JAMES' BLOG

Governance at home is the sequel to founder exit timing, applying the same readiness discipline to a risk most boards have never put on an agenda, executive personal exposure. This piece breaks down why boards must treat personal risk with the same rigor as cyber and succession risk, and what oversight actually looks like.

A popular checklist of AI tool settings promises better results in minutes: model choice, connectors, memory, custom instructions. Most of it is harmless. One setting, granting an AI assistant OAuth access to email and files, is a governance decision that deserves far more scrutiny than a toggle switch usually gets. Here is how to tell the difference.

Most boards equate cybersecurity with firewalls and a compliance checklist, covering perhaps two of the twelve domains a mature program actually requires. API security, third-party risk, and disaster recovery rarely make the agenda, yet they are where the next material incident is most likely to originate. Here is the full map and the four questions every board should be asking.

Executives are quietly building AI clones of their own writing voice, uploading years of best work so Claude can draft in their tone. Done well, it scales authentic communication across emails, LinkedIn posts, and scripts. Done carelessly, it creates an accountability gap the board has not yet named. Here is the governance framework leaders need before they turn it on.

Corporate cybersecurity spend keeps climbing, yet the personal perimeter, home networks, personal devices, and family accounts, sits entirely outside it. This piece breaks down why the tools stop at the office door, what boards should ask about executive exposure, and how to close the gap before it becomes a personal accountability requirement.