Blog

REST Beats MCP

Instead of using dedicated APIs, agents can operate existing web applications directly. Like humans, they rely on the most consistent implementation of hypermedia and benefit from existing context, validation, and access controls. Using an expense report as an example, I show how agents can automate complex, context-dependent tasks—without having to implement new APIs.

Blog Post

Spec-Driven Development is Domain-Driven Design’s Impatient Cousin

Spec-driven development tools like BMAD promise to fix the requirements bottleneck that agentic development teams face. But is it actually a good fit for your organisation?

Blog Post

The right size of a Data Product

Autonomous Data Product Heuristics

Blog Post

Agents good in the end?

Software development consists of a constant chain of trade-offs. As long as I’ve been building systems, there have always been things you don’t do despite wanting to do them. But now, with agents, we can fulfill all our dreams and finally build everything we always wanted and had the feeling we were missing. Spoiler alert: we shouldn’t do that.

Blog Post

Understanding AI Coding Patterns Through Cognitive Load Theory

AI coding assistants either severely harm learning or enhance it beyond manual coding—depending entirely on interaction patterns. A recent study reveals six distinct patterns with dramatically different outcomes. We’ll examine why through cognitive psychology and explore the study’s limitations.

Blog Post

Neuland reloaded

Blog Post

I sandboxed my coding agents. Now I control their network.

I want my AI coding agents to work independently, but I don’t want them to have unrestricted access to the internet. In this post, I describe how I routed all network traffic from my development sandbox through a strict proxy allowlist, allowing only a small set of explicitly approved domains. This setup finally gave me enough confidence to loosen the guardrails without constantly staying in the loop.

Blog Post

From Vibe Coder to Code Owner

AI agents generate thousands of lines of code in no time. If you want to fully leverage their potential, you can no longer review every single line – but you’re still responsible for the software. How do you take ownership of code you haven’t fully read? The answer lies in the agent harness: a system of deterministic checks, AI reviews, and targeted human review that enforces quality instead of hoping for it.

Blog Post

Your Database Table is an awful API

Is database integration still a thing?

Blog Post

Let’s Not Normalize Insecure AI Assistants

AI assistants like OpenClaw promise convenience, autonomy, and increasingly personalized help. But beneath that promise lies an architecture that quietly combines private data, internet access, and exposure to untrusted content—the lethal trifecta of security risk. Sandboxing and physical isolation help, but they don’t address the core problem. As we add more capabilities, the potential blast radius only grows. This post is a case for slowing down, questioning defaults, and refusing to normalize insecure architectures.

Blog Post

What to Do While the AI Is Thinking

AI can write code while we wait — but that doesn’t mean we suddenly have free time. Whether we should think, multitask, review, or rest depends on what kind of work we are doing.

Blog Post

AI and Elaboration: Which Coding Patterns Build Understanding?

Developing with AI through the cognitive Lens

Blog Post

I sandboxed my coding agents. You should too.

LLM coding agents are extremely powerful because they can run programs on our computers using our permissions. However, this same power also makes us very vulnerable. It only takes one mistake or one prompt injection to compromise the whole system.

Blog Post

Leave It Better Than You Found It

Leave your code better than you found it. This advice, also known as the Scout Rule, sounds so simple, but what does it look like in practice? This is the story of how I followed the advice and cleaned up a fat controller along the way, and how this unexpectedly enabled us to handle new requirements quickly and with minimal effort. It’s a lesson in habits and continuous architecture.

Blog Post

Why not scatter @Transactional everywhere?

Blog Post

From FOMO to Focus

AI is on every agenda – but where do you start? Many companies launch multiple AI initiatives in parallel, driven by the fear of missing out. The result: scattered resources, lack of prioritization, and unclear business impact. AI Opportunity Mapping provides a solution: it systematically guides you from vague AI visions to concrete, prioritized use cases with real business value. In five steps, teams develop AI opportunities in a structured way and make well-founded decisions. The result: focus instead of FOMO, clarity instead of chaos.

Blog Post

Speed vs. Skill

Every AI coding tool promises the same thing: unprecedented speed, effortless productivity, freedom from tedious work. The pitch is compelling. But what if feeling more productive and being more capable aren’t the same thing? Research shows that automation makes us feel more productive while eroding our skills. Let’s examine this tension through the lens of cognitive psychology.

Blog Post

Context Engineering: Managing AI-Generated Code Complexity

Keeping your scope small was always a good idea

Blog Post

Swiss Army Knife for Salesforce: LLM with In-Memory Database

Large Language Models (LLMs) struggle with transforming large datasets, particularly when performing aggregations that require calculations - essentially anything where you’d normally use GROUP BY or ORDER BY in SQL. But what if we need to retrieve extensive data from a system and process it with an LLM, but only have an API with limited functionality available? In this blog post, I present a solution I’ve implemented and tested.

Blog Post

Git Clarity: Building Meaningful Commits and Linear History

Feeling overwhelmed by Git’s complexity? Discover a streamlined workflow that centers on creating single, comprehensible commits. Learn how this approach leads to clearer code reviews, fewer merge conflicts, and a beautiful linear commit history that tells the story of your code. This isn’t just about Git commands—it’s about aligning your tools with how your brain works.

Blog Post

Achieving Digital Sovereignty with Standard Software

Blog Post

Managing Geopolitical Risks with Enterprise Architecture

IT leaders in Europe increasingly face questions about whether geopolitical developments – such as data protection disputes or trade conflicts between the EU and the US – threaten the viability of US cloud services. The risks range from price increases and legal uncertainties to potential usage restrictions. CIOs must not only ensure functional IT operations but also proactively assess external risks. This article demonstrates how enterprise architecture methods can help identify risks early and develop viable alternatives.

Blog Post

The Path to Heterogeneous Cloud Platforms

Digital transformation brings both challenges and opportunities for businesses. To create future-proof and flexible IT infrastructures, more and more companies are adopting multi-cloud or hybrid cloud strategies. This isn’t just about cost reduction, but also about aligning innovative services from different providers with regulatory requirements - particularly in the area of data protection. This article shows how targeted integration strategies can help you leverage the benefits of multi-cloud to optimize your existing infrastructure, reduce technical dependencies, and ensure long-term business success.

Blog Post

Modern Legacy (thanks to AI)

Why Focusing on Code Alone Falls Short in the Age of AI

Blog Post

A Governance Framework for Digital Sovereignty

In an increasingly connected world where digital infrastructure forms the backbone of our economy and society, the topic of digital sovereignty is gaining more and more attention. For decision-makers in German-speaking countries, this goes far beyond merely selecting a cloud provider. It’s about strategic agency, resilience, and the ability to actively shape one’s digital future. This article explores how a robust governance methodology can help organizations not only understand digital sovereignty but also put it into practice—without sacrificing convenience or innovation.