Simon Plant
Chief architect turned fractional CTO. Thirty years designing and delivering the systems each new platform makes possible — web, cloud, DevOps, now AI. Hands-on in the code, and at the leadership table.
What I do
I work with 2–3 companies at a time as a fractional CTO — AI reality checks, architecture strategy, executive advisory, and turning strategic bets into executable delivery plans. If you're facing a technology decision where getting it wrong is expensive, that's my job.
Fractional CTO services →AI architecture patterns
A working reference for designing and operating AI systems — patterns, decisions, and trade-offs written from production experience, not theory.
The Advisory-Only Agent: A Structural Boundary for High-Stakes Domains
When an AI agent operates in a domain where mistakes are expensive and irreversible, make execution structurally impossible — not a config flag. The agent proposes, briefs, and alerts; a human pulls every trigger.
The Auto-Loaded Context Contract
Every agent framework loads a fixed set of context at session start — and silently ignores everything else. Treat that set as a contract: design your agent's knowledge around what is guaranteed to be present after any restart or compaction.
Credential Isolation for AI Agents
Assume the agent will eventually be manipulated. Design so that even then it cannot leak what it never held: credentials live behind a vending proxy, egress is allowlisted, and the runtime is read-only.
AI security
How AI systems get attacked and how to defend them — techniques, hardening, and advisories from running hardened agents in production.
The Agent Tool Supply Chain
Every MCP server, plugin, and community skill you connect to an agent runs inside its trust boundary and often speaks in the same instruction channel the model obeys. Treat agent extensions as a supply chain, because that's what they are.
The Agent Workspace Is an Attack Surface
An agent's identity, rules, and memory live in files the agent itself can often write. That makes the workspace a persistence mechanism for attackers — and hardening it is cheap.
Advisory: Your Local LLM Endpoint Is Probably Listening Too Widely
Self-hosted inference servers ship with no authentication and an easy path to binding on all interfaces. Thousands end up reachable from the internet or an untrusted LAN. Five minutes of checking closes it.
What I'm building
The advice is grounded in shipping — AI systems I run in production and tools I build.
Writing
- Passes Everything, Works for Nothing · 5 min read
- Personality Is Three Paragraphs · 3 min read
- The cPanel Moment · 3 min read