I’m evolving. Slowly. I’ve always been a back of the adoption curve kind of guy, so over the last few years, as AI has stormed the castle so-to-speak, I’ve taken my time with it.

Being placed on permanent sabbatical in September of 2024 meant that I’ve missed the whole AI ultimatum put on employees by employers to adopt AI in their daily tasks. My AI adoption hasn’t been coerced which has allowed me to explore on my own schedule and focus its use on projects of my own interest. That’s how the idea of Tinkering started.

Two questions

When I started tinkering, I was asking myself “how can I do or solve something with AI.” The framing of that question pushed me in a direction to opening up an AI chat agent, typing prompts, and getting results. It was fun, exciting, and powerful.

It allowed me to create three different software apps: bwak.news, bwak.email, and also bwak.money.

Bwak.news moves email newsletters out of your inbox into a feed. Bwak.email is a new way to bring email alias management to your email accounts. Bwak.money is a budgeting tool designed for those who use credit cards to earn points and pay them off monthly.

These projects reinvigorated my love of software development and introduced me to product development.

At the same time, I’ve been reading about the rapid changes in agentic development and using swarms of agents to accomplish so much more, and that got me curious. I needed to find a way to see what all the chatter was about.

This simple thought introduced a second question to ask: “If I could hire a staff to help me run bwak.news, who would I hire?”

Well, I knew I had a sign-up and conversion problem. I had an initial wave of signups, but no conversions. I knew my efforts to get more signups were becoming futile and ineffective. So, with this in mind, I simply started asking AI to help me hire a sales and marketing staff who could help me develop a strategy to gain sign-ups for bwak.news.

I didn’t want an unsupervised AI approach though. I wanted to keep myself as a human in the middle in order to stay authentic to who I am and the brand I’m building.

Why not a real agency

And here’s the funny thing: I could absolutely go and hire a physical agency to do this work for me. As an entrepreneur, it would be a logical step. But I’m not here to turn bwak.news into some massive revenue-generating machine and the cost to hire an agency would devour my modest $1,000 start-up budget.

Instead, I’m here to teach myself how to bring a product to market. The goal isn’t to build a profitable business overnight. The goal is to enjoy the journey and learn what it takes to not only build a business, but also bring a product to market. Surprisingly, these are two different but related tasks.

So, given the breadth of AI and the low bar of entry I’ve chosen to make AI integral to that journey.

I went on a hiring spree. Err, I mean, I went on an AI Agent creation spree with the express purpose to help me find and lure prospects to signing up for bwak.news.

Meet the team

Before diving in, let me explain what a hire is. A hire is a skill I created in Claude and personified for my own edification and reference. The skill is invoked via a scheduled job that runs on my MacMini for now. The execution of a skill via Claude on a schedule is the AI agent I hired.

The agents work overnight, Scout starting at 1 am, Page Writer on Tuesdays at 1:30 am, Pitcher at 2:00 am, Notes at 3:30 am, Scorekeeper Mondays at 4 am, and Helios at 4:30 am. Helios writes the daily briefing from the output of the other agents that I read when I wake up.

No one talks to the agents; they run on their own and drop their output into files that I store in my file vault.

Each morning, before feeding the chickens and other barn animals, I sit and read my daily briefing.

On most days, walking through the daily ops note takes about 15 to 20 minutes. The note is setup where I make all the decisions. Nothing goes out that I haven’t written. I send every pitch, post every Note, and write every comment on my own. Before I publish anything, I run it through Grammarly to check for spelling and grammar.

Each Monday, Radar gives me a list of article pitches that I work separately from my daily routine.

Finding partner prospects (Scout)

Greg Roche over at The Introverted Networker (), who took an early interest in bwak.news, generated 147 referrals out of the 274 from all my efforts by mentioning the app in his newsletter. His warm lead and trusted voice did more for my product’s promotion than all the articles I wrote to date. His warm referral has become the rally cry for my strategy on finding new subscribers.

