, but remembers patterns and failures over time

Note:
- Know your role = do your job. Be the process engineer.
- Don't be happy with mediocre results.
- You were born in the era where code was written by hand — see it as a strength.

---

# Most important guideline: Optimise context

<div style="flex:1">
  <div style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.6em; letter-spacing:1.8px; text-transform:uppercase; color:var(--kpv-medium-grey); margin-bottom:34px">Large context decreases quality</div>
  <p style="margin:0 0 16px"><strong>Rot</strong> — quality drops as the window fills</p>
  <p style="margin:0 0 16px"><strong>Tunnel vision</strong> — the first framing sticks, better paths go unseen</p>
  <p style="margin:0"><strong>Dilution</strong> — everything important means nothing important</p>
 </div>

<div style="flex:1">
  <div style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.6em; letter-spacing:1.8px; text-transform:uppercase; color:var(--kpv-primary); margin-bottom:34px">so</div>
  <p style="margin:0 0 16px"><strong>Start fresh</strong> — a new task gets a clean context</p>
  <p style="margin:0 0 16px"><strong>Keep knowledge narrow</strong> — small, named, one job each</p>
  <p style="margin:0"><strong>Progressive disclosure</strong> — load the detail only when it is needed</p>
 </div>

</div>

---

## Building blocks for agentic systems

---

# Skills: the company wiki, not a memorised handbook

Skills are reusable playbooks the agent loads **on demand**:

![h:380](./assets/mermaid-d982846d.svg)

</div>

Note:
Talk track — the wiki/print analogy, say it slowly:
- Context = the agent's working memory, and it's finite. Cram everything "just in case" and quality drops — it loses the thread, weighs trivia equally. Everything important = nothing important.
- So good agents keep context LEAN — pull in knowledge on demand, not all upfront.
- A new hire doesn't memorise the whole wiki day one. Needs to print → looks up "how do I print here?" right then. A skill is exactly that: a small named playbook ("how we deploy", "how we write a tender") the agent loads the moment a task calls for it. Huge library of know-how, near-zero attention cost until needed.
- Forward hook: this is the primitive that makes agents practical at scale — same lean-context discipline you apply rolling out across the org (§5).
- Progressive disclosure (only if asked): name+description always resident, body loads on trigger, references load only when reached.

---

# Sub-agents

Sub-agents provide **context isolation**:

![h:420](./assets/mermaid-f346a29e.svg)

</div>

Note:
- Same lean-context theme as skills: heavy work happens in a throwaway context, only the summary comes back, so the main agent stays focused.
- Reinforces "keep context lean" one more way.

---

# Tools: narrow or general

<div style="position:absolute; top:30px; left:0; font-family:'Agenda',sans-serif; font-weight:700; font-size:25px; line-height:1.15; color:var(--kpv-petrol)">Single-purpose</div>
 <div style="position:absolute; top:30px; right:0; text-align:right; font-family:'Agenda',sans-serif; font-weight:700; font-size:25px; line-height:1.15; color:var(--kpv-primary)">General-purpose</div>

<div style="position:absolute; top:140px; left:7%; transform:translateX(-50%); background:#fff; border:2px solid var(--kpv-petrol); border-radius:22px; padding:7px 16px; font-family:ui-monospace,monospace; font-size:17px; color:var(--kpv-petrol); white-space:nowrap">load_skill</div>
<div style="position:absolute; top:140px; left:28%; transform:translateX(-50%); background:#fff; border:2px solid var(--kpv-petrol); border-radius:22px; padding:7px 16px; font-family:ui-monospace,monospace; font-size:17px; color:var(--kpv-petrol); white-space:nowrap">search_documents</div>
<div style="position:absolute; top:140px; left:52%; transform:translateX(-50%); background:#fff; border:2px solid var(--kpv-tangerine); border-radius:22px; padding:7px 16px; font-family:ui-monospace,monospace; font-size:17px; color:var(--kpv-tangerine); white-space:nowrap">browser</div>
<div style="position:absolute; top:140px; left:75%; transform:translateX(-50%); background:#fff; border:2px solid var(--kpv-primary); border-radius:22px; padding:7px 16px; font-family:ui-monospace,monospace; font-size:17px; color:var(--kpv-primary); white-space:nowrap">python</div>
<div style="position:absolute; top:140px; left:93%; transform:translateX(-50%); background:#fff; border:2px solid var(--kpv-primary); border-radius:22px; padding:7px 16px; font-family:ui-monospace,monospace; font-size:17px; color:var(--kpv-primary); white-space:nowrap">bash</div>

<div style="position:absolute; top:272px; left:0; max-width:330px; font-size:17px; line-height:1.3; color:var(--kpv-dark-grey)">You know exactly what can happen.</div>
 <div style="position:absolute; top:272px; right:0; max-width:330px; text-align:right; font-size:17px; line-height:1.3; color:var(--kpv-dark-grey)">It can do anything you can.</div>

</div>

Note:
Bridge into MCP, and almost no words on purpose.

The wedge is blast radius — it widens to the right. Point at it once.

Left end: one job, one shape. You know what can happen, it is easy to audit and easy
to sandbox. Right end: one tool, any job. bash can do anything the account it runs
under can do, so containment stops being a setting and becomes the design problem.

The room's decision is not "which end is better" — both ends are in every real agent.
It is: who decided which tools this agent has, and can they still tell you?

Hand off to MCP with that: a connector is how you hand an agent a whole set of these
at once, which is why it matters who wrote it.

---

# MCP: one plug, many systems

</div>

**MCP is the USB-C of agents** — one standard, so any agent can plug into any system.

Note:
Builds up in eight beats — press through them, do not talk over the whole thing at
once. Same actors as the agentic loop slide, with a connector and a real system
hanging below the agent. Point at that continuity rather than re-explaining the loop.

The beats: idle · connect (round trip to the connector) · the preamble landing in
the system prompt · the question · the MODEL picking the tool · the connector
running it against the system · the file coming back as a tool result · the answer.

Badges carry the distinction the old mermaid version could not: "once, when you
connect it" for the first two beats, "then, every question" for the rest.

Three things the old diagram got wrong and this one does not:
1. The LLM picks the tool, not the agent. That is what the loop slide taught two
   slides ago.
2. Discovery happens ONCE, when you connect the server — not on every question.
3. The result goes back to the MODEL, which then writes the answer. That is the
   loop, closing.

What the connector actually hands over on connect: an "instructions" string
describing how to use it, which the client injects into the system prompt, plus each
tool's name, description and input schema. Claude Code and VS Code both do the
injection; the MCP spec words it as "may", so it is convention rather than guarantee.

Three consequences worth saying out loud, in this order:
- Connectors SPEND CONTEXT. Every connected server's preamble and every tool
  description sits in the window on every request, before anyone types anything.
  Twenty connectors and the context is diluted before the work starts.
- Part of your agent's instructions is then written by SOMEONE ELSE. If the
  connector is not yours, a stranger authored text that lands in your system
  prompt. That is tool poisoning, and it hands straight to the lethal trifecta in
  section 4.
- Every connector is a PERMISSION you grant: someone approves it, someone keeps
  the list.

USB-C is the line to say out loud — one standard, so any agent plugs into any
system. Apt rather than hype: before MCP every agent needed a bespoke integration
per system.

If asked what we do ourselves: our agents reach GitLab and our own planner through
connectors, and there are systems we deliberately did not connect.

---

# 4. Risks and legal aspects

---

# What can actually go wrong

Not rogue AI. **Good intentions + too much access + mistakes** — plus one new twist: hijack.

| Risk | What it looks like |
|---|---|
| **Data & IP leakage** | an over-eager agent commits secrets to the repo, or sends source / customer data to an outside model |
| **Prompt injection** | hostile content the agent reads hijacks it into leaking or acting *(next slide)* |
| **Supply chain** | the agent pulls in a malicious or typo-squatted dependency |
| **Destructive mistakes** | a good-faith agent with too much access breaks or deletes the wrong thing |
| **Unreviewed output** | hallucinated facts or insecure code shipped because nobody checked |

Note:
- Core reframe (say first): not a "rogue" AI — good faith + too much access + mistakes.
- The one genuinely new, AI-native risk is PROMPT INJECTION (the "hijack" twist) — next slide (lethal trifecta). Mundane risks bite far more often than a clever injection.
- Data/IP leakage — shadow AI (free tiers train on input; GDPR slide) + over-eager `git add` committing secrets.
- Supply chain — typosquatted package into your product.
- Destructive mistakes — rm -rf the wrong dir; good intent, bad blast radius.
- Unreviewed output — the review bottleneck; shipping what nobody read.
- Mental model: a capable but over-eager junior. Injection deep-dive next, then mitigations.

---

# Prompt injection: the lethal trifecta

*Why* it's possible at all — and *when* it actually harms:

![w:520 h:245](./assets/ail-7fdca854.svg)

</div>

**Break any one leg and it's defanged.** <span class="ref">"lethal trifecta" — Simon Willison, 2025</span>

Note:
The lethal trifecta (Simon Willison): an injection only HARMS when all three legs are present —
- processes untrustworthy input (externally-authored data can carry an injection),
- has access to sensitive systems or private data (prod configs, secrets, source, user data),
- can change state or communicate externally (write actions, or send data out via web/tool calls).
- Remove any one leg → defanged. It's an ARCHITECTURE problem, not "is the model immune".

Root cause (left box) — why injection is possible AT ALL:
- LLMs have no control-plane/data-plane separation (unlike parameterised SQL, where query ≠ data).
- System prompt, user input, tool output, retrieved docs ALL arrive as one undifferentiated token stream → can't reliably tell instruction-to-follow from data-to-read. Can't be fully patched away.
- The Venn (right) = WHEN that possibility becomes actual harm.

