Field notes
Notes from the years the questions were still live.
Dated to the moments they come from — early product bets, launch pressure, consent questions, reliability resets, leadership transitions. Some are conviction, some doubt; the work kept asking better questions.
Newest first.
2026
2026 · Trust
Why I left the platform for the patient
Twelve years building for billions taught me to feel scale in the abstract. I’m leaving for work where the consequence has a face, on purpose.
Live questionAfter a career of consequences measured in millions, do you want the kind you can finally see?
TrustHealthcareConsequence2026 · Trust & safety
The adversary is sometimes the account holder
What designing supervision tools taught me: in trust systems, the dangerous insider is often someone you already let in.
Live questionIn a trust system, who do you design against when the dangerous actor is already authorized?
TrustSafetyIdentity2026 · Leadership
The team is the deliverable
On the craft of management — why a leader’s real output is what their team can build without them.
Live questionWhat is a leader’s real output, if not what their team can build without them?
LeadershipPeopleCraft2026 · AI & trust
“Humans in the loop” is not a safety plan
The phrase reassures more than it protects. What a real version asks of the people who build the system.
Live questionWhen is a human in the loop a safeguard, and when is it just a place to put the blame?
AI safetyTrustAccountability2026 · Ethics & craft
Defaults are moral decisions
What eight years building for families taught me about the ethics hiding inside a toggle’s default state.
Live questionWho is a default really serving, before anyone reads a word?
EthicsDefaultsCraft2026 · Trust-critical systems · The abuse case
Design the unsafe home first
A supervision tool is most revealing not in the loving family it was built for, but in the home where it becomes a weapon. That case is not an edge. It is the spec.
Live questionDo you design a trust system for the user you hope you have, or the one who already holds power over someone else?
TrustPowerAI2026 · AI systems
I bet a compliance migration on a model
The cleanup nobody would fund with humans was the one that mattered most. The only way to afford it was to let an AI do work I’d normally never let it touch.
Live questionWhen the work is too big for humans and too sensitive for a model, which fear do you let win?
AIMigrationTrust
2025
2025 · YouTube · Platform
A platform no one is forced to use
My team sets the standards hundreds of engineers build on, and I can’t order a single one of them to adopt anything. A platform you can’t mandate has to be good enough that people choose it.
Live questionHow do you set standards for hundreds of engineers when your authority over them is essentially zero?
LeadershipPlatformsInfluence2025 · Engineering org
My reach exceeded my authority on purpose
Eight people reported to me; ninety ran on processes I set. I had to learn to lead the ninety without the lever I’d been trained to pull.
Live questionHow do you take responsibility for far more than you control without pretending you control it?
LeadershipInfluenceScale
2023
2023 · Google Assistant · Platform
The empire you agree to dissolve
We built a custom framework to make Assistant logic portable across servers and devices. Then I argued my own teams should hand most of it away — and wind themselves down.
Live questionWhen the strategy shifts away from what your team owns, do you defend the empire or dismantle it on your own terms?
LeadershipPlatformsChange2023 · Assistant & Gemini · AI systems
The demo is not the product
AI capability is crossing from interesting to obvious. I keep coming back to the distance between a great demo and something real users can rely on.
Live questionWhat has to be true before an AI capability becomes a dependable product?
AIFulfillmentProduct systems
2019
September 2019 · Family Link · Reliability
I asked Google to stop shipping
Growth was outrunning reliability, and I was about to argue that a growth org should stop shipping. I wasn’t sure I was right.
Live questionWhen does continuing to ship become the irresponsible choice?
ReliabilityLeadershipTrust repair2019 · Family Link · Reliability
The dashboard is not the reality
We had dashboards. That is not the same as being able to see what users actually felt.
Live questionCan an organization tolerate seeing itself clearly when the dashboard is green?
ReliabilityObservabilityHonesty2019 · Family Link · Identity & dignity
We called it a supervised member. He called it his account.
The infrastructure needed one clean word for the relationship. The teen on the other end of that word already had a name, a history, and a sense of whose account it was.
Live questionWhen supervision is added to an account a person already owns, whose account is it now?
IdentityDignityTrust
2018
2018 · Family Link · Teens & autonomy
A supervised teenager is the most motivated red team on earth
Designing against bypass without designing with contempt — and why the family is not a security model.
Live questionHow do you design against bypass without designing with contempt?
AutonomySafetyTrust2018 · Family Link · The autonomy transition
The account belongs to the teenager
Parents wanted to supervise teens who already had real digital lives. But that account was the teen’s — which made consent, and the exit, the whole engineering problem.
Live questionWhen a parent wants to supervise an account that already belongs to a teenager, who is allowed to say yes — and who is allowed to leave?
AutonomyConsentSafety
2016
2016 · Family Link · 0→1
Four prototypes became a promise
The pieces were starting to look like a product. The harder question was whether a family could understand the whole.
Live questionWhen do useful features become a coherent promise a family can understand?
0→1LaunchProduct clarity2016 · Family Link · Identity model
A family is not an account
Google’s identity systems knew one thing: the individual adult. We had to teach them what a child, a teen, and a parent were — without forking every product to do it.
Live questionHow do you model ‘supervised’ for a six-year-old and a sixteen-year-old in the same system without forking every product that touches an account?
IdentityTrustScale