Thomas Talks AI

I write about AI after the demo starts looking convincing: production engineering, Claude architecture, secure AI agents, Claude Code, LLM observability, evals, governance, financial-services controls, and the uncomfortable gap between a model release and a system people can trust.

The common thread is controlled autonomy. What can the system see? What can it change? Who reviews it? What evidence remains when something breaks?

Start here

What is an AI agent?: a practical definition for production teams.
The model release is not your AI strategy: how to stay calm when the AI news cycle moves faster than your roadmap.
From AI POC to production: the operating model that makes AI survive beyond the demo.
LLM observability: why production AI needs replayable evidence, not only dashboards.
Java vs Python for production AI applications: where experiments end and enterprise systems begin.
AI agents in financial services: controls before autonomy.
Agentic coding in production: the operating model around AI coding agents.
AI coding agents: Claude Code, software agents, permissions, evals, and review loops.
CCA-F certification guide: scenario-based preparation for the Claude Certified Architect Foundations exam.

Wider AI notes

Not every useful AI article needs to point straight at a book. Some pieces are here because the topic matters: model releases, vendor churn, AI interfaces, adoption habits, organisational risk, and the way the industry keeps mistaking demos for direction.

I will keep a mix: practical production AI, security and governance, Claude Code field notes, and broader AI commentary when the news cycle exposes something worth saying.

LeanPub

Securing Enterprise AI Agents

AI agent security, bounded autonomy, AgentSecOps, MCP security, RAG governance, and audit evidence.

Book page LeanPub

Kindle + LeanPub

Claude Code: Building Production Agents That Actually Scale

Claude Code in real repos: MCP, permissions, hooks, evals, observability, cost controls, review, and rollback.

Book page Amazon

LeanPub

Architect the Agent: The CCA-F Certification Guide

Scenario-based preparation for the Claude Certified Architect Foundations exam: agentic architecture, MCP, Claude Code, prompts, context, and practice exams.

Book page LeanPub

Build and secure enterprise AI agents in production

What I am trying to answer

Claude Code and other AI coding agents are already useful. The harder question is what happens when they meet real repositories, review habits, permissions, tests, production risk, and now formal architecture certification.

The strongest posts so far:

Latest writing

Why CCA-F wrong answers sound tempting

The hardest CCA-F distractors are often almost right. Learn to spot the architectural boundary they quietly cross.

The Claude Architect exam is a judgment exam, not a memory test

CCA-F study should train scenario judgment: what failed, which boundary was crossed, and which answer makes the agent architecture safer and more reliable.

Cover of Architect the Agent: The CCA-F Certification Guide

Architect the Agent: CCA-F Certification Guide is live

My new Leanpub guide for the Claude Certified Architect Foundations exam is live. It focuses on scenario judgment, distractor analysis, practice exams, and the production architecture behind the badge.

A production AI agent flow with request, approval, action, evidence, and revocation path

If the agent can act, it must be easy to stop

Production AI agents need a revocation path before they get wider authority. If a Claude Code run, MCP tool, workflow agent, or RAG assistant goes wrong, the team should know exactly how to stop it.

An agent permission change moving through proposal, review, tests, approval, rollout, and rollback

Permission changes are releases

Every new agent permission is a production change. Treat new MCP methods, data sources, write paths, credentials, and approval bypasses like releases with evidence and rollback.

A bridge from a Claude Code run to an enterprise AI agent, connected by one control record

The control record is the bridge

Claude Code rollout and enterprise AI agent security need the same artifact: a control record that explains scope, authority, evidence, approval, and rollback.

A production AI agent rollout flow showing scope, authority, evidence, and release controls before autonomy expands

Put agent security before the rollout

Production AI agents need scoped authority, run evidence, approval gates, and rollback before the rollout expands. This is where Claude Code delivery work and enterprise agent security meet.

A production AI agent evidence loop showing task contract, bounded tools, run record, approval gate, and rollback path

If the agent cannot explain the run, do not scale it

Production AI agents need more than good output. Before a team scales Claude Code or enterprise agents, the run must explain its task, tools, evidence, approval, and rollback path.

A production Claude Code workflow showing scope, patch, tests, review, and rollback as required controls

Do not merge Claude Code work without a review packet

A clean Claude Code diff is not enough for production review. The reviewer needs the task contract, scope, commands, evidence, risks, rollback note, and approval record before merge.

A two-book production and security loop diagram showing Claude Code delivery controls and enterprise AI agent risk controls

No approval, no autonomy

If an AI agent can read internal data, call tools, change code, open tickets, or trigger workflows, it has delegated authority. Give it an approval packet before it acts.

Thomas Talks AI#

Start here#

Wider AI notes#

Books#

Securing Enterprise AI Agents#

Claude Code: Building Production Agents That Actually Scale#

Architect the Agent: The CCA-F Certification Guide#

What I am trying to answer#

Latest writing#