Honesty (from hands-on testing — hidden reworded instructions in docs, read by the model, never fired):
- Blatant overrides bounce off frontier models now; what survives is the SUBTLE, task-aligned kind (the curl|bash "fix").
- Don't oversell injection — rank honestly: an over-broad git commit leaks secrets far more often than a clever injection.
- curl|bash is BOTH categories: delivery = task-aligned indirect injection, payload = supply-chain/RCE. It only bit because the agent could EXECUTE untrusted code unattended.
- Live guardrails (shell command needs permission; model wary of curl|bash) ARE the least-privilege + human-gate controls — turning them off (YOLO / auto-approve) is the real vulnerability.

---

# Containing it

| Lever | What it means |
|---|---|
| **Least privilege** | the agent gets only the data & tools its task needs — not prod secrets, not root |
| **Review the artifacts** | check what it *produced* — the output, the diff — not the permission prompts |
| **Sandboxed, sanctioned tools** | provisioned business-tier tools; embedded in-app agents for non-coders; containerised runtimes for devs |
| **Human on consequential calls** | a person owns anything with legal or material effect (ties to the AI Act & GDPR) |

**Your real security boundary is the output you review — not the checkbox you click.**

Note:
- Key insight: per-action permission prompts give a FALSE sense of control — time-of-check ≠ time-of-use (approve "run make" + approve "edit Makefile" = arbitrary code execution). No one reads the bash prompt anyway.
- Move the security boundary to the ARTIFACTS the agent produces (the diff, the output — review like a junior's PR), not the side effects you rubber-stamp mid-run.
- Least privilege: scope data + tools to the task (RBAC, tenant/row scoping). Highest-leverage control — shrinks the blast radius of every other risk.
- Sandboxed/sanctioned tools: also the shadow-AI fix — give people a good provisioned tool so they don't reach for personal free accounts. For non-coders, the in-app EMBEDDED agent is safer: sandbox = the app's own permissions & data boundaries, not trust in a CLI prompt.
- Prompt injection defence: break the lethal trifecta — don't combine untrusted input + sensitive data + ability to act, all unattended.
- Human oversight on consequential actions → ties to legal (Art. 14 / GDPR Art. 22).
- Don't claim "secure" — claim "contained": least privilege + review the output.

---

![](assets/eu-justice.png)

<p style="position:absolute; right:16px; bottom:12px; margin:0; font-size:14px; font-style:italic; color:rgba(255,255,255,0.75); text-shadow:0 1px 4px rgba(0,0,0,0.7)">Justitia / EU flag · iStock / Getty Images</p>

---

# EU AI Act: the legislation

**The text** — Regulation (EU) 2024/1689, the world's first comprehensive AI law. Binding as written in all 27 EU states — no national transposition. Full text & 13 annexes live on EUR-Lex.

**Who it binds** — every actor in the EU & EEA. And, like GDPR, anyone *outside* the EU who places AI on the EU market or whose **output is used in the EU** — a Swiss or US firm is caught the same way.

| When | What kicks in |
|---|---|
| 1 Aug 2024 | entered into force |
| since Feb 2025 | the bans + the AI-literacy duty |
| **since 2 Aug 2026** | **transparency duties — this applies now** |
| 2 Dec 2027 | high-risk, stand-alone systems *(Annex III)* |
| 2 Aug 2028 | high-risk, inside regulated products *(Annex I)* |

<p class="ref">Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI — Regulation (EU) 2026/1744, in force 27 July 2026</p>

Note:
Structural facts execs ask for before the risk model makes sense.
- WHAT: Regulation (EU) 2024/1689. A "Regulation" (not a Directive) = directly applicable, identical in every member state, no national law needed. 113 articles, 13 chapters, 13 annexes. Authoritative text: EUR-Lex, CELEX 32024R1689.
- WHEN: trilogue deal Dec 2023; Parliament 13 Mar 2024; Council 21 May 2024; published OJ 12 Jul 2024; in force 1 Aug 2024; obligations phased 2025→2028.
- WHO / territorial reach (Art. 2): all EU + EEA. Deliberately extraterritorial like GDPR — non-EU providers placing systems on the EU market, AND non-EU providers/deployers whose system OUTPUT is used in the EU. A non-EU firm is caught the moment it sells into the EU or its AI's output is used there. "Where your servers sit is irrelevant."
- Main chapters if asked: prohibited practices · high-risk systems · transparency · general-purpose AI models · governance (AI Office + Board) · penalties.
- Land it: "a regulation with GDPR-style global reach — assume you're in scope."

THE DEFERRAL IS LAW, not a proposal — checked 19 Aug 2026. Digital Omnibus on AI =
Regulation (EU) 2026/1744, published in the OJ 24 July 2026, in force 27 July 2026.
Fixed dates, not conditional on standards being ready: the Commission's original
conditional trigger was dropped in negotiation.
- Annex III stand-alone high-risk moved from 2 Aug 2026 to 2 Dec 2027.
- Annex I, high-risk inside regulated products, to 2 Aug 2028.
- Transparency (Art. 50) was NOT moved: it applies since 2 Aug 2026, so it is live
  today. Exception: machine-readable marking of synthetic content for systems already
  on the market before 2 Aug 2026 has until 2 Dec 2026.
- Art. 4 literacy was SOFTENED: "take measures to support" AI literacy rather than
  "ensure" it, and explicitly no obligation to guarantee any particular level. Still in
  force since Feb 2025 — do not oversell it as a training mandate.
- Art. 27 FRIA may now cross-reference an existing DPIA.
- Two new prohibitions added (non-consensual intimate imagery, CSAM), from 2 Dec 2026.
If asked why the delay: standards and support tooling were not ready, and the deferral
buys the two years.

---

# EU AI Act: risk-driven regulation

| Risk level | Examples | Your obligation |
|---|---|---|
| **Unacceptable** | social scoring, manipulation, emotion-tracking at work | **banned outright** |
| **High** | hiring & HR, credit, education, medical, critical infrastructure | strict: human oversight, logging, data governance, conformity |
| **Limited** | a bot your *customers* talk to; AI content you *publish* (deepfakes, public-facing text) | tell people it's AI |
| **Minimal** | AI as your *own* tool — chatting, drafting, generating your own work | no obligations |

Note:
The one mental model: the Act tiers AI by RISK, obligations scale with tier — NOT a blanket "AI is regulated" regime.

Four tiers:
- Unacceptable → prohibited (in force since Feb 2025): social scoring, manipulative/subliminal techniques, untargeted face-scraping, emotion recognition in workplace & education, most real-time biometric ID.
- High-risk (Annex III) → the heavy column: employment/HR screening, credit, education, medical devices, critical infrastructure, biometric ID. Duties: risk management, data governance, logging, human oversight, conformity assessment, registration.
- Limited → transparency only (Art. 50): tell people they're talking to AI; label AI-generated/manipulated content (deepfakes). Applies 2 Aug 2026.
- Minimal → no obligations. Most office-productivity use lands here.

- Don't read the table aloud — point: "find your use case's row, that's your duty."
- Refs: artificialintelligenceact.eu summary; EC digital-strategy FAQ.

---

# Four questions before you build

<div style="border:2px dashed var(--kpv-medium-grey); border-radius:8px; padding:15px 22px; display:flex; align-items:baseline; gap:18px; margin-bottom:22px">
 <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:19px; color:var(--kpv-dark-grey); letter-spacing:1.4px; text-transform:uppercase; flex:none">First</span>
 <span style="font-size:20px; line-height:1.35; color:#2b2724">Is the AI in something you <strong>ship</strong>, or in a <strong>decision about people</strong>? <span style="color:var(--kpv-medium-grey)">If it only helps you write, none of this applies.</span></span>
</div>

<div style="display:grid; grid-template-columns:44px 1fr 300px; align-items:baseline; gap:22px; padding:16px 0; border-top:1px solid #e2e4e6">
 <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:30px; color:var(--kpv-primary); line-height:1">1</span>
 <span style="font-size:23px; line-height:1.28; color:#111; font-weight:800">Is it forbidden?
  <small style="display:block; font-size:17px; font-weight:500; color:var(--kpv-medium-grey); margin-top:4px; line-height:1.3">Trustworthiness scoring · emotion recognition on staff or students · face scraping</small></span>
 <span>
  <span style="display:block; font-family:'Agenda',sans-serif; font-weight:700; font-size:26px; color:var(--kpv-primary); line-height:1">Stop</span>
  <span style="display:block; margin-top:6px; font-size:16.5px; line-height:1.3; color:#2b2724">Banned since Feb 2025. Fines to 7% of turnover.</span>
 </span>
</div>

<div style="display:grid; grid-template-columns:44px 1fr 300px; align-items:baseline; gap:22px; padding:16px 0; border-top:1px solid #e2e4e6">
 <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:30px; color:var(--kpv-primary); line-height:1">2</span>
 <span style="font-size:23px; line-height:1.28; color:#111; font-weight:800">Does it judge people in a high-risk area?
  <small style="display:block; font-size:17px; font-weight:500; color:var(--kpv-medium-grey); margin-top:4px; line-height:1.3">Hiring · credit · education · essential services · safety in critical infrastructure — sold or used in-house</small></span>
 <span>
  <span style="display:block; font-family:'Agenda',sans-serif; font-weight:700; font-size:26px; color:var(--kpv-primary); line-height:1">Months</span>
  <span style="display:block; margin-top:6px; font-size:16.5px; line-height:1.3; color:#2b2724">The heavy tier: oversight, logging, conformity. Question 3 decides your share of it.</span>
 </span>
</div>