This prompted my first hire, Scout, whose job is to find other newsletters and directories whose readers would make good bwak.news users: people subscribed to more newsletters than they can keep up with.

Making pitches (Helios, Pitcher)

Scout finds the prospects. I subscribe to their newsletters or directories, and then I watch. And read. And interact with the prospective newsletters.

Scout has found 42 prospects so far and I’ve subscribed to 28 to date. That’s a lot of newsletters and articles to read, so I hired a chief-of-staff, Helios to help track the publications and read the articles with me. Helios’s job is to read an article, and hold it up against my area of expertise and rate if an article is worth commenting on or engaging with, i.e., will I have something valuable to add to the conversation.

Helios doesn’t write the comments, it only finds the articles, hands them off to me with why it thinks it’s a good fit for me to engage with and then I do the rest.

This is a daily ritual I’ve adopted and has really taken shape over the last week.

These actions only serve as a means to develop a relationship with the person behind the newsletter. The goal is to make enough comments and interact with the newsletter enough so when I’m ready, I can make a pitch to the owner on why I think bwak.news aligns with their audience and see if they’d be interested in a partner deal.

I haven’t made any pitches yet, but when I do, Pitcher, my new hire, will be right there with me with all the data from our research and prospecting.

I’ve set minimum requirements around who to pitch which include observing the newsletter for at least a month (ideally get at least 4 editions) and make at least 3 meaningful comments.

Only then, will I allow Pitcher to put together the data I need to write a short simple, hopefully warm pitch to the operator.

I won’t have any pitch candidates until after Oct. 31 when I will have satisfied the requirements.

Posting on social media (Notes, Radar)

Building a business and a personal brand requires regular posting on social media channels. I hired two AI Agents Notes and Radar to help with this.

Notes watches over all my tinkering and makes suggestions for quick articles to post on Substack and LinkedIn.

Radar leverages a curated list of industry news sources, commentators, and newsletters related to my areas of interest (AI, technology, and operations) to help generate longer form articles to post on LinkedIn and Substack.

This has been the toughest hire yet and there has been a lot of trial and error to get meaningful output from Radar. Hopefully, I’ve dialed it in and starting on Monday, I’ll begin the process of publishing pieces from Radar regularly.

Showing up in search and AI answers (Page Writer)

Page Writer is helping create the SEO pages that are being used to feed Google and AI crawlers. It’s doing weekly research on what those readers search for and coming up with ideas for the content that will help improve my listing on Google and hopefully get our foot in the door for AI recommendations.

This hire is a black box to be honest and I hired it just to get started, but need to spend a lot more time pushing buttons and pulling strings to make it effective at its job.

Measuring results (Scorekeeper)

And what good would any of this work be if I didn’t have a set of key performance indicators to measure against? I hired Scorekeeper to do just that. Identify the KPIs, gather the metrics daily and weekly. Feed the results along with commentary on what’s moving the needle, areas I need to focus on, or celebrate wins from prior campaigns.

Why it’s fun again

It feels really f**king cool to have this team.

Before, all the work fell on my shoulders and was too much and became a non-starter for me. With the sales agents, that is changing. I have excitement again, I have direction, and I have the help I need to get this push started in earnest.

And the best part of all, starting a business, building a product from scratch, marketing the product, and making sales is all new to me. And with it, comes a whole host of problems that require solving.

The jury is still out. What I described here is where I’m at now. Swimming in the proverbial deep end of problems is exciting and scary at the same time. Working toward results in a systematic form is priceless.

The report outlined how a single person was able to attack 17 different organizations through a variety of large-scale theft and extortion attempts of personal data within a month’s time frame.

Not a crime ring. Not a syndicate. One person sitting behind a terminal using AI.

As a small business owner, what this means to me is that cybercriminals no longer have to target any particular organization.

Instead, all they have to do is find a door into yours.

