Drawing set · Series 01
At the Boundary
Everything interesting in software happens at a boundary: a request enters a server, a document enters a parser, a prompt leaves for a model. Every serious bug in seven years of production work sat on one of those lines. This set is one numbered sheet per lesson, drawn the way architects draw buildings, from systems that carry real users and real money, plus field reports on incidents disclosed while the set runs.
Read in any order. Each sheet names the ones it belongs with. The letter after GL is the discipline: S security, A artificial intelligence, E engineering, P product, R record of what shipped. The status says what kind of sheet it is: FOR INFORMATION teaches, RECORD is a bug found in my own work, AS BUILT is what shipped with numbers you can check, SUPERSEDED is something I used to believe.
Week 1Where the bugs live
GL-E-001September 5, 2026FOR INFORMATIONThe bug is never where you're looking. It's at the boundary.
A boundary is any line where data changes hands: a request enters a server, a document enters a parser, a prompt leaves for a model.
GL-A-002September 6, 2026FOR INFORMATIONThe agent handed over its own API key. $600,000 later, someone noticed.
An AI evaluation organisation put an agent on a public cloud instance behind a login. The login had a fail-open bug that silently disabled authentication.
GL-S-003September 7, 2026RECORDThe rider billed 50 km. The trip was 2 km. Nothing crashed.
The delivery fee was priced on the distance the rider's app reported. A number in a request body, treated as a measurement.
GL-A-004September 7, 2026FOR INFORMATIONYour prompt is a data export. Who's on the receiving end?
Send a customer's message to a model and it leaves your infrastructure for another company's.
GL-A-005September 23, 2026FOR INFORMATIONFour AI coding agents pinned the commit. None checked what arrived.
Coding agents install plugins from Git and pin each one to a 40-character commit hash. The pin is the promise: this code, and only this code.
GL-S-006September 24, 2026FOR INFORMATION"Who sees our customer data?" Four answers. One survives an auditor.
Procurement asks this on every serious deal now. Engineering teams give one of four answers.
GL-E-007September 24, 2026RECORDTwo customers bought the last item. Both won. Stock: −1.
Both reads saw stock = 1. Both checks passed. Both writes went through. Two people were promised one thing.
GL-A-008September 25, 2026FOR INFORMATIONThat PDF has characters you can't see. The model can.
Unicode has a block of invisible tag characters. They render as nothing. A model reads them as text.
GL-E-009September 26, 2026FOR CONSTRUCTIONFive boundaries. One rule. Verify at the line, trust inside it.
Everything that crosses a line is a claim until the boundary turns it into a fact. Then the code inside can be simple and confident.