<div style="display:grid; grid-template-columns:44px 1fr 300px; align-items:baseline; gap:22px; padding:16px 0; border-top:1px solid #e2e4e6">
 <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:30px; color:var(--kpv-tangerine); line-height:1">3</span>
 <span style="font-size:23px; line-height:1.28; color:#111; font-weight:800">Is it yours?
  <small style="display:block; font-size:17px; font-weight:500; color:var(--kpv-medium-grey); margin-top:4px; line-height:1.3">You ship it under your name — or you repurpose a bought tool for a high-risk use</small></span>
 <span>
  <span style="display:block; font-family:'Agenda',sans-serif; font-weight:700; font-size:26px; color:var(--kpv-tangerine); line-height:1">Your share</span>
  <span style="display:block; margin-top:6px; font-size:16.5px; line-height:1.3; color:#2b2724">Yes → provider: the full conformity load, months. No → deployer: oversight and logs, weeks.</span>
 </span>
</div>

<div style="display:grid; grid-template-columns:44px 1fr 300px; align-items:baseline; gap:22px; padding:16px 0; border-top:1px solid #e2e4e6">
 <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:30px; color:var(--kpv-emerald); line-height:1">4</span>
 <span style="font-size:23px; line-height:1.28; color:#111; font-weight:800">Does a person talk to it, or see what it made?
  <small style="display:block; font-size:17px; font-weight:500; color:var(--kpv-medium-grey); margin-top:4px; line-height:1.3">A chat they use · content you publish</small></span>
 <span>
  <span style="display:block; font-family:'Agenda',sans-serif; font-weight:700; font-size:26px; color:var(--kpv-emerald); line-height:1">A day</span>
  <span style="display:block; margin-top:6px; font-size:16.5px; line-height:1.3; color:#2b2724">Say it's AI. One line in the interface.</span>
 </span>
</div>

</div>

<p class="ref">Regulation (EU) 2024/1689 — Art. 5, Annex III, Arts. 16 & 25, Art. 50 · confirm your own case with the Commission's AI Act compliance checker</p>

Note:
The risk table again, as an instrument: same four tiers, asked as questions you can
answer about your own case. Also the answer to "te veel geëxcuseerd" in the
feedback. The room leaves with an instrument instead of a caveat. Say the frame
once, out loud: nobody here needs to be a lawyer, the same way nobody needs to be
a traffic engineer to drive — you need to know the rules well enough to stay on
the road and to recognise when to pull over.
Questions 2 and 3 are a chain, say it explicitly: 2 tells you the heavy tier
applies (sold OR in-house), 3 tells you which half of the bill is yours — built or
rebranded → provider, the full conformity load; bought and used as intended →
deployer, oversight and logging.

Cost is in days, months or stop. That is the only unit this room converts into a
decision. Order is by cost, not by article number.

The gate is the misreading that costs the room the most. The dividing line is NOT
sold versus internal — deployers are bound too, which is why question 2 says "sold
or used in-house". The line is what the AI is used for.

Question 3 alone is light: provider of a non-high-risk AI system means transparency
and literacy, no conformity assessment, no CE mark. It only turns expensive
together with question 2.

Worked example to run live, better than our own product because everyone in the
room has an HR department: "we just ask ChatGPT for interview hints." Hints, with a
human writing the questions — fine, a writing tool. Paste in CVs and ask it to rank
them and you are a high-risk deployer under Annex III point 4, and Art. 25 can make
you the provider for repurposing a general tool. GDPR bites first either way:
candidate data, Art. 22, applicants as vulnerable subjects. That is the sentence
worth saying — the AI Act is the famous one, but GDPR is usually what stops you,
and it has applied since 2018.

Our own product is the second example if there is time: we ship an agent harness,
so 3 and 4 are yes, which is a day of work. Whether 2 applies is domain-dependent
and belongs in the design conversation with the customer.

Say the disclaimer HERE and nowhere else: a triage heuristic, not a legal test, and
largely untested law. Also worth naming while this is on screen — AI literacy is
already a duty (Art. 4, in force since Feb 2025), so training your people is
compliance, not prudence.

This slide is also the laminated cheat-sheet from the feedback list — same card,
printed.

---

# Does your AI content need a label?

| What you put out | Label it? |
|---|---|
| image / audio / video that resembles a **real** person or event & looks authentic | **yes** — disclose it's AI |
| text published to inform the public on **matters of public interest** | **yes** — unless a human editor is accountable |
| a decorative or clearly *illustrative* image (invented people) | no — light touch at most |
| AI used as your *own* working tool | **no** — *if you're the final reviewer and accountable* |

<p class="ref">the Act makes you label AI — it doesn't make AI true; falsity lives in other law (DSA, defamation, GDPR)</p>

Note:
Run the test on the deck itself.
- Deep-fake (Art. 3(60)) = AI image/audio/video that (a) resembles a real person/event AND (b) looks authentic. Both prongs needed.
- The cover image: invented people, not a real person or event, plainly decorative → not a deep fake → no label. (Transparency duties only apply from 2 Aug 2026 anyway.)
- The whole deck: AI-assisted, faces an audience — yet owes no label. A human authors, reviews and presents every slide. "Facing people" was never the test; a human standing behind the content is.
- Asymmetry: images need a label whenever they're a deep fake (broad); text only when published on public-interest matters with no human editor (narrow).
- "Matters of public interest" is narrow — journalism, public affairs, a listed company's market-moving statements; not internal docs or a deck like this.
- Not legal advice; untested law (test turns on audience perception, not intent).

---

# Organisational impact

| Level | What you do |
|---|---|
| **Must** *(the law)* | train staff in AI (literacy, in force now) · disclose user-facing AI · never run a prohibited use case · **+ if a use case is high-risk:** impact assessment & notify, 6-month logs, human oversight, registration |
| **Should** *(govern)* | keep an **inventory** of AI in use · **risk-classify** each use case · an acceptable-use policy (your shadow-AI lever) · an incident path |
| **May** *(optional)* | adopt a voluntary code of conduct · name an AI owner — none is mandated · go beyond the minimum to earn trust |

<p class="ref">Art. 4 (literacy) · Art. 50 (transparency) · Art. 5 (prohibited) · Arts. 26–27, 49 (high-risk deployer) · Art. 95 (voluntary codes)</p>

Note:
Org-level companion. Framed must/should/may.

MUST — unconditional, lands on (almost) every deployer:
- Art. 4 AI literacy — staff who use/oversee AI must be trained. Enforceable since 2 Feb 2025. Satisfied by a documented programme, NOT a filing.
- Art. 50 transparency — disclose user-facing AI / label the narrow deepfake & public-interest-text cases.
- Art. 5 — never deploy a prohibited practice.
- CONDITIONAL must (only if Annex III → high-risk): Art. 27 FRIA + notify the authority (public bodies, public-service providers, credit/insurance); Art. 26 logs ≥6 months, human oversight, monitor, consult worker reps (26(8)); Art. 49 register (public authorities). + GDPR Art. 35 DPIA in parallel. Build/brand a high-risk system → you're a PROVIDER (tech docs, QMS, conformity, CE, post-market, incident reporting — the full load).

SHOULD — not mandated at limited risk, but sensible AND the prerequisite to knowing your obligations: AI inventory, per-use-case risk classification, acceptable-use policy (the shadow-AI control), incident path. Mostly reuses existing GDPR + InfoSec governance — not a new bureaucracy. The real job is inventory + classification; the duties just follow from the tier.

MAY — genuinely optional: Art. 95 voluntary codes of conduct (high-risk-style rigour for non-high-risk systems); naming an AI lead (NO mandatory "AI officer", unlike GDPR's DPO); exceeding the minimum as a trust play.

Board hooks:
- Myth-buster: at LIMITED risk essentially NO mandated AI-Act paperwork — no published risk analysis, no registration. The mountain only appears at high risk.
- Penalties scale: up to EUR 35M / 7% turnover (prohibited), EUR 15M / 3% (most breaches), EUR 7.5M / 1.5% (wrong info to authorities).
- Where the foundation work pays off: inventory, logging, oversight are the same plumbing — and shadow-AI risk is why you need the policy.
- Untested law; not legal advice — pair with DPO/counsel for high-risk.

---

# 5. Agents in your organisation

## where it pays, how you deploy it, what it takes

---

# Nothing in common but the friction

<div style="display:flex; gap:26px; align-items:baseline; padding:18px 0; border-top:1px solid #e2e4e6">
 <span style="flex:1; font-family:'Agenda',sans-serif; font-weight:700; font-size:28px; line-height:1.15; color:var(--kpv-petrol)">Closing, accruals, forecasting</span>
 <span style="width:340px; flex:none; font-size:16px; line-height:1.25; color:var(--kpv-medium-grey)">Rivian: 15+ days of manual work per monthly cycle</span>
</div>

<div style="display:flex; gap:26px; align-items:baseline; padding:18px 0; border-top:1px solid #e2e4e6">
 <span style="flex:1; font-family:'Agenda',sans-serif; font-weight:700; font-size:28px; line-height:1.15; color:var(--kpv-petrol)">Scheduling and replanning</span>
 <span style="width:340px; flex:none; font-size:16px; line-height:1.25; color:var(--kpv-medium-grey)">Xpress Boats: expedited shipping cost −50%</span>
</div>

<div style="display:flex; gap:26px; align-items:baseline; padding:18px 0; border-top:1px solid #e2e4e6">
 <span style="flex:1; font-family:'Agenda',sans-serif; font-weight:700; font-size:28px; line-height:1.15; color:var(--kpv-petrol)">Troubleshooting, field service</span>
 <span style="width:340px; flex:none; font-size:16px; line-height:1.25; color:var(--kpv-medium-grey)">ABB: 80% of faults resolved self-service</span>
</div>

<div style="display:flex; gap:26px; align-items:baseline; padding:18px 0; border-top:1px solid #e2e4e6">
 <span style="flex:1; font-family:'Agenda',sans-serif; font-weight:700; font-size:28px; line-height:1.15; color:var(--kpv-petrol)">Small purchases</span>
 <span style="width:340px; flex:none; font-size:16px; line-height:1.25; color:var(--kpv-medium-grey)">TotalEnergies: up to 10% cheaper under €50k</span>
</div>

<div style="display:flex; gap:26px; align-items:baseline; padding:18px 0; border-top:1px solid #e2e4e6">
 <span style="flex:1; font-family:'Agenda',sans-serif; font-weight:700; font-size:28px; line-height:1.15; color:var(--kpv-petrol)">Chasing anomalies</span>
 <span style="width:340px; flex:none; font-size:16px; line-height:1.25; color:var(--kpv-medium-grey)">AWS: each cost anomaly investigated, not just flagged</span>
</div>

</div>

<p class="ref">public cases; Rivian, ABB and AWS are company-attributed, Xpress Boats and TotalEnergies are vendor case studies about a named customer</p>

Note:
Point = the SPREAD. Finance, planning, field service, procurement, IT cost control.
Read the five out loud first. Room arrived thinking "AI writes text".

