Practical writing on governance, privacy, and risk from someone who's had to make it work.

I write about what I'm seeing in practice — what's working, what isn't, and where the gap between policy and operations actually lives.