# Knowledge Foundation

> Muthu Bommiah's working knowledge on governed AI, context engineering and AI-native software delivery, kept current by an LLM librarian; each note says whether he has reviewed it. Every note carries its sources and when it was last verified.

Every note is also available as Markdown at its address plus .md. Notes follow the Open Knowledge Format v0.2; provenance (sources, generated, verified) is in each file's frontmatter. The author's essays are canonical at https://muthub.org.

## Context engineering

- [Context fragmentation: why your agents keep starting from zero](https://wiki.muthub.org/context-engineering/context-fragmentation-why-your-agents-keep-starting-from.md): The knowledge an agent needs is scattered across code, tickets, chat, wikis, incident tools and people's heads. Each fragment is accurate and useless alone. Fragmentation, more than model quality, is what makes enterprise agents brittle.
- [Living documentation and the human trust gap](https://wiki.muthub.org/context-engineering/living-documentation-and-the-human-trust-gap.md): Docs that regenerate on every commit describe what code does. The harder, more valuable problem is capturing why it exists.
- [Not another data lake: context needs curation, not collection](https://wiki.muthub.org/context-engineering/not-another-data-lake-context-needs-curation-not-collection.md): The tempting answer to fragmented context is to pour everything into one place. We tried that with data, and many lakes became swamps. A context layer has to be a curated overlay: retrieval-first, owned, and pointing back to the systems that hold the truth.
- [Passive capture: knowledge that writes itself, with humans who approve it](https://wiki.muthub.org/context-engineering/passive-capture-knowledge-that-writes-itself-with-humans-who.md): Documentation fails because it is a second job. The knowledge we need is already produced as a by-product of work: commits, tickets, incidents, reviews and decisions. Capture it passively, distill it, and keep a human approval gate before anything becomes trusted.
- [Self-describing knowledge: why the Open Knowledge Format matters, and what enterprises must add](https://wiki.muthub.org/context-engineering/self-describing-knowledge-why-the-open-knowledge-format.md): In June, Google Cloud published the Open Knowledge Format, and July's v0.2 added provenance, verification and freshness. It is the right foundation. Regulated enterprises still need to add ownership, classification and a policy for how much trust an agent needs before it acts.
- [The cost of unmanaged context](https://wiki.muthub.org/context-engineering/the-cost-of-unmanaged-context.md): Enterprises budget for compute, models and licenses, but almost none budget for the context those models depend on. Unmanaged context is the largest cost nobody tracks, and every new AI agent adds to it.