PATTERN, say it once:
- Agent lowers the fixed cost of running a coordination task.
- Expensive setup -> you did it rarely -> stale -> suboptimal.
- Not better work. Cheaper repetition. The gain is CADENCE, not speed.

Why enterprise IT never got here: automation needs the task IDENTICAL. Coordination
work never is. Agents need it only SIMILAR. That is the unlock.

THE CASES

1. RIVIAN — closing, accruals
- Stuck: assembling it IS the work. So quarterly, or yearly.
- Agent: PO accruals for custom tooling. Pulls from SAP, builds the model, chases PO
  owners for delivery dates, computes the accrual, parks journal entries for a human.
- 15+ days of manual work per monthly cycle. Their own finance director says so.
- AWS for SAP blog, 13 Aug 2026. SAP's own page has no number — cite the AWS post.
- Reaches SAP over MCP. Callback to the MCP slide.

2. OURS — forecasting
- Budget forecast: yearly -> monthly.
- The forecasting barely changed. Reassembling it stopped costing a week.

3. XPRESS BOATS — scheduling, replanning
- Stuck: the algorithm was never the problem. Gathering the inputs was.
- Aluminium boat builder. Agents found bottlenecks across procure-to-pay and
  order-to-cash.
- Expedited shipping cost -50%, returns handling -95%.
- AWS/Infor release, customer named and quoted.

4. ABB — troubleshooting, field service
- Stuck: collecting the logs and the manual cost more than escalating to someone else.
- Technician scans the device QR code. Agent reads device data, logs, manuals. Returns
  a plain-language diagnosis with repair steps.
- 80% resolved self-service, ~15% remote specialist, ~5% site visit. ABB's own testing.

5. TOTALENERGIES — small purchases
- Stuck: under 50k, not worth chasing a price or a framework deal.
- Agent drafts the spec, finds suppliers, matches framework agreements, checks
  compliance rules, proposes.
- Up to 10% cheaper on some categories. Microsoft case study.

6. AWS — chasing anomalies
- Stuck: an alert nobody has time to chase is the same as no alert.
- Agent investigates: usage-driven or rate-driven? which API call, which identity,
  likely owner. Ends with a root cause, not a dashboard.
- No fleet number published — one worked example. Say so if pressed.

TWO FACES of the same mechanism:
- FREQUENCY — annual becomes monthly, quarterly becomes continuous.
- THRESHOLD — the small purchase, the small anomaly now clear the bar. That is the
  "what do you say no to" probe, two slides on, with a mechanism behind it.

THE LIMIT: cadence has a ceiling, and the agent is not what sets it. How fast can the
organisation absorb a new answer? An hourly replan nobody acts on is churn.

IF ASKED, deliberately absent:
- Maintenance history. TotalEnergies MARGE, 25-45% better fault-cause identification.
  Classifies reports rather than taking steps -> AI, not an agent.
- Toyota paint defects, BlueScope predictive maintenance. Both ML-assisted human
  decisions in the vendors' own words.
- AGCO quality triage, Ericsson test suites, any named production-rescheduling number:
  could not be found at all.

PROVENANCE: Rivian, ABB, AWS = company-attributed. Xpress Boats, TotalEnergies =
vendor case studies about a named customer.

---

# Where the value actually lives

![w:1180 h:504](./assets/ail-a92f08ca.svg)

</div>

Note:
Two ways to point an agent, both apply in EVERY function (Legal, Ops, Sales, Analysts, Product, Support, Finance, HR — most knowledge work, not code):
- CUT COSTS — do today's work cheaper. Genuinely useful, not trivial.
- DIFFERENTIATE — do it better, or do what others can't. The edge isn't the model (everyone runs the same agent — like everyone has Word); it's how you apply it to YOUR data, craft and people, and that compounds.
Why prioritise differentiation even though cost-cutting is worth doing — the downside of being late is asymmetric:
- Late to cut costs = a bit less efficient (recoverable).
- Late to differentiate = a rival redefines the offer, your efficient version of the old thing stops mattering (can't undo).
- Tagline: be late to differentiate, and the cost savings stop mattering.
- Sets up the stories below: tenders = the cost-only trap (cheap scale floods, fit drops); 1-2-1 prep = the reframe to a people-business edge.

---

# Where do we start looking?

<div style="display:flex; gap:24px; align-items:baseline; padding:14px 0; border-top:1px solid #e2e4e6">
 <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:21px; line-height:1.2; color:var(--kpv-petrol); width:400px; flex:none">Where does work wait?<span style="display:inline-block; font-family:'Agenda',sans-serif; font-weight:700; font-size:12px; letter-spacing:1.3px; text-transform:uppercase; padding:2px 7px; border-radius:3px; margin-left:9px; vertical-align:3px; background:rgba(29,110,136,.14); color:var(--kpv-petrol)">research</span></span>
 <span style="font-size:19px; line-height:1.32; color:#2b2724">Not where it is busy. Where it queues. Speeding up anything else changes nothing you can measure.</span>
</div>

<div style="display:flex; gap:24px; align-items:baseline; padding:14px 0; border-top:1px solid #e2e4e6">
 <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:21px; line-height:1.2; color:var(--kpv-petrol); width:400px; flex:none">What do you say no to?<span style="display:inline-block; font-family:'Agenda',sans-serif; font-weight:700; font-size:12px; letter-spacing:1.3px; text-transform:uppercase; padding:2px 7px; border-radius:3px; margin-left:9px; vertical-align:3px; background:rgba(186,36,21,.13); color:var(--kpv-primary)">ours</span></span>
 <span style="font-size:19px; line-height:1.32; color:#2b2724">Bids not made. Customers too small to serve. Questions nobody has time to answer.</span>
</div>

</div>

Note:
Four minutes, in silence: everyone writes one answer per question. Then a few out
loud. This is the part of the session the room asked for — five of the seven
pre-session replies said some version of "I don't know where it pays off".

Probe by probe:
- WAITS is Goldratt's constraint, 1984. Improving a non-constraint yields nothing,
  which is the cleanest explanation for a pilot that works and changes nothing.
- HOURS is the fundable one. Do not dismiss cost: in a company that cannot hire,
  released hours are capacity, and that is a growth argument, not a savings one.
- GLUE finds the coordination tax. A plan that lives in a project file AND in
  everyone's inbox, with a human as the sync protocol between them.
- NO is the only probe that finds work that does not exist yet. It is also the one
  people answer badly, because it asks what they are failing to do — if the room
  goes quiet, ask instead "what would you do with two more engineers?".

Departments are the anti-pattern because they are not a property of the work. Every
probe above cuts across them.

---

# Which one first?

<div style="display:flex; gap:24px; align-items:baseline; padding:14px 0; border-top:1px solid #e2e4e6">
 <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:21px; line-height:1.2; color:var(--kpv-tangerine); width:400px; flex:none">Can you easily tell if it is wrong?<span style="display:inline-block; font-family:'Agenda',sans-serif; font-weight:700; font-size:12px; letter-spacing:1.3px; text-transform:uppercase; padding:2px 7px; border-radius:3px; margin-left:9px; vertical-align:3px; background:rgba(186,36,21,.13); color:var(--kpv-primary)">ours</span></span>
 <span style="font-size:19px; line-height:1.32; color:#2b2724">Work whose output always looks right is the dangerous kind.</span>
</div>

<div style="margin-top:10px; padding-top:11px; border-top:1px solid #e2e4e6; font-size:17px; color:var(--kpv-medium-grey)">Three yeses is a candidate. Two is a maybe with a named fix. One is a slide.</div>

<div style="margin-top:24px; padding:14px 20px; border:2px solid var(--kpv-primary); border-radius:8px; font-size:19px; line-height:1.35; color:#2b2724"><strong style="font-family:'Agenda',sans-serif; font-size:22px; color:var(--kpv-primary); display:block; margin-bottom:5px">Then pick by learning speed, not size</strong>Start with the one whose owner knows <strong>within a week</strong> whether it worked — and name the number it should move before you build.</div>

</div>

<p class="ref">Dell'Acqua et al., "Navigating the Jagged Technological Frontier", Organization Science (2025) — 758 consultants: +40% quality inside the frontier, 19 points worse than colleagues using no AI outside it</p>

Note:
Why verification is the first criterion, and the study is worth naming out loud:
758 BCG consultants, 18 tasks, published in Organization Science. Inside the
frontier: 12.5% more tasks completed, 25.1% faster, 40% higher quality. Outside it,
the AI-assisted group scored 19 points WORSE than colleagues with no AI at all.

The two tasks looked equally hard to a human. One was creative product work. The
other hid a contradiction between a spreadsheet and a set of interview notes, and
the model argued the wrong answer well. Nobody can tell from the outside which side
a candidate falls on — so choose work where finding out costs a minute.

The rule is the punchline. The first project's job is to teach you how to choose
the second one; picking the biggest candidate first is how pilots become
statistics. In practice the winner is usually a cost or capacity case: measurable,
cheap to check, and it funds the platform the revenue cases need.