Using AI, a cybercriminal can “vibe” code, automate reconnaissance, harvest victims’ credentials, and penetrate your network and decide what can be exploited for their gain.

We are all targets now.

What this has meant to how I run my small business is that I’ve built some core principles ingrained in me from my days in corporate America.

Early on, our security team rolled out a least privilege policy for every employee.

At the time, my team had admin rights to many of the systems they supported, rights they didn’t need.

We worked to build automation systems that replaced the need for admin access. The tools were purpose-built with only the permissions needed to do the job.

We gathered logs in central repositories, stripped of sensitive data, so nobody had to log in to a server and grep through a log anymore.

It was fine. And other groups followed suit.

Today, in my own business, the email account I use for all my communication with customers and clients is not the one I use for my bank and payment platforms.

The email addresses I use to manage my farm’s YouTube channel and The Weekly Tinkerer Substack are different too.

On each of these platforms, I keep separate account holder and content creator roles. I never publish content from the account holder role. And I never use the content creator role for account-level changes: monetization settings, security changes, anything destructive.

And yes, you guessed it, each role has its own email and login.

I only stay logged in as the content creator, which is also the account I use to interact with other channels and newsletters.

The logs and metrics from the infrastructure running my applications are sent to a central monitoring system that sends alerts to my phone, so I never have to log in to the servers directly.

Does this setup feel extreme and obtrusive?

Not really.

Using a good password manager to access different resources with the appropriate credentials is seamless and requires minimal thought.

Whose login owns your business’s Facebook page, your Google Workspace, your bank portal? Is it the one you answer email from all day?

I thought to myself, what do you mean, now what? You use your newly created Bwak News email address to sign up for your favorite newsletters.

She actually exposed a hard truth about the onboarding process that I didn’t understand at the time.

Until now.

More than half (57%) of the early adopters of bwak.news said the same thing. The data shows me that people are signing up, but they aren’t subscribing to any newsletters.

They are all asking the same question, asked in silence and backed by telemetry data on usage statistics —one number: zero usage of the app.

Zero means that after signing up and logging in, they don’t see anything in their feed except a request to resubscribe to all the newsletters they already read using their newly minted Bwak News email address.

In marketing speak, there was no payoff in my subscribers’ zero-to-hero journey after signing up to use the product, only more work.

My vision for the app was that after signing up, you use the custom email address you create to happily go to your favorite newsletters and update your subscriptions with the new email address.

This vision gave me a head start over more than half of the early adopters.

The trial users who came after them? 64% followed the initial set of instructions explaining how to subscribe to your first newsletter, Morning Brew, and that was it.

Nothing more.

My sister has never had a problem giving me feedback. Sometimes it’s overt and loving, other times it’s subtle and unintentional.

Her words have weighed heavily on me over the last couple of months, until today, when I finally decided to understand exactly what she meant.

The design of bwak.news is heavily influenced by modern-day social feeds. It’s a service you sign up for, find some friends to follow. Read the content they produce.

So, I looked back at the history of one of the original gangsters of this model, the application formerly known as Twitter.

In 2014, then-CEO Dick Costolo told a group of stock analysts that too many users start with what he called “unhealthy timelines” after onboarding to the app.^[1] Empty feeds characterize these unhealthy timelines or feeds with very little content because they follow only a small number of other accounts.^[2]

TechCrunch went on to report that new users were “dumped on a mostly empty timeline,” and “until they do [find people to follow], they’re at risk of churning out and never coming back.”^[2]

The answer that Twitter came up with? They unveiled a feature where new users pick categories like sports, TV, and technology and get a feed of tweets right away.^[3]

There it was. Twitter experienced, albeit at a larger scale, the same problem my numbers were telling me.

More than half of the early adopters never really started using the app, meaning they never received a single newsletter.

And 100% of all trials I’ve gotten since rolling out the application have churned after initially signing up.

Because Twitter’s success speaks for itself, there is something to be learned here.

bwak.news “For You” Feed

And that gets me back to a new feature I’m rolling out with bwak.news this week.

