The market for PII-detection-and-redaction tools is growing fast. The right answer for most teams isn't a tool, it's a pattern that lives at the prompt-assembly layer and uses small, cheap models to do the work.
Most AI governance frameworks I've seen are written by people who don't ship code, for people who don't ship code, and applied to people who do. The result is friction, attrition, and shadow AI. The frameworks that actually work share a few specific properties.
Three months past WWDC 2025. The Apple Intelligence pitch was real on the demo stage. The shipped version is more constrained and the timeline gap is widening rather than closing. Worth being concrete about what landed and what didn't.
AI services need a catalog the same way every other internal platform does. The wiki approach falls over the moment you have more than a handful of models. Backstage with a thin AI plugin layer is the pattern that holds, a direct callback to the catalog discipline.
After tuning a lot of prompts across my own workflows and reading deeply across the public corpus, the ratio that keeps holding is roughly 30% prompt instructions to 70% retrieved context. The opposite ratio is what most people start with. Worth being plain about why and when to break the rule.
Two hours of chasing a bug that wasn't where the agent said it was, in a file the agent confidently described and that didn't exist. A close reading of one of the more useful failures of the year.
DeepSeek shipped R2 with open weights, MIT-licensed, frontier-competitive on the benchmarks that matter, and at a price floor that puts more downward pressure on closed-frontier pricing than anything since R1 in January. The asterisks are gone.
If your AI infra depends on third-party container images, you don't control your supply chain. Forgejo on store-01 as the source-of-truth git host, Harbor on engine-01 as the registry plus image-signing layer. The sovereign-infra argument, and why mirroring is non-negotiable now.
The AI security track at Black Hat this year was the most-attended track. The substance under the hype was a real category forming, prompt injection, model exfiltration, agent privilege abuse, that maps closer to 2014 cloud security than anyone wants to admit.
Not every AI workload belongs on Kubernetes. Some belong nowhere else. The patterns that hold up, separating CPU and GPU tiers, sizing autoscaling for serving versus batch, picking the right foundation, and the ones that fall apart at the first real load.
Cloud lock-in in 2010 was bad. AI lock-in in 2025 is worse for reasons most teams aren't thinking about. The data, the prompt patterns, the agentic surface, the fine-tunes, none of it ports cleanly. Worth being clear about why before you commit.
The right unit for AI cost tracking isn't tokens, isn't requests, isn't users. It's conversations. The cost story makes sense when you measure it that way and gets impossible when you don't.