High stakes never rules a use case out — it rules out the agent acting alone. Say
that here if the room is safety-critical; it is the same principle as question 4 of
the legal slide.

Ours, not from the literature: verification cost as the first criterion, and "what
do you say no to" as a probe. No published framework scores either.

---

# Success story: dynamic budget forecasting

<p style="font-size:0.78em; font-weight:600; color:#111; margin:14px 0 4px">“What happens to our cash if we land that big order?”</p>
<p style="font-size:0.56em; color:var(--kpv-medium-grey); margin:0 0 26px">Asked in a sentence. Answered for the whole year, on your own numbers.</p>

<div style="display:flex; gap:26px; align-items:stretch; max-width:1180px; margin:0 auto; text-align:left">
<div style="flex:1; background:#f6f7f8; border-radius:10px; border-top:6px solid var(--kpv-medium-grey); padding:22px 24px 24px; display:flex; flex-direction:column">
  <div style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.82em; color:var(--kpv-medium-grey); line-height:1.1">As planned</div>
  <div style="margin-top:9px; font-size:0.5em; line-height:1.3; color:var(--kpv-dark-grey); min-height:2.6em">Today's drivers, nothing changes.</div>
  <div style="margin-top:auto; padding-top:14px; font-family:'Agenda',sans-serif; font-weight:700; font-size:1.5em; color:var(--kpv-medium-grey); line-height:1">€420k</div>
  <div style="font-size:0.4em; letter-spacing:1.4px; text-transform:uppercase; color:var(--kpv-medium-grey); margin-top:4px">year-end cash</div>
</div>
<div style="flex:1; background:#f6f7f8; border-radius:10px; border-top:6px solid var(--kpv-primary); padding:22px 24px 24px; display:flex; flex-direction:column">
  <div style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.82em; color:var(--kpv-primary); line-height:1.1">The big order</div>
  <div style="margin-top:9px; font-size:0.5em; line-height:1.3; color:var(--kpv-dark-grey); min-height:2.6em">One extra project, three hires from March.</div>
  <div style="margin-top:auto; padding-top:14px; font-family:'Agenda',sans-serif; font-weight:700; font-size:1.5em; color:var(--kpv-primary); line-height:1">€690k</div>
  <div style="font-size:0.4em; letter-spacing:1.4px; text-transform:uppercase; color:var(--kpv-medium-grey); margin-top:4px">year-end cash  ·  +270k</div>
</div>
<div style="flex:1; background:#f6f7f8; border-radius:10px; border-top:6px solid var(--kpv-petrol); padding:22px 24px 24px; display:flex; flex-direction:column">
  <div style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.82em; color:var(--kpv-petrol); line-height:1.1">The bad year</div>
  <div style="margin-top:9px; font-size:0.5em; line-height:1.3; color:var(--kpv-dark-grey); min-height:2.6em">Input costs up a fifth, sales soften.</div>
  <div style="margin-top:auto; padding-top:14px; font-family:'Agenda',sans-serif; font-weight:700; font-size:1.5em; color:var(--kpv-petrol); line-height:1">€180k</div>
  <div style="font-size:0.4em; letter-spacing:1.4px; text-transform:uppercase; color:var(--kpv-medium-grey); margin-top:4px">year-end cash  ·  −240k</div>
</div>
</div>

<p class="ref">our own budget: once a year in a spreadsheet, now rolling monthly · with The House of Support · figures illustrative</p>

Note:
Replaces the 1-2-1 preparation story. This one is better: it IS the cadence pattern
from the inspiration slide, it is ours, and there is a partner behind it, so it
answers "what do you actually do" without a customer clearance.

The story in three beats:
1. Everyone recognises the job. Budgets and cashflow forecasts have lived in
   spreadsheets since Lotus 1-2-3 in 1983 — slow to build, only the author
   understands the assumptions, and a dragged formula breaks it silently.
2. Budgeting tools help until reality gets specific. If your margin rides on the
   cost of skilled labour, your budget has to reflect THAT, not a generic template.
   And one future is never enough — copying Excel sheets per scenario is how you lose
   track of which one you are looking at.
3. So the agent works from your reporting lines, derives the parameters, and lets you
   adapt them. The scenario cards are the payoff: same budget, three futures.

Say the cadence line out loud, because it is the whole reason this slide sits here:
we used to do this once a year. Now it rolls monthly, and the forecasting itself
barely changed — what changed is that reassembling it no longer costs a week.

The definition worth repeating verbatim: a budget is not a document written in January
and defended for eleven months, it is a model that absorbs actuals as they land and
reforecasts the rest of the year on its own. Rolling twelve months, monthly
granularity, variance explained per parameter.

It reads from the bookkeeping and the time registration and does NOT write back into
them. Useful when someone asks about risk: a management instrument, not an accounting
one, and it touches no statutory reporting.

KEEP IT GENERAL. The partner engagement behind this runs on a confidential functional
analysis. Naming the partner is fine, naming their brands, their systems or their
client structure is not — the deck is published to a public URL and these notes are
published with it.

The three figures are illustrative, not our numbers. Say so if asked; do not let the
room take 420k / 690k / 180k as Kapernikov's cash position.

If asked how it is built: it reads the business reporting, so actuals and budget can
be compared on the same lines, and the derived parameters are visible and editable
rather than buried in formulas. That visibility is the whole difference from a
spreadsheet — the assumptions are objects you can inspect, not cells you have to
reverse-engineer.

---

# Success story: submitting public tenders

<div style="flex:1; text-align:left">
    <p style="font-size:1.1em; line-height:1.5">Public tenders are <strong>text-heavy and tightly specified</strong> — exactly what LLMs are good at. An agent parses the spec, matches it to our profiles, and drafts the submission. Cheap, fast, scalable.</p>
  </div>

</div>

Note:
NOT a win. This is the trap.

- Read the claim straight first. Sounds great.
- Then the turn: so can everyone else.
- Cheap to produce -> volume explodes -> fit drops -> your edge is gone.
- Same agent, same price, for every competitor. Like Word.

The line: the edge is not submitting more, it is winning the right ones.

Careful, and use it: Infrabel is on the RECEIVING end of that flood. Kwidea does
procurement law. Say so out loud - "some of you get this in your inbox" - and it lands
as insight instead of a boast.

Pairs with the value slide: cost-only wins get competed away, differentiation compounds.

---

# Productivity gains?

> Only ~10% of companies report a measurable productivity gain from AI so far — *NBER "Firm Data on AI," 2026 (≈6,000 executives)*

![w:912 h:420](./assets/ail-0f8d383f.svg)

</div>

Note:
The productivity J-curve.
- A general-purpose technology SUPPRESSES measured productivity at first: complementary work (process redesign, retraining, reorg) is expensed before payoff appears. Dip = pay first; harvest = gains compound later.
- The gap between "what's promised" (straight climb) and the actual curve now → the skeptical headlines: MIT's "95% no P&L impact" and METR's "−19%" are measurements taken IN THE DIP.
- Tagline stat: ~6,000-firm survey across four advanced economies (NBER WP 34836, "Firm Data on AI", 2026): ~70% now use AI but ~90% report NO measurable impact "so far" — yet same firms predict AI will lift productivity ~1.4% over next three years. "Nothing yet, but a boom is coming" = the J-curve in firms' own words.
- Roughly at the inflection in early 2026 — Brynjolfsson argues the harvest is just beginning (US productivity ~2.7% in 2025, ~2× the decade average).
- Normal pattern, not an AI failure: electricity took ~30 years (1882 → visible aggregate impact), the PC over a decade. (Brynjolfsson–Rock–Syverson 2021; David 1990; ILO Aggregation Paradox 2026.)
- Takeaway: measure the WORKFLOW CHANGE, not the tool — start the unglamorous foundation work early, it's the slow part and therefore the moat.

---

# From a local win to a company-wide gain

The International Labour Organization identified the conditions for local wins to translate into organisation-wide gains. The three a firm controls:

| ILO condition | Your move |
|---|---|
| **Adoption breadth** | get the agent **everywhere**, not one team |
| **Complementary human capital** | **train people** to use, adapt and supervise it |
| **Complementary intangible investment** | **redesign the workflow + fix the data** — the slow, expensive part |

**The personal win:** tasks run **10–70%** faster. **The organisational win:** ~**4 in 5** firms that adopt AI report *no* measurable productivity gain — yet.

<p class="ref">Chan & Shedania (2026), <em>The Aggregation Paradox of AI</em>, ILO Research Brief — Table 2 (three of eight conditions, at firm level); task gains 10–70%; ~4 in 5 adopters report no measurable gain (Yotzov 2026)</p>

Note:
The honest table — faithfully translates ILO Table 2 to the firm level.
- ILO Table 2 ("Conditions for Translating Micro-Level Gains to MACROECONOMIC Impact", 8 rows) is a one-firm→all-firms ECONOMY translation. The excavator story is the same shape one level down (one team→all teams inside a company). Keep only the rows that survive the level-shift:
  - KEEP (firm actions): Adoption breadth · Complementary human capital · Complementary intangible investment.
  - DROP: Measurement adequacy; Competitive dynamics, Labour-market adjustment, Regulatory environment (economy-only weather); Digital & physical infrastructure (data-infra half already inside "intangible investment", rest is macro).
- Left column = the ILO term (faithful, not invented); right column = the firm's move. Maps to spread · train · rebuild.
- Hard number: Yotzov et al. 2026 (~6,000 execs) — ~FOUR-FIFTHS report NO measurable productivity gains despite adopting; Aldasoro 2026a (EIB, >12k firms) — AI raises labour productivity ~4% on avg but CONCENTRATED in medium/large firms.
- On-message ILO quote: gains "depend less on the capabilities of frontier AI developers and more on whether firms … can integrate AI into workflows, upgrade skills and redesign jobs."