It’s the “For You” feed.

All users now get two feeds in the app: “Following” and “For You.” As before, the Following feed consists of newsletters you signed up for using your bwak.news email address.

The For You feed lets you choose from a list of curated newsletters by topic.

As a new user, this means that after signing up, you don’t know which newsletters to subscribe to or don’t have time to port your existing newsletters into bwak.news, you can select a few topics of interest and start reading some of the industry’s best newsletters related to that topic.

Existing users, the For You feed offers a unique way to discover newsletters you don’t already follow.

Either way, when you come upon a newsletter you’d like to subscribe to, the application makes it easy by directing you to the signup page with your bwak. news email address. Once you’re signed up, the newsletter will appear in your Following feed.

Why Follow Anything?

Viewing the For You feed is like window shopping. It’s a curated list of newsletters you can preview before you commit.

The feed allows you to “try” a newsletter on before you “buy.” If you want to take the tags off and “wear” the newsletter, use the built-in feature to follow the newsletter.

What’s Next

As you read this newsletter, the For You feed has been enabled.

If you are already a subscriber, check out the new feature and see if you can find a new newsletter to follow based on your interests.

And if you haven’t tried it yet, why not? There is nothing to lose and no credit card necessary.

Terri’s feature (what I’ve decided to call the For You feed) hasn’t been tested yet, but it offers a different “now what” than what I originally built, and I’m confident she’ll approve the feature name when she reads this.

Head over to the website and sign up for your free 30-day trial.

Sources

1. “7 Things We Learned At Twitter’s Analyst Day,” Martin Beck, Marketing Land (now MarTech), November 12, 2014. https://martech.org/top-things-learned-twitters-analyst-day/

2. “Twitter Will Onboard Users With ‘Instant Timeline’, Inject Top Tweets From ‘While You Were Away’,” TechCrunch, November 12, 2014. https://techcrunch.com/2014/11/12/twitter-instant-timeline/

3. “Twitter Unveils Timeline Highlights, Instant Timeline for New Users,” Victor Luckerson, TIME, November 12, 2014. https://time.com/3581714/twitter-timeline-highlights-instant-timeline/

Subscribe now

It was going to be the summer when I solidified my next career move by launching bwak.news and The Weekly Tinkerer newsletter to build my brand and serve as a funnel for building trust with my future customers.

I had it all planned out; this was going to be my second coming-of-age story.

And then I woke up one morning to find the toilets wouldn’t flush. It was the perfect harbinger for things to come.

So, when your septic system guy says pump your tank again in 2025, he means 2025. Not 2026. Failing to pump your septic system regularly can cause it to back up. And, in case you weren’t aware, all your sewage runs into one location, and when it backs up, it starts to seep out of the drains.

We were a few flushes away from sewage flowing back into our bathroom and having a bigger mess to clean up.

Next up, our upstairs AC finally kicked the bucket and needed replacing. I knew it was going to happen; we had already had to charge it with refrigerant twice in 5 years. But there was no more charging; we couldn’t go into the summer blowing hot air through our vents. Another couple of days lost as we got it replaced.

And as if right on queue, the tarp covering our newish chicken coop ripped off. This hoop-coop was a new design I tried, and now I don’t like it. That took a day to repair before all the rain hit during the spring.

Then we had the big storm roll through, a lot of lightning and even more rain. RadarScope showed 4 different lightning strikes on our property. It was a storm for the ages. We survived the night, but we woke up facing another calamity. The pergola on our back terrace collapsed. No one was hurt, except my plans for the ideal summer.

Oh, and I nearly forgot about the shutoff valve in our upstairs bathroom that failed, flooding our main bedroom. Who knew that you should replace those shutoff valves every several years? I do now.

