Research

Technical reports and citable frameworks.

Longer-form work a board paper, procurement file or literature review can cite. Every piece carries a DOI and states its sources in full.

6 deposited reports6 versioned frameworks1 reference architectureCC BY-NC 4.0 licenceORCID 0009-0000-9204-6943
Deposited technical reports

Six reports, each with a DOI.

Each adapts an article first published here: the summary becomes the abstract, the sources become a numbered reference list, and the PDF is fixed once deposited.

Technical report · August 2026

AI Companies Actually Printing Revenue in 2026

Strip out cloud infrastructure revenue (AWS, Azure, Google Cloud) and strip out AI features bolted onto software that was already selling before generative AI existed (seat-priced copilots, assistant add-ons), and a much smaller, much more interesting list remains: AI-native companies whose entire revenue depends on the AI output itself, in legal work product, clinical documentation, resolved customer tickets, shipped code, generated video and voice. These companies exist and several are now doing hundreds of millions to billions in annual recurring revenue. What they share is how they charge, not their category.

DOI 10.5281/zenodo.22685620
Download the PDF →Zenodo
Technical report · August 2026

The Black Box Problem and How to Engineer Around It

The black box problem is not one problem. Jenna Burrell’s 2016 taxonomy separates opacity that is withheld, opacity nobody has the expertise to read, and opacity that exists because no one, including the model’s own developer, can hold the explanation. Only the third form is intrinsic to the technology, and it is the one that produces silent failure, unfaithful self-explanation, and safety arguments that become statistical rather than deductive. The workable response is not to wait for interpretability to mature. It is to constrain what an opaque component is permitted to decide and instrument the system around it so failure is caught from outside.

DOI 10.5281/zenodo.22685582
Download the PDF →Zenodo
Technical report · August 2026

The Need for an AI Stability Board

Every institution built to manage a global risk, nuclear proliferation, systemic financial contagion, ozone depletion, took shape after a body with standing to act was formed. AI governance has run the sequence backwards: three summits in three years, an advisory body with no enforcement power, and a retreat from the word “safety” itself, while frontier models cross capability thresholds the summits were convened to watch for. A stability board for AI would not regulate deployment. It would do what the Financial Stability Board does for finance and the IAEA does for nuclear material: hold the common risk picture, run the independent evaluation, and raise the alarm before a national regulator can.

DOI 10.5281/zenodo.22685600
Download the PDF →Zenodo
Technical report · August 2026

Outcome as a Service: What the Contract Has to Do

Outcome as a Service is sold on the claim that it moves 100 per cent of delivery and performance risk to the vendor. Sixty years of performance-contracting history, from Rolls-Royce’s Power by the Hour to modern energy savings contracts, says risk is redistributed rather than removed. Three categories of exposure, statutory duty, retained control over client-side variables, and second-order cost, stay with the buyer no matter how the invoice is structured. Contracts drafted on the opposite assumption fail in a predictable, well-documented way.

DOI 10.5281/zenodo.22685614
Download the PDF →Zenodo
Technical report · August 2026

What Stops a Rogue Agent You Never Catch

“Rogue agent” sounds like science fiction, a system that decides to defect. The evidence from 2026 says the real version is quieter than that: agents that conceal ordinary self-interest from the exact mechanism built to catch them, or agents that never intended anything adversarial and still escalate into sabotage because nobody gave them visibility into each other. Human-in-the-loop only works when the loop sees the right thing at the right time. This report is about what holds when it does not.

DOI 10.5281/zenodo.22685618
Download the PDF →Zenodo
Technical report · July 2026

Singapore Small Business AI Use Tripled to 14.5%: Why the Other 85.5% Are Still Behind

AI use by Singapore small businesses tripled between 2023 and 2024. But the gap with bigger companies got wider. The problem is not that small businesses do not want AI. IMDA’s own data shows 95.1% of small businesses already use at least one digital tool. The problem is picking AI projects that work for a business with no IT team, and knowing which ones do not.

DOI 10.5281/zenodo.22685622
Download the PDF →Zenodo
Reference architecture

How the controls fit together in a real pipeline.

The frameworks say what to check. The architecture says where each check sits and what the audit log has to contain.

Governed Agentic RAG reference architecture: sixteen components in four bands with four cross-cutting controls
Version 1.0 · September 2026 · DOI 10.5281/zenodo.22727449

Governed Agentic RAG

An agentic retrieval pipeline built to pass an ISO/IEC 42001 audit and meet MAS FEAT. Sixteen components in four bands, four cross-cutting controls, and a component-to-clause mapping for both standards.

Read the architecture →
Frameworks

Six frameworks, versioned and citable.

Each has a reference diagram, a version number, a suggested citation and a PDF brief deposited on Zenodo with its own DOI.

Five-Dimension AI Readiness Assessment01Five-Dimension AI Readiness Assessmentv1.1 · first published June 2026 · DOI 10.5281/zenodo.22722215Framework and PDF brief →TRACE Framework02TRACE Frameworkv1.1 · first published June 2026 · DOI 10.5281/zenodo.22722217Framework and PDF brief →Four-Question AI Governance Baseline03Four-Question AI Governance Baselinev1.1 · first published June 2026 · DOI 10.5281/zenodo.22722219Framework and PDF brief →Return on Employee (RoE) Framework04Return on Employee (RoE) Frameworkv1.1 · first published March 2026 · DOI 10.5281/zenodo.22722223Framework and PDF brief →Measurement-Before-Prediction Architecture05Measurement-Before-Prediction Architecturev1.1 · first published June 2026 · DOI 10.5281/zenodo.22722225Framework and PDF brief →Governed Cognitive Layer (Layer 8)06Governed Cognitive Layer (Layer 8)v1.0 · first published July 2026 · DOI 10.5281/zenodo.22722227Framework and PDF brief →

The Readiness Assessment, TRACE, the Governance Baseline and the architecture's control set are also published as YAML, templates and a JSON Schema in the openai-governance-toolkit repository under CC BY 4.0.

Ongoing research

Work in progress.

Studies and a book not yet published, with the numbers and chapters as they come in. Password protected because the work is preliminary. Ask for the password to follow it.

A grid of identical navy tokens on a linen desk, three lifted onto a brass tray beside a loupe and a tally sheet
Password protected · updated September 2026

Your sample is smaller than you think

How much AI agent work can go out unchecked. Because a fleet runs copies of one model, the agents make the same mistakes together, and a small spot-check makes the work look safer than it is. Proposal, simulation results, a conference paper draft and a 12-page brief inside.

Open ongoing research →
A closed navy hardcover book on a linen desk with a brass pen and stamp on its cover and an orange ribbon bookmark
Password protected · book in progress · started September 2026

The Governed Enterprise

A book on AI governance for boards, executives and public agencies, co-written with Michael Low. Working title, the four readers, a 20-chapter outline with the site material each chapter draws on, and the outline as a branded PDF. Chapter drafts will be filed here as they are written.

Open the book page →
Using this work

How to use this research.

Everything here is licensed CC BY-NC 4.0: reproduce it with attribution for non-commercial use, including board papers, training material and academic work. For a commercial product, a paid course or a tender, write to me; permission is normally a formality.

Corrections are welcome. If a source is wrong, the article is corrected first and the deposit superseded. Credentials, patents and the full record →

Terence Kok
Before You Go

I started depositing these for a plain reason: a blog post, however careful, is not something an evaluation committee or a literature review can cite with a straight face, and a DOI is. The reports are the same arguments the articles make, with the furniture removed and the sources numbered, and every title page says what they are and are not. If one helps you win an argument you should have won anyway, that is what it is for.

Terence Kok