DEV Community: Stephen Lincoln

The AI Race Is Accelerating .But Are We Building Trust at the Same Speed

Stephen Lincoln — Sun, 27 Sep 2026 17:48:37 +0000

The AI Race Is Accelerating. But Are We Building Trust at the Same Speed?

Every month, AI becomes more powerful.

Models are reasoning better.

Agents are becoming autonomous.

Organizations are beginning to let AI interact directly with production systems.

But as AI capabilities grow, so do the challenges.

We've already seen organizations deal with:

• AI hallucinations leading to costly mistakes.
• Prompt injection and security attacks.
• AI agents entering unintended execution loops that waste compute and resources.
• Unauthorized or risky actions performed through connected tools.
• Enterprises struggling to understand what their AI systems are actually doing before something goes wrong.

The industry is asking:

"How do we build smarter AI?"

I'm asking a different question.

"How do we build AI that organizations can trust to act?"

Introducing Ex

I'm a non-technical founder exploring an idea called Ex.

Ex isn't another AI model.

It isn't another chatbot.

It isn't another agent framework.

The vision is for Ex to become an AI Execution Governance Platform—a trust layer that sits between AI agents and the real world.

Instead of allowing every AI action to execute immediately, Ex evaluates high-impact actions before they happen.

Think of it like an airport security checkpoint—but for AI actions.

Without exposing proprietary implementation details, the idea is built around principles such as:

Evaluating execution requests before they reach production systems.
Enforcing organization-defined policies.
Assigning risk levels to sensitive actions.
Supporting human approval for high-impact operations.
Creating clear audit trails for accountability.

The goal isn't to make AI smarter.

The goal is to make autonomous AI more trustworthy.

I'd love your thoughts.

Do you believe AI will eventually need a universal execution governance layer, or will every organization continue building its own governance systems?

Could something like Ex become part of the standard infrastructure for autonomous AI?

Live Demo

I'd appreciate any honest feedback on the current MVP:

Ex Live Demo

It's still early, and I'm actively learning from the community.

Looking for a Long-Term Builder

I'm also looking for someone who believes this problem is worth solving.

Not just another startup.

A long-term mission.

I'm a non-technical founder, and I'm looking for an engineer, researcher, or technical co-founder who believes the future of AI isn't only about making models more intelligent—but also about making them more trustworthy.

You don't have to agree with my approach.

In fact, I'd love to hear a different one.

If you believe AI governance is one of the defining infrastructure challenges of the next decade, let's talk.

Maybe together we can build something that helps shape the future of autonomous AI.

Question for the community:

If you had to design the trust layer between AI and the real world, what would it absolutely need to do?

The World Is Building Smarter AI. Who's Building the Layer That Makes It Safe to Act?

Stephen Lincoln — Sun, 20 Sep 2026 20:14:39 +0000

The AI industry is moving incredibly fast.

Every week we see better models, more capable agents, and new tools that automate increasingly complex work.

But the more I study autonomous AI, the more I keep coming back to one question:

Who governs AI once it starts taking real-world actions?

Not generating text.

Not answering questions.

Actually acting.

Imagine an AI agent that can:

approve a payment
deploy production infrastructure
modify cloud resources
access sensitive customer data
control physical systems

Most discussions today focus on making AI more capable.

I'm interested in something different:

How do we make AI trustworthy enough for enterprises to let it act?

That's the idea behind something I'm exploring called Ex.

The vision is simple:

Create a trust layer between AI and the real world.

A place where every high-impact AI action can be evaluated against policy before execution.

I'm still researching this problem, and I'd genuinely love to hear from engineers building AI systems today.

I'm curious:
What AI failures have you experienced in production?
Have you had to build your own approval or governance system?
What's the biggest problem your AI agents create today?
What do you wish existed that doesn't?

I'm not looking for validation.

I'm looking for reality.

If the problem isn't real, I'd rather learn now.

If it is real, I think it deserves serious attention.

A second reason I'm posting this

I'm also interested in meeting people who think long-term.

Not people chasing the next AI trend.

People who believe the next decade of AI will require entirely new infrastructure around governance, trust, and execution.

If that sounds like how you think, I'd genuinely enjoy talking.

Whether you're an engineer, researcher, security specialist, product builder, or potential co-founder, feel free to reach out.

Sometimes the best companies begin with a conversation.

The Missing Layer Between AI and the Real World

Stephen Lincoln — Sat, 19 Sep 2026 19:28:25 +0000

"The Missing Layer Between AI and the Real World." Over the past few months, I've noticed something The AI industry is racing to build models that are smarter, faster, more autonomous.

