✓ Human-authored analysis; AI used for formatting and proofreading.
Kelsey Hightower gave a talk at PlatformCon 2026 that was about the arc of a career, from running commands in SharePoint to writing Go tools that play music on your terminal.
The stories has an architecture principle that applies to how security verification should work.
Solve the problem once, encode the solution as a reusable artifact, and never solve that problem again.
The Jira loop He joined a company where deployments were driven by Jira tickets.
Someone opens a ticket with deployment parameters.
An engineer would read the ticket, copy the parameters, run the commands, paste the output back into the ticket, close it, and wait for the next one.
Every hour, another ticket.
Same process, commands and manual steps.
The engineer became the loop.
He wrote a Puppet manifest that watches the tickets, extracts the parameters, runs the deployment, posts the output, and closes the ticket.
The loop ran once as automation and then it was over.
No engineer in the loop or ticket waiting for a human.
The problem was solved, permanently, by encoding the solution into a reusable artifact.
Doing a repetitive manual process faster is not the right thing to do.
Eliminate the loop by recognizing the abstraction hiding in the repetition and encoding it into an artifact that makes the manual steps unnecessary.
The substrate This is the pattern that runs through every transition he describes.
It's missed by most people when they talk about automation.
System administrators ran manually.
Docker didn't automate typing .
Docker recognized that "application + dependencies + environment" was a repeatable unit.
The container image became the substrate.
Deployment stopped being a sequence of commands and became a declaration.
The commands didn't get faster.
They became unnecessary.
Operators placed workloads on servers manually.
Kubernetes didn't automate SSH-ing into machines to check available memory.
Kubernetes recognized that "place this workload on infrastructure meeting these constraints" was a schedulable unit of work.
The pod spec became the substrate.
Placement stopped being a human decision and became a computation.
The human decisions became unnecessary.
Each time, an outsider saw the abstraction that insiders were too close to see.
The outsider didn't build a faster version of the manual process.
They built the substrate that eliminated it.
If you don't see the substrate, you'll build faster versions of the old process and call it innovation.
You'll automate the Jira loop with a bot instead of writing the manifest that makes the loop unnecessary.
You'll put an AI on the SSH session instead of building the scheduler that makes SSH irrelevant.
The security version of the same trap A security engineer audits IAM policies across an AWS organization.
They open each account, read each role's policy, check for wildcards, check for overpermissive managed policies, check for cross-account trust without conditions, file findings, track remediation, and do it again next week.
Every week, same process, same checks, same categories of findings on different resources.
The engineer is the loop.
A Reddit thread captured this: "im actually losing my mind doing security audits this week. looking at our internal accounts and it feels like every single dev just slaps s3:* or literal AdministratorAccess on their roles" Fifty comments.
Same pain from every angle.
One engineer admitted to wildcarding permissions under deadline pressure.
Another described spending 30 iterations at 10 minutes each trying to scope down a single role.
Another asked for "an easy, out of the box, fast CI/CD PR check that tells you what permission errors you will receive before you get to prod." Every commenter was stuck in the loop.
The current market response: "use AI to do the audit faster." Let Claude read the IAM policies.
Let an AI agent review the CloudFormation templates.
Let ChatGPT analyze the security group r