The Model's Good Enough. Are We? Project Solara & AI Governance | EP36

This fortnight the capability conversation takes a back seat to a more awkward one. Cyrus opens on governance, with Anthropic's new Fable 5 model and the reported decision by Microsoft to stop its own staff using it over the data retention terms attached. It is a tidy example of an AI safety choice turning straight into an enterprise governance headache, and the cost and retention profile means the smartest model on the shelf is not always the one you can actually use. He then walks through the June refresh of the Microsoft Cybersecurity Reference Architecture, now sitting inside the Security Adoption Framework, plus the Entra and Intune changes that will have help desks busy around the July 6 conditional access deadline. David brings what Richard fairly describes as his most eclectic set of links yet, and ties them to one thread: the model is good enough now, but are we? He gets into HVE Core and its research, plan, implement workflow, the CAIRA composable reference architecture that pairs with it, a sharp piece on scoping security assessments for attack paths rather than org charts, and intent driven specification development as a reply to the spec first orthodoxy. The argument lands somewhere uncomfortable, which is that most of the work now falls to us and most of us are not doing it yet. Richard closes on two Build items. The GitHub Copilot app and its parallel worktree sessions, which behave like five developers on five branches at once, and Project Solara, Microsoft's agent first device platform running on a fork of Android. He looks at Solara through a management and identity lens rather than as a gadget, and asks what an endpoint where an agent acts for the user does to an identity model that quietly assumes a person is there. Chapters: 00:00 Welcome 01:53 Claude Fable 5, Mythos, and a governance problem 07:00 Model routing, token cost, and the auto picker 11:44 The MCRA June refresh and the Security Adoption Framework 14:08 Data security gets its own reference architecture 15:22 Entra auth changes and the July 6 conditional access deadline 18:00 Intune controls for MAC randomization and Android Bluetooth 20:53 The model is good enough, but are we? 24:55 HVE Core and the research, plan, implement workflow 28:59 CAIRA and composable AI reference architecture 31:37 Scoping for attack paths, not org charts 35:20 A community icon library worth bookmarking 36:23 Intent driven specification development 43:59 HLD, LLD, agile, and the spec first problem 49:01 The GitHub Copilot app and parallel worktrees 51:22 Project Solara and the agent first endpoint 57:50 Why did nobody call these IoT devices? 58:44 Wrap up Links: Microsoft Cybersecurity Reference Architecture and Security Adoption Framework: https://aka.ms/MCRA HVE Core (Hyper Velocity Engineering): https://github.com/microsoft CAIRA (Composable AI Reference Architecture): https://github.com/microsoft msicons.com architecture icon library: https://msicons.com Project Solara at Microsoft Build: https://build.microsoft.com X/Twitter: https://x.com/richardihogan Bluesky: https://bsky.app/profile/richardihoga... LinkedIn:   / richardhogan   Facebook: https://www.facebook.com/profile.php?... Threads: https://www.threads.com/@richardhogan323 Music: Null Invocation, Monochrome Pulse https://is.gd/b1kNU9