And not to be outdone, Ada wanted in on the action also. We’ve known for a while her eyelashes were thick and growing the wrong way, irritating her eyes. We just failed to understand how serious the problem was. Each eye developed an ulcer, with one of them nearly ready to rupture, ruining her vision permanently. This required immediate surgery. We met with the doctor on a Friday; on Monday she was under the knife.

I could go on with several more surprises that hit us this summer, but you are sensing a theme here, and I won’t bore you with the rest.

The mental fatigue of waking up to a new problem each morning started wearing on me. Getting out of bed to face the day’s crisis was taking longer and longer each morning.

The lack of motivation to get things done compounded into sleepless nights.

Eventually, the kitchen garden, which had started with so much promise, was overgrown, with the fruits of my labor dying on the vines in the searing heat of August.

I needed a reframe, and it just so happened to come from a video^[1] I watched on a recent sleepless night.

Until that video, wabi-sabi was not in my vocabulary. As I watched the video, a sense of calm came over me. The toil of everything unplanned that happened over the summer looked different.

The backed-up septic system was not one step away from catastrophe. It was a lesson to tend to the system that makes the farm work.

The failed AC was not a crisis; it had been building over time, and I got to choose when to fix it.

The failed covering on the chicken coop was not a disaster in the middle of the winter, when the chickens would need protection the most. Instead, I replaced it between rainstorms and reinforced it with a velvet underlayment, which improved it.

The collapsed pergola was a reminder of time’s passage and the impermanence of man-made structures that require our care. The collapse is simply a passage of time, marking a new beginning for our terrace.

The plumbing leak, which required new flooring and ceiling repair, was a reminder that I can take care of our property and meet its needs.

Ada’s eye is distressing, but she is now on the road to recovery, and her kisses remind me that she’s going to be just fine.

And then there is the garden. Despite the record-setting heat and drought we are experiencing in the late summer, this past spring I equipped it with a drip irrigation system, and the lushness of the overgrown garden is a testament to its effectiveness.

Today, I stand on our front porch looking out over the land with different reverence. Until today, I had been failing to see the beauty in the imperfection, impermanence, and incompleteness of our lives and our land.

A lesson that usurps the original covenant I made with myself at the beginning of the summer.

Sources

1. “6 Simple Wabi-Sabi Habits to Bring Beauty and Peace to Your Life” Produced by Zen to Manabi.

—Kevin

So when I decided to deploy bwak.email to my family’s email domain, theeberts.us, I was naturally terrified of how my wife, Charlotte, would accept the change.

There was no hiding behind a screen of anonymity like bwak.news afforded me. This time, the user lives under the same roof.

She watched me toil over its development. I reported the progress to her as I tested it on my personal email domain, k3bert.net.

She understands the concept; it’s a tool for controlling who sends you emails. You get an email from our bank, approve it. You get an email from a Prince from Sub-Saharan Africa; you deny it. The difference is, these decisions are made before the email lands in your inbox.

Not a spam filter.

Not inbox rules.

Just a gate; you control who gets to enter your inbox.

The software flips the script; instead of anyone with your address emailing you, they have to pass through a gate that you hold the key to. You don’t let them in; their email never sees the light of day in your inbox.

Until last week, the concepts were just that, concepts to her. She lacked any hands-on experience. The things I told her about what the software would do had no meaning until now.

This was the first time I got to launch software where the primary user lived under the same roof as I did. Her ability to understand and operate the software is the litmus test I’ll use to decide whether to take the software public.

So, I was excited and nervous.

I hit the deploy button and in the immortal words of Vivian Ward (played by Julia Roberts) in the movie “Pretty Woman”

Big mistake. Big. Huge.

You see, I did something stupid. Not only did I deploy bwak.email to the theeberts.us domain, but I also decided to move our primary email provider from Proton Mail to Apple’s iCloud Plus (iCloud+) at the same time.

You never deploy two breaking changes at the same time. Never. Full stop.

So, it won’t come as a surprise to you when I tell you that she went to the USPS website and signed up to receive delivery notifications for a package she was receiving later in the week. Bwak.email sent her the approval request, “Let USPostalService@usps.com through” and she clicked the link to approve, and nothing happened.

