Grace — Distributed systems, observability, and ML infrastructure Control mappings, disclosure measurement, and evidence tooling for systems that call large language models. Primary-source research on SOC 2, the EU AI Act, and Regulation B. 2026-09-08T01:39:57+00:00 https://grace.github.io/writing/ Gracegrace@gracefulco.de You cannot filter your way to compliance https://grace.github.io/writing/structural-controls/ 2026-09-05T00:00:00+00:00 What the EU AI Act actually asks of an LLM deployment, and why the control most vendors sell you is the one least able to deliver it. Settability decides what your adverse action notice leaks https://grace.github.io/writing/settability-and-observability/ 2026-09-05T00:00:00+00:00 Five measurements on whether explanation mandates and model-extraction risk actually conflict. The cost turns out to depend on whether the requester can set the quantities an explanation names. Your observability tool cannot be your evidence https://grace.github.io/writing/observability-is-not-evidence/ 2026-09-05T00:00:00+00:00 Honeycomb said it themselves in 2023: observability and compliance workloads are orthogonal. Sampling is the product; retention is 60 days. Three years on, the answer for the other workload is still 'build a data lake' — here is what actually finishing that takes. The strongest test in your AI controls checklist doesn't run https://grace.github.io/writing/invoice-reconciliation/ 2026-09-05T00:00:00+00:00 Reconcile logged request counts against provider invoices, month by month. It is the best test in every AI control mapping, including the one I wrote. AWS billing data contains no request counts. Grimwatch https://grace.github.io/writing/grimwatch/ 2026-09-05T00:00:00+00:00 A SOC 2 Type II opinion covers a period. Every compliance tool shows you today. Grimwatch assembles point-in-time snapshots into the period record an auditor actually asks for — including the gaps between scans. The CFPB's own form fails the disclosure rule https://grace.github.io/writing/form-c1-audit/ 2026-09-05T00:00:00+00:00 Applying a security disclosure rule to the adverse action notice the CFPB actually publishes. What leaks, what does not, and where Regulation B already drew the line. What does an explanation actually leak? https://grace.github.io/writing/explanation-disclosure/ 2026-09-05T00:00:00+00:00 Five reproducible measurements on the assumed conflict between explanation mandates and model extraction. Two negative results, and one positive result narrower than the question. Five incidents your taxonomy has no row for https://grace.github.io/writing/decision-layer-incidents/ 2026-09-05T00:00:00+00:00 Five classes of supply-chain incident involving automated decision systems that conventional incident taxonomies have no row for, and the instrumentation that would make them visible. AI Controls for SOC 2 Type II https://grace.github.io/writing/ai-controls-soc2/ 2026-09-05T00:00:00+00:00 Thirty-two controls for systems that call large language models, mapped to the 2017 Trust Services Criteria, each with a test procedure written for a period rather than a moment.