## Governed AI

- [A2A and MCP: complementary, not competing](https://wiki.muthub.org/governed-ai/a2a-and-mcp-complementary-not-competing.md): MCP connects agents to tools; Agent2Agent connects agents to each other. Together they turn single agents into systems, and raise the governance stakes.
- [Adopting MCP in a bank: the four risks to solve first](https://wiki.muthub.org/governed-ai/adopting-mcp-in-a-bank-the-four-risks-to-solve-first.md): The Model Context Protocol standardizes how agents connect to tools and data. It is silent on whether they should. Four risk areas a regulated institution should resolve before agents get tools.
- [Architecture that runs: why AI-era governance must be code](https://wiki.muthub.org/governed-ai/architecture-that-runs-why-ai-era-governance-must-be-code.md): AI now writes code faster than any review board can read it, while architecture still moves at meeting speed. Governance has to become something that executes in the pipeline and in the agent's context.
- [Architecture-as-Code Control Plane](https://wiki.muthub.org/governed-ai/architecture-as-code-control-plane.md): An executable, policy-aware governance engine that checks designs automatically before they reach production, so architecture keeps pace with AI-speed delivery.
- [Architecture-as-Code Reference Platform (open prototype)](https://wiki.muthub.org/governed-ai/architecture-as-code-reference-platform-open-prototype.md): aac.muthub.org: a public, working prototype of an architecture control plane, with catalogs, OPA policies, waivers, an executive scorecard, a CLI and an MCP server that brings the rules into coding agents. It is modeled in its own notation and passes its own rules.
- [Designing an enterprise MCP registry: the control point agents need](https://wiki.muthub.org/governed-ai/designing-an-enterprise-mcp-registry-the-control-point.md): As agents multiply, every enterprise needs an authoritative directory of the tools they can call. What a governed MCP registry must do, what the official registry leaves to you, and the mistakes to avoid.
- [Enterprise Generative AI Architecture](https://wiki.muthub.org/governed-ai/enterprise-generative-ai-architecture.md): An enterprise-grade Generative AI reference architecture: a governed path from experiment to production, adopted as the reference model across business lines.
- [Enterprise Identity & Access Management](https://wiki.muthub.org/governed-ai/enterprise-identity-access-management.md): Built USAA's first Oracle Identity Federation servers and the access-management foundation for single sign-on, multi-factor authentication and partner integrations.
- [If you can't prove why an AI wrote it, you can't ship it](https://wiki.muthub.org/governed-ai/if-you-can-t-prove-why-an-ai-wrote-it-you-can-t-ship-it.md): Shipping AI-generated code without recording where it came from is unmanaged risk. Regulated teams need deterministic provenance for non-deterministic models: line-level attribution, Git-native session history and AI bills of materials.
- [Inside an Architecture-as-Code platform: a C4 walkthrough](https://wiki.muthub.org/governed-ai/inside-an-architecture-as-code-platform-a-c4-walkthrough.md): The open prototype at aac.muthub.org, described in its own notation and validated by its own rules. A level-by-level C4 walkthrough of the design decisions that mattered, and what I would change before an enterprise ran it.
- [MCP in three primitives: tools, resources, prompts](https://wiki.muthub.org/governed-ai/mcp-in-three-primitives-tools-resources-prompts.md): MCP ended the copy-paste problem with three simple primitives. Being open is why it beat a thousand bespoke integrations.
- [Model is a tool, harness is the strategy](https://wiki.muthub.org/governed-ai/model-is-a-tool-harness-is-the-strategy.md): Handing an AI agent a production codebase without a harness is like putting a teenager in a sports car with no dual brakes. Deterministic guardrails and sensors, owned as a platform, are what make agents safe to scale.
- [Remote MCP, straight from the API](https://wiki.muthub.org/governed-ai/remote-mcp-straight-from-the-api.md): Direct remote MCP access through the Messages API removed a client layer and moved agent integration from clever hacks toward engineering.
- [Securing AI agents: identity, not secrets](https://wiki.muthub.org/governed-ai/securing-ai-agents-identity-not-secrets.md): Agents act on their own, at machine speed, across many systems. Static credentials and perimeter thinking don't hold up. Attested identity, explicit delegation and policy enforced outside the model do.
- [The MCP spec grows up](https://wiki.muthub.org/governed-ai/the-mcp-spec-grows-up.md): OAuth 2.1 authorization, streamable HTTP, batching and tool annotations: the March 2025 update that made enterprise MCP plausible.