I swear you could see the blood leave my face. Something I had tested hundreds of times before didn’t work.

Digging through the logs gave me the error.

Blocked due to content: The message was rejected because it contained content that the recipient’s server doesn’t allow

And as if the software gods were watching and laughing at me, another approval request came in, this time from our bank alerting us to a new statement.

She approved it.

And again, nothing delivered.

I sent my own test message in from my Gmail account, approved it, and it works!

After digging through the Resend API documentation and a few expletives later, I found the root cause.

The way Resend forwarded the email to the inbox after approval broke the email’s chain of custody and removed the original DKIM signature. Apple was interrogating the message, recognizing it originated from the USPS. But without the original DKIM signature, it flagged the message as spoofed and would not deliver the forwarded message from bwak.email.

This behavior was different. All my testing to date used Proton Mail as my mail provider, but as part of this changeover, I moved the domain to Apple’s iCloud+ service for our mail hosting, essentially negating the months of testing I did with k3bert.net.

I had a choice to make: roll back to the last known good state, which meant moving back to Proton Mail and undeploying bwak.email from theeberts.us domain. This didn’t excite me; by now it was 1:30 AM and any rollback would be a three- to four-hour process.

Emails weren’t being lost; I still had the failed messages in the logs, but my wife couldn’t see them.

So I did the next logical thing, I forged ahead.

Forging ahead meant finding another mailing service, Mailgun, that had an API that supported forwarding original MIME-type messages, which meant the DKIM would remain intact.

On paper, it should work.

It took 12+ hours to set up the Mailgun account. There was a verification process I had to go through to prove ownership of the domain I was using, and to describe the system I built, which required a human to review and approve.

In the end, I swapped out Resend for Mailgun, and I was ready to test again.

I might be making it up, but I swear I saw the clouds part and the sun come through the moment Charlotte hit approve on the same USPS message from the day before, and bwak.email delivered the message.

You could hear Katrina and the Waves’ song “Walking on Sunshine” start up in the background. That was me, walking on sunshine and partying like you’d expect a 54-year-old retired technologist would party.

A few days later, Charlotte is managing our email domain theeberts.us like a boss. I’ve purposefully stepped back to let her go at it. I spent 60 seconds explaining how to use the app, and here she was a few days later, owning it, approving and blocking senders like the pro she is.

Interesting Read

This week, I’m adding a new section to the newsletter that you’ll see from time to time. It’s part experiment and part advertisement for bwak.news, the first app I built to bring to market.

The whole point of this section is that it’s a quick take on something I read over the last week that got me thinking, and I want to share.

Hiding Out — Seth Godin

Originally published via Seth’s Blog Newsletter: https://app.bwak.news/share/aoci2PpJ10w

My Take
I have a long history of playing things safe, or at least holding things close to my chest.

Safe works until it doesn’t.

Being reminded that time is batting a thousand for outing safety motivates you to bet on yourself.

Truer words couldn’t be spoken for where I’m at in my life at this point. I’m calling myself retired, but I’m learning I have a lot more to give. So recoiling into the safety of my home is no longer a stance I’m taking because time will out me.

What’s something you built, wrote, or made that you didn’t really trust was good enough? Not until someone picked it up on their own and got it, without you there to explain it?

—Kevin

I had my assumptions, but decided it was worth looking into further.

My first instinct told me this was a privacy nightmare, a case of false pretense, deceit, lies, or worse entrapment. I was having a visceral reaction of hell no, I’ll never set foot in a Waymo vehicle. I will not surrender any more of my privacy rights in the name of convenience in the surveillance economy.