---

# Nobody chose to start this

<div style="border-top:5px solid var(--kpv-tangerine); background:#f6f7f8; border-radius:8px; padding:20px 24px 21px; display:flex; flex-direction:column; gap:9px">
  <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.56em; letter-spacing:1.7px; text-transform:uppercase; color:var(--kpv-tangerine)">Stage 1 · it already started</span>
  <h2 style="font-size:1.12em; line-height:1.08; margin:0; color:#111">The eager team</h2>
  <ul style="margin:0; padding-left:1.05em; line-height:1.34">
   <li>Developers ship with frontier tools because the case is too good to ignore.</li>
   <li>Everyone else quietly uses their own account.</li>
   <li>Real wins, invisible to the P&L.</li>
  </ul>
  <div style="margin-top:auto; padding-top:10px; border-top:1px solid #e2e4e6; font-size:0.6em; color:var(--kpv-medium-grey); line-height:1.3">Roughly <strong style="color:var(--kpv-tangerine)">half</strong> of employees use AI tools their employer never approved — and senior managers are about <strong style="color:var(--kpv-tangerine)">twice</strong> as likely to do it as their staff.</div>
 </div>

<div style="display:flex; flex-direction:column; align-items:center; justify-content:center; gap:7px; padding-top:26px">
  <div style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.58em; letter-spacing:1.1px; text-transform:uppercase; color:var(--kpv-medium-grey); text-align:center; line-height:1.25">training<br>proof of concept</div>
  <div style="width:100%; height:2px; background:var(--kpv-light-grey); position:relative">
   <div style="position:absolute; right:-1px; top:-4px; border-left:9px solid var(--kpv-light-grey); border-top:5px solid transparent; border-bottom:5px solid transparent"></div>
  </div>
 </div>

<div style="border-top:5px solid var(--kpv-petrol); background:#f6f7f8; border-radius:8px; padding:20px 24px 21px; display:flex; flex-direction:column; gap:9px">
  <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.56em; letter-spacing:1.7px; text-transform:uppercase; color:var(--kpv-petrol)">Stage 2 · someone owns it</span>
  <h2 style="font-size:1.12em; line-height:1.08; margin:0; color:#111">A team that carries it</h2>
  <ul style="margin:0; padding-left:1.05em; line-height:1.34">
   <li>One enabling team: tooling, guardrails, the safety net.</li>
   <li>Proven wins get spread instead of re-invented.</li>
   <li>Access, logging and review become somebody's job.</li>
  </ul>
  <div style="margin-top:auto; padding-top:10px; border-top:1px solid #e2e4e6; font-size:0.6em; color:var(--kpv-medium-grey); line-height:1.3">You don't have an AI problem. You have <strong style="color:var(--kpv-petrol)">every team solving it separately</strong> — which means every team creating risk separately.</div>
 </div>

<div style="display:flex; flex-direction:column; align-items:center; justify-content:center; gap:7px; padding-top:26px">
  <div style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.58em; letter-spacing:1.1px; text-transform:uppercase; color:var(--kpv-medium-grey); text-align:center; line-height:1.25">governance<br>risk</div>
  <div style="width:100%; height:2px; background:var(--kpv-light-grey); position:relative">
   <div style="position:absolute; right:-1px; top:-4px; border-left:9px solid var(--kpv-light-grey); border-top:5px solid transparent; border-bottom:5px solid transparent"></div>
  </div>
 </div>

<div style="border-top:5px solid var(--kpv-primary); background:#f6f7f8; border-radius:8px; padding:20px 24px 21px; display:flex; flex-direction:column; gap:9px">
  <span style="font-family:'Agenda',sans-serif; font-weight:700; font-size:0.56em; letter-spacing:1.7px; text-transform:uppercase; color:var(--kpv-primary)">Stage 3 · the work changes</span>
  <h2 style="font-size:1.12em; line-height:1.08; margin:0; color:#111">The whole company</h2>
  <ul style="margin:0; padding-left:1.05em; line-height:1.34">
   <li>Processes redesigned around agents, not decorated with them.</li>
   <li>This is where measurable margin finally shows up.</li>
   <li>Slow, expensive, and worth it — if you got here honestly.</li>
  </ul>
  <div style="margin-top:auto; padding-top:10px; border-top:1px solid #e2e4e6; font-size:0.6em; color:var(--kpv-medium-grey); line-height:1.3">Only <strong style="color:var(--kpv-primary)">7%</strong> of organisations have fully scaled AI; for agents, <strong style="color:var(--kpv-primary)">23%</strong> are scaling anywhere at all.</div>
 </div>

</div>

<div style="margin-top:22px; display:grid; grid-template-columns:1fr 88px 1fr 88px 1fr; align-items:start; text-align:left; font-size:0.6em">
 <div></div>
 <div></div>
 <div style="border-left:4px solid var(--kpv-primary); padding:2px 0 2px 12px">
  <span style="display:block; font-family:'Agenda',sans-serif; font-weight:700; font-size:0.6em; letter-spacing:1.3px; text-transform:uppercase; color:var(--kpv-primary); margin-bottom:3px">We help here</span>
  <span style="line-height:1.3">Train your people, and build one proof of concept that survives contact with production.</span>
 </div>
 <div></div>
 <div style="border-left:4px solid var(--kpv-primary); padding:2px 0 2px 12px">
  <span style="display:block; font-family:'Agenda',sans-serif; font-weight:700; font-size:0.6em; letter-spacing:1.3px; text-transform:uppercase; color:var(--kpv-primary); margin-bottom:3px">And here</span>
  <span style="line-height:1.3">The platform, the guardrails, the audit trail — and the AI Act homework that comes with them.</span>
 </div>
</div>

Note:
Replaces the blank REAP decision matrix. The matrix said these three were a CHOICE and
explicitly not a ladder. That stance doesn't survive the evidence: grassroots is not a
strategy anyone selects, it is what has already happened everywhere. So stage 1 is a
description of the present, not an option — say that out loud, it is the whole hook.

What moves an organisation right is not ambition, it is the bill arriving: training,
a proof of concept that has to become a real system, governance, risk. Those four words
sit on the arrows deliberately — they are the loose ends the room is already feeling.

The offering hangs off the TRANSITIONS, not the stages. Don't apologise for the two red
blocks; the room asked what we actually do.

Risk appetite hasn't disappeared, it decides PACE. That is a spoken line, not an on-slide
one, and it is where the old matrix's self-locating debate can still be run verbally if
the room is lively ("who here is still fully in stage 1?").

Numbers, with their real provenance:
- Shadow AI ≈ half of employees, managers ~2x their staff — vendor surveys (BlackFog and
  similar), self-reported, "unapproved" often just means no policy exists. Say "roughly
  half", never a decimal, never a single-source citation.
- 7% fully scaled / 23% scaling agentic — McKinsey State of AI 2025. Measures
  self-reported scaling, not P&L impact; pairs with the MIT NANDA and McKinsey EBIT
  numbers in the honest-measurement block.
- "Every team solving it separately creates risk separately" is the standard argument for
  a central enabling team — it is a governance argument, not a measured finding.

---

## How you deploy it

---

# On a laptop — everything local except the model

![w:1000 h:540](./assets/ail-9ee84a1c.svg)

</div>

Note:
- The canonical case everyone pictures: the same agentic loop, most familiar habitat. GUI, loop, tools and codebase all on the machine; only the model call leaves it.
- Examples: Claude Code, Cursor, Codex CLI. What most agents do today — the origin point.
- Next: the judgement burden it creates, then architectures that move WHERE the loop runs to relieve it.

---

# In the cloud

![w:1000 h:540](./assets/ail-f429b5ca.svg)

</div>

Note:
- Same loop, hosted. Loop, tools, cloned codebase AND model all run in the vendor's cloud — the vendor IS the model provider (pick from its catalog: Azure AI Foundry in Copilot Studio, the Bedrock catalog — not an arbitrary outside model). Only the GUI is on your side.
- Examples: OpenAI Codex (cloud), GitHub Copilot coding agent, Google Jules; Microsoft Copilot Studio, AWS Bedrock Agents.

---

# Embedded in your product

![w:1000 h:540](./assets/ail-336c2098.svg)

</div>

Note:
- Same loop, shipped inside a product. GUI = your product's UI in the customer's browser; loop + tools run on YOUR servers; tools act on your own data; model stays an external, swappable provider.
- The human is your end customer, not an operator.
- Example: fullstack-sota — a server-side agentic loop whose tools are the app's own functions (get_team, search_allocations, …).
- The architecture execs most underrate.

---

# Treat your people as creative individuals

| Don't | Do |
|---|---|
| one project for one use case — the "request-holiday bot" | **embrace flexibility** offered by agents  |
| a workflow scripted by the project team, frozen at go-live | **let workflows emerge** — the people doing the work improve and invent them |
| assume the tool does the thinking | **train the skills** — agentic workflows, skills & tools |

> Your workforce is creative. Give them a tool they can shape — and the skills to shape it — not a box that does one thing.

<p class="ref">shadow-AI surveys (2026): ~90% pick general-purpose frontier tools; single-purpose enterprise builds get dropped for them</p>

Note:
Holds regardless of which infra you choose.
- Failure mode isn't just "unchanged workflow" — it's spending a whole project to narrow a GENERAL-purpose technology down to ONE use case (the holiday-request bot, glorified RAG bolted onto Teams). Throws away the "G" — the value of a GPT is its breadth.
- Shadow AI: ~90% reach for general-purpose frontier tools on their own; a lawyer dropped a $50K single-purpose enterprise tool because ChatGPT's output was better. People route around the narrow bought tool.
- ILO: scaling needs "system-level redesign", "not merely substitution of AI for human effort at isolated task nodes" (Agrawal/Gans/Goldfarb).
- Training is the enabler: people can only be creative with agentic workflows if taught the skills/tools — the human-capital row of the prior slide, made concrete.
- Takeaway: buy/build for breadth, train people to wield it, let workflows emerge.