## AI-native SDLC

- [Agent design is still hard](https://wiki.muthub.org/ai-native-sdlc/agent-design-is-still-hard.md): High-level SDKs break under real tool use. Caching, reinforcement, failure isolation and shared state decide whether an agent is reliable.
- [AI-Augmented Software Development Lifecycle](https://wiki.muthub.org/ai-native-sdlc/ai-augmented-software-development-lifecycle.md): Coding agents brought into a large bank's software lifecycle behind one governed platform: curated context, maker/checker controls and a single gateway for every model call.
- [Beyond vibe coding: specs as executable artifacts](https://wiki.muthub.org/ai-native-sdlc/beyond-vibe-coding-specs-as-executable-artifacts.md): Ad-hoc prompting yields code that looks right but misses intent. Making the spec the gated source of truth is how AI-assisted delivery becomes repeatable.
- [Closing the loop: agents that verify their own work](https://wiki.muthub.org/ai-native-sdlc/closing-the-loop-agents-that-verify-their-own-work.md): An agent that runs the tests, reads the failure and fixes its own work is the line between autonomy and a one-shot tool.
- [Code that validates itself: AI-generated assertions](https://wiki.muthub.org/ai-native-sdlc/code-that-validates-itself-ai-generated-assertions.md): Only about 2.5% of open-source Java repositories use production assertions. LLMs can write them, adding the verification layer AI-written code needs.
- [From pair programming to fleet management](https://wiki.muthub.org/ai-native-sdlc/from-pair-programming-to-fleet-management.md): Editors now run local, background and cloud agents side by side. The leadership job shifts from writing code to designing the system that writes it.
- [Governing coding agents in a bank: a 12-point checklist](https://wiki.muthub.org/ai-native-sdlc/governing-coding-agents-in-a-bank-a-12-point-checklist.md): The controls a regulated enterprise needs before coding agents write production code at scale. One page, kept current, meant to be copied into your own standards.
- [Spec-driven development for regulated industries: audit the contract, not every line](https://wiki.muthub.org/ai-native-sdlc/spec-driven-development-for-regulated-industries-audit-the.md): For complex work in regulated sectors, prompt-to-code cannot pass an audit. Making the specification the contract an AI must fulfil can, provided the spec stays anchored to the code and machines check conformance.
- [The AI-native SDLC: when typing code stops being the bottleneck](https://wiki.muthub.org/ai-native-sdlc/the-ai-native-sdlc-when-typing-code-stops-being-the.md): AI has made writing code cheap. Verification, trusted context and human judgment are now the scarce resources, and teams that redesign their lifecycle around them will pull away from teams that only add assistants.
- [Three architectures for AI coding agents, and how enterprises should choose](https://wiki.muthub.org/ai-native-sdlc/three-architectures-for-ai-coding-agents-and-how-enterprises.md): Platform-embedded, sandboxed and evolutionary coding agents each earn trust in a different way. Then the editor became a fleet manager. Choose and govern agents by how their work will be verified.

## Data & AI platforms

- [A data engineering agent in practice](https://wiki.muthub.org/data-ai-platforms/a-data-engineering-agent-in-practice.md): An experimental agent built pipelines, changed schemas, reverted its own mistakes and generated quality checks from plain language. Self-correction was the part that mattered.
- [Agent-first data architecture: five principles](https://wiki.muthub.org/data-ai-platforms/agent-first-data-architecture-five-principles.md): Data platforms built for people asking questions will strain when the main consumer is software taking actions. Five principles for designing data platforms where agents are first-class users, and why an open lakehouse helps.
- [Capture the why: the knowledge layer enterprise agents are missing](https://wiki.muthub.org/data-ai-platforms/capture-the-why-the-knowledge-layer-enterprise-agents-are.md): Most enterprise AI pilots hit the same wall: systems record what happened, but the reasoning behind decisions evaporates. Durable, governed context about the why is the real foundation for useful agents.
- [Cloud Data & Analytics Platform](https://wiki.muthub.org/data-ai-platforms/cloud-data-analytics-platform.md): A cloud data platform at USAA processing 25B+ records a day, with an AWS architecture approved for identity, data protection and detective controls.
- [Controlled Data Movement](https://wiki.muthub.org/data-ai-platforms/controlled-data-movement.md): A configuration-driven, secure data movement pattern built at USAA to move 25B+ records a day, then carried to Wells Fargo as a bank-wide framework for analytics and AI.
- [Enterprise Machine Learning Platform](https://wiki.muthub.org/data-ai-platforms/enterprise-machine-learning-platform.md): An enterprise MLOps platform that moved 360 data scientists onto one governed environment, saved $25M in license costs over 3 years and cut model deployment from 8 weeks to 5 days.
- [From MLOps to AI engineering: what industrializing ML still teaches us](https://wiki.muthub.org/data-ai-platforms/from-mlops-to-ai-engineering-what-industrializing-ml-still.md): A trained model is the start of the work, not the end. The lessons of industrializing machine learning carry straight into generative and agentic AI, which is why AI engineering has to unify DataOps, MLOps and DevOps.
- [Governance belongs in the catalog](https://wiki.muthub.org/data-ai-platforms/governance-belongs-in-the-catalog.md): When business meaning, data products and relationships live in one open catalog, agents stop guessing at tables and governance travels with the data.
- [Middleware & Global Enterprise Systems](https://wiki.muthub.org/data-ai-platforms/middleware-global-enterprise-systems.md): Led Bunge's middleware and business-application platforms, delivered a Hyperion upgrade for 2,000 users worldwide and set the enterprise service bus strategy adopted across Bunge companies.
- [Python or the JVM for production enterprise AI? Put the agent where the transaction lives](https://wiki.muthub.org/data-ai-platforms/python-or-the-jvm-for-production-enterprise-ai-put-the-agent.md): Python is unrivaled for research and prototyping. Production enterprise AI is mostly integration, security and scale, and with JVM agent frameworks now arriving, the runtime that owns the transaction is often the right home for the agent.
- [Rethinking operational databases for the agent era](https://wiki.muthub.org/data-ai-platforms/rethinking-operational-databases-for-the-agent-era.md): The lakehouse unified analytics and AI. Bringing operational Postgres into it points toward one governed source of truth for agents.