I’m, of course, talking about the recent incident where Waymo stopped a vehicle and alerted local police because two teenage riders were acting suspiciously in the vehicle during their ride. The passengers were allegedly drinking and waving guns (that turned out to be toys). ^[1]

The story goes that suspicious activity was detected, alerted a Waymo employee who intervened telling the the passengers there was a “technical issue” with the car, advising that it was pulling over and that they should remain in the vehicle. Simultaneously, Waymo contacted the police, gave them the vehicle’s location, and kept it there until they arrived.

The police officers arrived on the scene and treated it like a high-risk traffic stop and proceeded to remove the passengers from the vehicle and ultimately took them home and didn’t arrest them.

After reading the article, I had questions and needed to research this further.

Did Waymo play judge, jury, and executioner?

Reading the article, that’s what every fiber in my body was screaming. But I’ve been known to overreact a time or two, and this was no exception.

As it turns out, no, not really.

Nearly a few dozen sensors are installed on each vehicle, both internally and externally. There are the obvious ones you’d expect any autonomous vehicle to have to drive safely, and there are the internal ones you might think about, but there are a few you may not consider. ^[2]

Internally, there are obviously the cabin cameras, seatbelt, door, and window sensors. Not so obvious are the weight sensors, smoke detectors, and microphones.

What is missing, though, is facial and voice recognition systems. ^[3]

And, according to the Waymo privacy statement and terms of service, the data collected is used to enhance the rider experience, improve vehicle operations, respond to emergency situations, and protect Waymo’s property. ^[4]

This data is not shared with law enforcement agencies unless requested through the normal judicial warrant process. They regularly receive and respond to these requests and assert that they follow the relevant laws of the jurisdictions in which they operate. No different of a stance than most technology companies take.

In the case of the two teenagers, the vehicle’s machine learning detected an issue from the data collected, involved a Waymo operator who decided there was enough concern to alert local police and suspend the ride so they could investigate.

So yes, Waymo alerted police, but they didn’t act as the judge, jury, and executioner. That was left to law enforcement and the district attorney.

What about privacy? Isn’t there a level of privacy you expect when riding in a taxi, ride-share, or autonomous vehicle?

At first glance, this screams of a privacy violation of sorts. People’s behaviors were monitored, someone was alerted, and action was taken.

But, as I thought through the situation, I found myself asking, what level of privacy do we expect when taking public transportation? Traditional taxi services? Or ride-share services?

In all of those cases, there is some level of human and autonomous observation, i.e., video recording, a driver, a conductor, an operator, and other safety sensors. So, you shouldn’t expect any specific level of privacy when using them.

Thus, I couldn’t see anything Waymo was doing that isn’t already being done through other modes of transportation. The primary difference is that the person isn’t in the same vehicle as you are; they are remote and interact with you in real time when required. But, they aren’t constantly monitoring the situation, AI is.

Take, for example, you jump into a cab and light up a cigarette; the cab driver is likely to turn around and tell you to put it out. Is that necessarily any different than an autonomous vehicle detecting the same behavior and asking you to refrain from smoking in the vehicle?

The more I thought about it, the more I couldn’t see any difference between the autonomous vehicle experience and other public transportation and taxi services when it comes to the level of privacy you should expect.

But, you have to admit the obvious, there is the layer of abstraction, filled by AI, that exists between the passenger and the Waymo employee that’s different.

When in a Waymo, are you aware that you are being monitored and recorded?

Yes-ish.

After watching a few different riders’ experiences on YouTube, you hear the car go through a series of instructions and disclosures when the passengers first enter the car and begin the ride.

The vehicles start with a confirmation of the destination, seat belt requirements, rider support button use, child seat safety, emergency protocol, no interference, and interior monitoring and microphones.

The announcement also covers the use of interior cameras to check on riders, analyze for product improvements, and more (see the next section). That’s the ‘ish’ in yes-ish, b/c what is more? The weight sensors? Door sensors? Window sensors? Other sensors?

The microphones remain off unless you activate them via a support request or when a situation requires them for two-way dialog with a Waymo operator.

The disclosure doesn’t get into how your data is collected and managed, or what your rights are regarding data privacy. For that, you have to use the app or go to their website.