But, we talk less about what happens after an AI decides
to act. Not what it writes or answers, but when it deploys infrastructure, moves money, accesses sensitive data, or interacts with the real world. I'm wondering if there's a missing execution layer between an AI's decision and the action itself. So, before building anything, I'd love to talk with AI engineers, researchers, MLOps, security folks. What's the biggest failure you've seen in production? What safety checks did you have to build yourself? I'm not selling. I'm listening, trying to see whether there's a real need for the layer that ex envisions.

The Missing Layer Between AI and the Real World

Stephen Lincoln — Thu, 10 Sep 2026 18:48:34 +0000

We're Measuring the Wrong Thing in AI Agents

Everyone seems focused on making AI agents smarter.

Bigger models.

Longer context windows.

Better reasoning.

More tools.

More autonomy.

Those things matter.

But I think we're overlooking a different question.

What happens after the AI decides to act?

Imagine an AI agent with permission to:

deploy infrastructure
approve refunds
query production databases
purchase inventory
update customer records
modify firewall rules

The challenge isn't whether the AI can perform these actions.

The challenge is whether it should perform them.

Most production systems already answer questions like:

Is this user authenticated?
Is this API key valid?
Does this service have permission?

Those are identity questions.

Autonomous AI introduces a different class of question:

Should this specific action be allowed under these specific circumstances?

Those aren't the same problem.

For example:

An AI wants to refund $8,500 to a customer.

Authentication succeeds.

The API key is valid.

The agent has permission to call Stripe.

Should the refund execute automatically?

Maybe.

Maybe not.

It depends on context.

Is this production or staging?
Is this a VIP customer?
Has fraud been detected?
Has a human approved refunds above $5,000?
Is another agent already processing the same request?

None of those questions are answered by authentication alone.

I think we're moving toward a new architectural pattern:

Intent

↓

Policy Decision

↓

Execution

Instead of allowing AI agents to directly change the real world, every high-impact action crosses a governance boundary first.

Not because we don't trust AI.

Because we need systems that businesses can trust.

I've been exploring this idea through a project called Ex.

The vision isn't to replace AI frameworks or build another agent platform.

It's to explore whether autonomous AI needs a dedicated execution governance layer that sits between agents and real-world consequences.

Think less about making AI more intelligent.

Think more about making AI safe to operate at enterprise scale.

I'm curious how engineers are thinking about this.

If you were designing AI infrastructure for the next decade:

Where would you enforce trust?

Inside the model?
Inside every agent?
At the tool/function-call layer?
In middleware?
As a centralized execution control plane?

I'd love to hear different perspectives.

ai #agents #softwareengineering #architecture #devops #security #opensource #machinelearning

Shadow Agent Problem

Stephen Lincoln — Wed, 09 Sep 2026 06:33:52 +0000

The Shadow Agent Problem

We've spent years securing who can access our systems.

The next challenge is governing what autonomous AI is allowed to do once it has access.

Imagine this:

A developer creates an AI agent using a personal API key, connects it to internal tools, and gives it permission to read customer data, call internal APIs, deploy code, or trigger business workflows.

No procurement process.

No centralized registration.

No security review.

The agent authenticates successfully and starts taking actions.

This is what I think of as the Shadow Agent Problem.

It's similar to the Shadow IT and Shadow SaaS challenges enterprises faced years ago—but with one critical difference:

AI agents don't just access information. They act on it.

They can initiate payments, modify infrastructure, interact with production systems, and automate decisions at machine speed.

That's why traditional controls aren't always enough.

Identity, procurement, and access management remain essential, but they primarily answer:

"Who is allowed to connect?"

They don't necessarily answer:

"Should this specific action be allowed to happen right now?"

I believe governance needs to exist at the execution layer.

Instead of evaluating only the identity of the agent, evaluate the action itself before it reaches the real world.

For example:

Should this payment be approved?
Should this deployment proceed?
Should this API call be allowed?
Should this database query execute?
Should this infrastructure change be blocked?

Every high-impact action becomes a policy decision.

Not after execution.

Before execution.

A possible architecture could include:

A policy engine that evaluates every high-impact action against organizational rules.
Approval workflows for sensitive operations.
A complete audit trail explaining what was attempted, why it was approved or rejected, and under which policy.
Real-time interception before external systems are affected.

One advantage of this model is that it doesn't require security teams to know about every AI agent in advance.

Instead of trying to catalog every possible agent, you govern the actions they perform.

As autonomous AI becomes more common inside enterprises, I think this architectural pattern will become increasingly important.

I'm curious how others are approaching this problem.

Are you enforcing governance at the tool/function-call layer?
Using policy engines like OPA?
Building middleware around agent frameworks?
Or taking a completely different approach?

I'd love to hear how you're thinking about execution governance for AI agents.