## Leading AI change

- [AI is an amplifier, not a silver bullet](https://wiki.muthub.org/leading-ai-change/ai-is-an-amplifier-not-a-silver-bullet.md): AI magnifies whatever is already in a team. Platform quality, clear policy and updated workflows decide whether that means strength or dysfunction.
- [An AI operating model for a bank: ten decisions to make before the twentieth use case](https://wiki.muthub.org/leading-ai-change/an-ai-operating-model-for-a-bank-ten-decisions-to-make.md): How a regulated bank should organize, fund, govern and measure AI so that the first few wins turn into a portfolio instead of a pile of pilots.
- [Build for today's task or tomorrow's platform?](https://wiki.muthub.org/leading-ai-change/build-for-today-s-task-or-tomorrow-s-platform.md): The classic architect's dilemma, upgraded for agents: how much to invest in reusable agents versus fast, single-use ones.
- [Data & AI on Public Cloud](https://wiki.muthub.org/leading-ai-change/data-ai-on-public-cloud.md): A multi-cloud Data & AI strategy and reusable, pre-approved archetypes that made public-cloud onboarding much faster and modernized a legacy data warehouse.
- [Gating AI investment: eight gates from pilot to production](https://wiki.muthub.org/leading-ai-change/gating-ai-investment-eight-gates-from-pilot-to-production.md): A stage-gate checklist for funding AI use cases in a regulated enterprise: what evidence each gate needs, so money follows results instead of enthusiasm.
- [Leading architecture change without direct authority](https://wiki.muthub.org/leading-ai-change/leading-architecture-change-without-direct-authority.md): In a large organization you rarely own the teams you need to move. Architects lead through clarity, credibility and standards people want to follow, and by treating the North Star and today's fires as one job.
- [Simplicity is not simplistic](https://wiki.muthub.org/leading-ai-change/simplicity-is-not-simplistic.md): Designs that are easy to explain, build and run take the most effort up front, and they are the ones still working years later.
- [Technical debt is an architectural liability](https://wiki.muthub.org/leading-ai-change/technical-debt-is-an-architectural-liability.md): Technical debt is a strategic risk rather than messy code. Coding agents make continuous paydown affordable inside everyday work.
- [Your prompt history is a more honest review than your calendar](https://wiki.muthub.org/leading-ai-change/your-prompt-history-is-a-more-honest-review-than-your.md): My 2025 prompt history split 60% enterprise, 40% personal growth. Here is the prompt I used to audit my own year.

## Optional

- [Graph data](https://wiki.muthub.org/graph.json): nodes and edges of the knowledge graph
- [Essays](https://muthub.org/llms.txt): the canonical essays