---

## Agentic coding

---

# The platform — and the team that owns it

![w:1180 h:533](./assets/ail-b01c9583.svg)

</div>

Note:
- Getting the most from agents needs investment in architecture + DevSecOps, owned by a strong central ENABLING team — data-mesh shape: it doesn't build the products, it provides the platform, standards and methodology that let specialist product teams move fast and safely. The multiplier, not the bottleneck.
- Concrete (Kapernikov as proof): GitLab e2e tests + review apps, automated security & dependency scanning, observability, a trusted starter kit (authn/authz, tech stack) — fullstack-sota.
- The foundation is also how you manage the review burden: machine-review (tests, scans, review apps) runs before a human looks, shrinking the review surface.
- "Look beyond code, but don't ignore it" — discipline pioneered in engineering, exported to the rest of the org. Same guardrails let non-technical people use agents safely (next subsection).

---

# A pipeline that catches defects

![w:900](./assets/ail-106d255a.svg)

</div>

<p class="ref">our batteries-included starter kit (fullstack-sota): review apps · security & dependency scanning · e2e tests · error tracking · daily perf benchmarks — the net is there from commit 1</p>

Note:
DevSecOps as a competent safety net for AI blunders; institutionalise the equivalent in other knowledge work. Two ideas:
1. REVIEW IS THE NEW BOTTLENECK → make it easy again. Agents make code cheap, so verification/review is where the cost moves (cf. wellbeing "all judgement, no breather"). The net automates the review surface so humans glance at green + focus on judgement.
2. FEEDBACK SIGNALS TO AGENTS = success criteria. Each stage is a machine-checkable signal the agent self-corrects against ("if it can evaluate the result, it can solve it"). Pre-merge gates (scan/tests+e2e/review-deploy) + always-on production instruments (error tracking, Sentry-compat; perf benchmarks, Prometheus, daily regression).
- Verbal extension: in non-dev knowledge work, build the same kind of net / "clear negative signal on AI slop at a dry-run". Ties to the platform slide above.

---

# 6. Impact on HR

## Hiring, training, wellbeing

---

# The judgement burden

</div>

Note:
- The problem with the local / general-purpose setup: a general-purpose agent turns every action into a judgement call — and lands them on people not trained to make them.
- Two kinds of calls pile up. PERMISSION calls: connect it to LinkedIn? legal? safe? run this script? And TRUST calls: do I trust this analysis? good enough to send? Security tooling only ever sees the first kind.
- (Animated: calls pop up one per click and pile up — the two trust calls come last, as the escalation.)
- Opens the chapter: the demand, concrete and on screen, before the next slide names it as leg 1 of the trap. Park the answer — it comes at "Relieve, and train", after the supply side.

---

# The judgement trap

Agents commoditise fluency. Judgement becomes the bottleneck:

1. **They need more of it** — the agent has none of its own; every output and action lands as a call on your people
2. **They quietly erode it** — judgement was built by doing exactly the work the agent just took over
3. **They hide the loss** — the small failures that kept people calibrated stop happening

> Demand up, supply down — and the gap is invisible from the inside.

Note:
The thesis slide for the whole judgement arc. Each numbered line is a header for what
follows: 1 → the burden just seen + judgement blindness (demand), 2 → the leaky
abstraction (supply), 3 → Dunning–Kruger (invisibility), and the closing line → "why
it's a trap". Spoken thread that holds the six slides together: the agent didn't take
the judgement work — it took everything else, and left the judgement.

---

# Judgement blindness

<div style="flex:1.3; text-align:left">
    <p>LLMs are capped at the text they learned from. They can be confidently wrong — with no world model underneath to catch it.</p>
    <ul style="line-height:1.4">
      <li>LLMs lack the context and situational awareness.</li>
      <li>Your "no, not at this customer" beats the agent's analysis: your world model holds the reality that was never in the text.</li>
    </ul>
    <p class="ref">LeCun (2026): LLMs lack grounding & a world model</p>
  </div>

<div style="flex:1; text-align:center">
    <img src="assets/youre-absolutely-right.png" style="max-height:480px; max-width:100%; border-radius:6px" />
    <p class="ref">"You're absolutely right" · via Reddit, r/BlackboxAI_</p>
  </div>

</div>

Note:
- No world model (LeCun): capped at the corpus; can't exceed the average of what was written, can't check text against reality.
- YOUR "no, not at this customer" beats the agent's analysis — your world model holds the customer reality that was never in the text.
- Leg 1 of the trap slide, other half: the agent brings no judgement of its own — which is why the calls in the opening slide land on people.

---

# The leaky abstraction

An agent is an abstraction over the work — and **all non-trivial abstractions leak** (Spolsky).

- Fine on easy problems, until one is hard enough that it leaks, and you fall through to a layer you never had to learn.
- It saves you time *working*, but not time *learning* the layer beneath — for the day it leaks.

<p class="ref">Spolsky, "The Law of Leaky Abstractions" (2002)</p>

Note:
- All non-trivial abstractions leak (Spolsky); they save time WORKING but not time LEARNING the layer beneath — for the day it leaks.
- The agent is fine until the problem is hard enough to fall through to a layer the person never had to learn.

---

# Dunning–Kruger, steepened

<p style="font-size:0.72em; color:var(--kpv-dark-grey); font-weight:500; margin:0 0 6px">A human constant — AI just extends the stay on the peak.</p>

<div style="text-align:center; margin-top:10px">
  <img src="assets/dunning-kruger.png" style="width:100%; max-width:820px; border-radius:6px" />
  <p class="ref">Dunning–Kruger curve · HealthKart (healthkart.com)</p>
</div>

Note:
- Say the reframe first: Dunning–Kruger is NOT an AI problem. Everyone has always
  started on Mount Stupid — it is a human constant.
- What knocked people off the peak was cheap small failures, early and often. The
  agent deletes exactly those: it front-loads easy wins and absorbs the small
  deflations that used to calibrate you.
- So people don't climb the curve differently — they CAMP on Mount Stupid longer,
  now with production access. The correction still comes, but as one big expensive
  problem instead of many cheap ones.
- Leg 3 of the trap slide: why the erosion is invisible while it happens.

---

# Why it's a trap

> The agent removes the friction — and friction was the teacher. Worse: the competence you'd need to *see* the gap is exactly the competence you skipped.

Dunning–Kruger's double curse: the knowledge to produce a right answer is the same knowledge to recognise one. **The gap is invisible from the inside** — confidence decoupled from competence.

<p class="ref">Dunning–Kruger (1999) · Spolsky (2002) · LeCun (2026) · Microsoft/CMU (CHI 2025): more trust in AI → less critical thinking</p>

Note:
- Why it's a TRAP: Dunning-Kruger double-curse — the knowledge to produce a right answer is the same knowledge to recognise one. So the gap is invisible from the inside. Confidence decoupled from competence is DK with a UI.
- Honest caveat: the DIAGNOSIS has real sources (CHI 2025, LeCun, Spolsky). The REMEDIES (next slides) are well-grounded — desirable difficulties (Bjork) is peer-reviewed learning science — but the AI-specific application is still early. Present them as well-reasoned directions, not proven fixes.

---

# Relieve, and train

![w:1180 h:544](./assets/ail-fdb94e4a.svg)

</div>

Note:
Two axes, because you can't tool your way out of judgement. Carry the two kinds of
calls over from the burden slide: PERMISSION calls (may this happen?) and TRUST calls
(is this right, good enough, does it fit this customer?). Relieving only ever shrinks
the first kind; training has to cover both.
RELIEVE — shrink the permission calls up front:
- prefer embedded / governed agents over a raw general-purpose one (the dangerous action isn't even offered);
- a vetted catalog of pre-approved agents/connectors/use-cases;
- policy & defaults (SSO-scoped connectors, DLP, blocklists) where tooling allows. Owned by the central enabling team.
- BUT can't remove them all — live "vet every action" tooling is immature, and some duties (parts of the EU AI Act) aren't tool-enforceable at all.
TRAIN — for what relieving can't remove:
- the permission calls tools miss, AND every trust call — "do I trust this analysis?", "good enough to send?" — which relieving never touches.
- Both large and unavoidable → build the judgement. The next two slides say what the skill is and who needs which depth.

---

# Working with AI is a trainable skill

![w:1180 h:354](./assets/ail-bb71a53e.svg)

</div>

Note:
Working with AI is a TRAINABLE skill, not a switch you flip. Three facets, matching
the cards left to right:
1. Judgement — navigating the jagged frontier: where to lean on the agent and where
   not. Callback to Dell'Acqua: the frontier is invisible from the outside, so knowing
   which side of it you are on IS the skill.
2. Harness engineering — shaping and constraining the agent with tools, skills, tests
   and workflows, so its output arrives verifiable instead of merely plausible.
3. Adoption — redesigning the workflow around the agent instead of bolting the agent
   onto the old workflow. The ILO "intangible investment" row, at the scale of one
   team's daily work.
Nobody was born with any of the three — that is the point of the title. Who needs
which depth is the training-tiers slide.

