Notes on infrastructure, operations, and building things that stay up.https://roozjalali.vercel.app/https://roozjalali.vercel.app/posts/the-restraint-of-a-model-that-only-decides/https://roozjalali.vercel.app/posts/the-restraint-of-a-model-that-only-decides/Jev does not write anything, cannot be talked into trying, and ships with a published list of its own weaknesses. I have not admired a piece of AI engineering this much in a while, and the reasons are mostly about what it refuses to do.Sun, 11 Oct 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/token-cost-as-a-design-constraint/https://roozjalali.vercel.app/posts/token-cost-as-a-design-constraint/Caching, batching and routing are the three levers on an inference bill. They are worth roughly ten times, two times and up to a hundred times respectively, and almost everybody reaches for them in the wrong order.Wed, 07 Oct 2026 08:00:00 GMThttps://roozjalali.vercel.app/posts/when-inference-costs-more-than-the-engineer/https://roozjalali.vercel.app/posts/when-inference-costs-more-than-the-engineer/An hour of engineer time buys roughly four million output tokens at top tier rates. Working out where that stops being true, and why the answer has almost nothing to do with which model you picked.Wed, 07 Oct 2026 07:00:00 GMThttps://roozjalali.vercel.app/posts/what-ai-has-not-changed/https://roozjalali.vercel.app/posts/what-ai-has-not-changed/Writing code was never the bottleneck in delivering software. Four pieces into an argument about what the tools changed, here is the larger part of the job they left exactly where it was.Tue, 06 Oct 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/the-cost-of-a-wrong-suggestion/https://roozjalali.vercel.app/posts/the-cost-of-a-wrong-suggestion/Time saved by accepting a suggestion is immediate, visible and easy to count. The cost of accepting a wrong one is delayed, diffuse and lands on somebody else. Guess which one ends up in the productivity deck.Sat, 03 Oct 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/tests-are-the-specification-now/https://roozjalali.vercel.app/posts/tests-are-the-specification-now/When an implementation can be regenerated in a minute, it stops being the valuable artefact. The statement of what the system should do is what survives, and most codebases have never written one down properly.Wed, 30 Sep 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/reading-code-nobody-wrote/https://roozjalali.vercel.app/posts/reading-code-nobody-wrote/Reviewing generated code is a different skill from reviewing a colleague's work. The errors cluster differently, the social signals are gone, and most of us are using the old technique on the new problem.Sat, 26 Sep 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/generation-got-cheap-review-did-not/https://roozjalali.vercel.app/posts/generation-got-cheap-review-did-not/Writing code sped up by a large factor. Reviewing it did not speed up at all. Everything teams are complaining about follows from that one asymmetry.Tue, 22 Sep 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/cedar-and-the-decision-point-my-ai-flow-was-missing/https://roozjalali.vercel.app/posts/cedar-and-the-decision-point-my-ai-flow-was-missing/Cedar is an authorisation language that is deliberately less powerful than its competitors, formally verified, and widely assumed to be an AWS only concern. All three of those are why it was the right tool for gating what an AI flow is allowed to do.Wed, 16 Sep 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/dora-and-the-supplier-your-regulator-now-supervises/https://roozjalali.vercel.app/posts/dora-and-the-supplier-your-regulator-now-supervises/The EU's operational resilience regulation for financial services does something new. It reaches past the regulated firm and supervises its cloud providers directly, nineteen of them, including all three hyperscalers. What that changes, and what it does not.Thu, 03 Sep 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/mapping-cloud-certifications-to-your-controls/https://roozjalali.vercel.app/posts/mapping-cloud-certifications-to-your-controls/AWS, Azure and Google Cloud hold near identical certificate lists and materially different scopes. A side by side comparison, a control by control mapping of what you still owe, and the three places the mapping usually goes wrong.Mon, 31 Aug 2026 18:00:00 GMThttps://roozjalali.vercel.app/posts/security-critical-functions-and-network-oversight/https://roozjalali.vercel.app/posts/security-critical-functions-and-network-oversight/UK telecoms security regulation defines two categories of system, one nested inside the other. The distinction is better thinking than most security frameworks manage, and it applies well outside telecoms.Mon, 31 Aug 2026 15:00:00 GMThttps://roozjalali.vercel.app/posts/measuring-a-control-you-cannot-see-failing/https://roozjalali.vercel.app/posts/measuring-a-control-you-cannot-see-failing/Most detection tools report what they found and say nothing about what they missed. Planting known records is how you get the number nobody will give you.Mon, 31 Aug 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/macie-and-the-hard-problem-of-finding-pii/https://roozjalali.vercel.app/posts/macie-and-the-hard-problem-of-finding-pii/Macie cannot reliably tell a payment card number from one of your own reference numbers. The privacy argument explains why that is hard to fix with your data, and not why it remains unfixed.Sun, 30 Aug 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/iso-42001-and-the-ai-rulebook/https://roozjalali.vercel.app/posts/iso-42001-and-the-ai-rulebook/What ISO 42001 actually is, how AI stresses an existing ISO 27001 management system, and where the rules stand across the EU, US, UK, Asia and the Gulf as of late 2026.Fri, 28 Aug 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/mlops-vs-aiops/https://roozjalali.vercel.app/posts/mlops-vs-aiops/The two names look like siblings and are close to opposites. What each inherits from DevOps, what MLOps has to handle that DevOps never did, and an honest answer on how transformational either one is.Tue, 18 Aug 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/prompt-injection-through-operational-data/https://roozjalali.vercel.app/posts/prompt-injection-through-operational-data/If you point a language model at your logs, tickets or alerts, an attacker who can write to any of those is writing part of your prompt. What that enables, and how to contain it.Tue, 11 Aug 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/stages-of-aiops/https://roozjalali.vercel.app/posts/stages-of-aiops/Two different things get called the stages of AIOps. One is a pipeline, one is a maturity ladder. What each says, where they came from, and how far to trust them.Tue, 21 Jul 2026 09:00:00 GMThttps://roozjalali.vercel.app/posts/what-is-aiops/https://roozjalali.vercel.app/posts/what-is-aiops/A plain English introduction to AIOps. What problem it solves, what the tools do, how far the label stretches, and why most of the value arrives before the AI does.Tue, 23 Jun 2026 09:00:00 GMT