---

# Training: match the tier

| Tier | What to train |
|---|---|
| **Developers** | the agentic harness (skills, tests, CI) + code & architecture review; the real risks — prompt injection, least privilege, secrets, `curl\|bash` supply chain |
| **Power users** | building and adapting their own agentic workflows; verifying outputs — right, not just plausible; avoiding shadow-AI data leaks, staying in governed tools |
| **Business users** | AI literacy: when *not* to trust a confident answer — and when it doesn't fit *your* case; confidentiality and AI Act labelling duties |

<p class="ref">verification over prompt tricks — Microsoft/CMU (CHI 2025) · AI literacy is a legal duty — EU AI Act Art. 4 (in force Feb 2025)</p>

Note:
Tier-differentiation angle (doesn't duplicate "Growing judgement").
- Common thread across tiers: train for VERIFICATION & JUDGEMENT, not prompt engineering — Microsoft/CMU CHI 2025 (work shifts to verification/stewardship; antidote = domain self-confidence); Vella & Blincoe 2026 (role → supervisory: direct/evaluate/correct); seniors verify, juniors over-trust. Also "scaffold not crutch" (Frontiers in AI 2025), build self-efficacy (Chuang 2025).
- Tiers = the deployment spectrum (developers / power users / business users); each cell folds CAPABILITY + the relevant RISKS — one table, not two.
- Why train at all: ILO "complementary human capital" is a binding condition (skill demand outpaces supply); AND EU AI Act Art. 4 makes AI literacy a LEGAL duty (in force Feb 2025) — the ref's "teeth". Can promote Art 4 into the lead if more emphasis wanted.

---

# Hiring for judgement

| Look past | Look for |
|---|---|
| polished portfolio, fast task completion | **how they use AI** — a fallible junior to oversee, or an oracle to obey? |
| "knows the stack" trivia | **"a real mistake — and what it cost you"** — confidence calibrated to reality |
| green-field demos | **judgement inside existing systems** & real-world constraints |

Note:
Recruitment — hiring for the human's judgement, not the agent's fluency.
- "Earned vs borrowed confidence" is the spine. The portfolio/CV signal collapsed because it reflects the agent now.
- "How they use AI" = the senior/junior tell: seniors treat the agent as a fallible junior needing oversight; juniors as a genius oracle. Let candidates USE AI in the interview and watch which one they do (Osmani).
- "A mistake and what it cost you" = a Dunning-Kruger calibration probe. Someone with a world model knows the edge of what they know; the DK peak doesn't.
- Landing = the pipeline catch-22. Entry-level tech hiring −25% YoY (2024); devs 22-25 down ~20% (Stanford); internships −30% since 2023. Agents can't transmit tacit knowledge (arXiv 2602.00496) — cutting juniors starves the senior pipeline. Takeaway: hire AND grow them differently, NOT stop.

---

# Growing judgement

You can't only hire it — you have to grow it. And judgement grows from **struggle**, not from being handed the answer.

- **Graduated autonomy** — juniors *earn* delegation; they don't start by outsourcing the thinking.
- **Keep the friction on purpose** — rotate them through what AI is bad at (contradicting information, edge cases). The struggle is the mechanism that builds skill.
- **AI as teaching material, not the deliverable** — defend generated code in review; measure understanding, not tickets closed.

> The agent quietly removes the "desirable difficulties" that build expertise. Put them back — deliberately.

<p class="ref">Bjork: desirable difficulties & the generation effect (struggle strengthens learning) · arXiv 2602.00496 (graduated agency) · Microsoft/CMU CHI 2025</p>

Note:
Development — you can't hire your way out; grow judgement in the people you have.
- "Struggle grows judgement" = Bjork's DESIRABLE DIFFICULTIES — peer-reviewed learning science. Generation effect: solving (and failing) beats reading the answer. The scientific spine of the whole thesis — the agent removes exactly these difficulties.
- Graduated autonomy: the arXiv SE study's "agency allocation" — juniors gradually increase autonomy, not immediately outsource decisions. Over-reliance → "technically accomplished but contextually naive" devs.
- AI as teaching material, not deliverable: use generated code to teach; require juniors to walk through and justify it; assess understanding over output.
- Closes the loop with "The judgement trap": friction was the teacher → put the friction back on purpose. Hands off to wellbeing: "scaffold, not crutch" is the same principle.

---

# Wellbeing: a different kind of tired

- **The slot-machine rush.** Prompt → result → prompt again: intermittent dopamine and adrenaline make agentic work genuinely addictive. Evenings and weekends erode.
- **Flow and breathers go.** The agent takes the low-effort typing and leaves you *waiting* and *reviewing* — passive boredom plus relentless judgement.

![](assets/slot-machine.png)

</div>

<p class="ref">Yegge / LeadDev (2025): agentic coding as a "slot machine" · Multitudes (500+ devs): +19.6% out-of-hours commits · Vella & Blincoe (2026): share reporting worse developer experience doubled 14%→27%, flow most vulnerable · Bainbridge (1983): the automation paradox</p>

Note:
Diagnosis (overt exhaustion).
- Slot-machine rush = variable-reward addiction → overwork ("the same rush as a computer game"). Yegge/LeadDev framing; Multitudes +19.6% out-of-hours commits (behavioural, not a wellbeing metric — keep as colour).
- Flow & breathers = the cognitive-load inversion. Vella & Blincoe (2026, longitudinal, n≈95 devs): the SHARE reporting worsened developer experience in ≥1 dimension nearly DOUBLED 14%→27%; FLOW most vulnerable. NB flow/load mean declines non-significant (p≈.195) — the robust claim is the doubled share, phrase it that way.
- Bainbridge (1983) = the canonical automation paradox (mechanism, substrate-independent).

---

# Wellbeing: hidden costs

- **You quietly deskill.** Lean on the agent for everything and your own edge fades — one developer: *"I've definitely gotten worse because I already rely on the AI."* The dependency builds before you notice.
- **The work can isolate.** More solo prompting, less turning to a colleague. Generative-AI use tracks with workplace loneliness — and loneliness, more than job insecurity, is what turns into psychological distress.

<p class="ref">Frontiers in AI (2025) — genAI technostress, young professionals (qualitative, N=15): dependency & skill loss · Frontiers in Public Health (2026), N=424 (cross-sectional): genAI use → distress, chiefly via workplace loneliness</p>

Note:
Diagnosis (the quieter, slower costs).
- Deskilling/dependency: Frontiers in AI (2025), qualitative N=15 German young professionals USING genAI — verbatim quote "I have definitely gotten worse because I already rely on the AI." Exploratory; cite as illustrative, not generalisable.
- Isolation/loneliness: Frontiers in Public Health (2026), N=424 China, CROSS-SECTIONAL self-report (90% CIs) — genAI use → psychological distress, fully mediated by job insecurity + workplace loneliness, LONELINESS the dominant path (~4x). Information literacy buffered insecurity; AI-ethical-risk perception amplified loneliness. Weak design → directional only; don't imply causation. The freshest, least-obvious angle.

---

# Managing for wellbeing

- **Plan time to verify.** Treat reviewing AI output as real work — allocate it; don't pretend the output is free.
- **Scaffold, not crutch.** Design work so people engage with and justify what the agent produces, rather than rubber-stamp it — the same thing that protects their skill.
- **Move people up to the judgement.** The role shifts to directing, evaluating, correcting. Designed for, a dull task becomes an interesting problem — *"how do I set the agent up so it knows when it's succeeded?"*
- **Protect recovery and connection.** Boundaries against the always-on rush; keep people in contact, not just solo with the machine.

<p class="ref">Frontiers in AI (2025): "explicitly plan… time to review AI output"; "scaffold rather than crutch" · Vella & Blincoe (2026): the role becomes supervisory — directing, evaluating, correcting</p>

Note:
Remedies — each maps onto a diagnosis above, each tied to an on-topic 2025/26 finding (not platitudes):
- Plan time to verify → answers flow/load drain. Frontiers AI (2025): "explicitly plan their verification efforts and allocate time for employees to review AI-generated outputs."
- Scaffold not crutch → answers deskilling. Frontiers AI (2025), verbatim: "GenAI at work should be used as a scaffold rather than a crutch." Ties to the judgement trap.
- Move people up to the judgement → the upside ("dull job → interesting problem: how does the agent know it succeeded?" = success criteria). Grounded in Vella & Blincoe's supervisory reframe (direct/evaluate/correct) + Frontiers AI's "eustress" finding.
- Protect recovery & connection → overwork (Multitudes) + the loneliness path (Frontiers PH 2026: maintain team collaboration, avoid overreliance).
- Deliberately NO tagline / no closing slogan. Honest caveat: agentic-AI wellbeing remedies are early evidence — frame as directions, not proven fixes.

---

# In short

- Agents can automate what is **text-based and well-defined**
- There are **legal and security risks** — and **solutions** for those risks
- **Judgement is for humans** → hire and build the skills to judge

Note:
Wrap-up / recap before the call to action. Three through-lines:
1. where agents help (text-based, well-defined work),
2. risks real but manageable (legal + security, with mitigations),
3. judgement stays human — so the HR answer is hire for it and grow it.

---

![](assets/kapernikov-logo.png)

**Thank you for attending!** — frank@kapernikov.com

<div style="text-align:center">
    <img src="assets/qr-slides.svg" style="position:static; max-width:none; max-height:none; width:290px; height:290px; background:#fff; padding:16px; border-radius:14px">
    <div style="margin-top:14px; font-size:24px; font-weight:600; color:#fff">These slides</div>
    <div style="font-size:18px; color:rgba(255,255,255,0.8)">agentic-coding-workshop.ac.kapernikov.com/executive</div>
  </div>

<div style="text-align:center">
    <img src="assets/qr-review.svg" style="position:static; max-width:none; max-height:none; width:290px; height:290px; background:#fff; padding:16px; border-radius:14px">
    <div style="margin-top:14px; font-size:24px; font-weight:600; color:#fff">Was this useful?</div>
    <div style="font-size:18px; color:rgba(255,255,255,0.8)">Leave us an honest review on Google</div>
  </div>

</div>

Note:
Ask the room out loud, once: "if today was useful, a review helps us a lot — and if
it wasn't, say that too." Ask everyone, ask for an HONEST review, and offer nothing
in return. Incentives, review gating and asking for 5 stars all break Google's policy.
qr-review.svg encodes https://g.page/r/Cd0Uikb5Bdh7EBM/review — same file as the coder
deck (regenerate: qrencode -o assets/qr-review.svg -t SVG -m 1 "<url>").
qr-slides.svg encodes the public executive URL, shared with the QR slide after the
title.