So technically, you may hear that you are being recorded and monitored, but most people who sit down believe there is a level of privacy because a human is not present. Which is obviously different than when taking a taxi or other ride share service who have humans operators in the vehicle with you.

Is it an algorithm or human making the decision on what is suspicious activity?

Both.

Business Insider reports that “...Waymo hasn’t publicly disclosed the full range of behaviors its systems can recognize or exactly what prompts an employee to access a live feed.” ^[5] Nor will they disclose a full list of sensors they have.

But, Waymo does disclose that they leverage machine learning from the behavior detecting sensors, which trigger alerts to employees.

Only after anomalous events are detected will the vehicle engage with human operators from Waymo. These operators have access to all the sensors and internal camera feeds and can engage with passengers using the microphones and the car’s sound system.

In other videos I’ve watched, though, it doesn’t appear that these operators can remotely operate the car per se, like with a remote control car. ^[6] From the video, you can see and hear the operator clearly explaining to the passenger that they are sending recommendations to the car on how to proceed when it became stuck in a parking area. And when finally faced with the fact the vehicle would not continue, the operator had to ask the passenger to exit the vehicle and look for alternative transportation.

This was a startling finding. So, not only is an algorithm making the initial decisions on anomalous behaviors its sensing inside the car. The remote operators have limited abilities to take control of the cars driving. But, they have every tool available to monitor, observe, and communicate with the passengers, up to suspending the service.

Where does this leave me with my thoughts on autonomous vehicles?

After looking through the Waymo website, it’s clear that safety is a top priority. And this makes sense: if the vehicles and service aren’t perceived as safe, there is no way people will set foot in the vehicle.

But, for me, this is just as much about trust as it is about safety. There is a level of trust that has to be developed. And feeling save requires trust.

A vehicle that is instructed to pull over under the pretense of a technical issue when, in fact, authorities are alerted and en route to investigate doesn’t build trust. Especially when Waymo doesn’t fully disclose what behaviors or actions will trigger such escalations.

While the algorithm engages a person, that person hasn’t been like a driver interacting with you. They step in and review the preponderance of evidence in near real time AND after the fact, making a quick decision without any obvious direct engagement with you about the circumstances.

I’ve read enough of Waymo’s policies and watched plenty of videos to feel they are working with positive intent to build a safe and reliable product. But they are falling short in building a brand you can trust.

It’s naive to expect there not to be incidents involving riders in their vehicles, no different from incidents we’ve heard about with taxi drivers and ride-share services. But the major difference is an algorithm and AI sitting between the passenger and the operators: no dialog or interaction, sensors and an AI model deciding how to proceed. Sure, a human is introduced in the middle. For now. Will that remain the case as the service scales to more markets and the number of daily trips increases? Only time will tell.

And that makes riding in a Waymo vehicle or other autonomous vehicle service a hard pass for me. What about you?

References

1. Original incident coverage — NPR, “Waymo called the cops on teen riders, raising privacy concerns” July 10, 2026: https://www.npr.org/2026/07/10/nx-s1-5886113/waymo-police-privacy-driverless-autonomous-vehicles

2. Sensor/camera count — Waymo, “Self-Driving Car Technology for a Reliable Ride” (”There are 29 cameras on our Jaguar I-PACEs”): https://waymo.com/waymo-driver/

3. No facial/voice recognition; interior camera/microphone policy — Waymo Help Center, “Cameras, microphones, and related data processing”: https://support.google.com/waymo/answer/9190819?hl=en

4. Data use / privacy statement — Waymo Privacy Policy: https://waymo.com/privacy/

5. ML flagging + Waymo’s declined comment on full trigger list — Business Insider, Lloyd Lee, “Kids, rowdy riders, don’t forget: Waymo could be watching,” July 2026: https://www.businessinsider.com/waymo-cabin-cameras-monitor-teens-police-san-mateo-incident-2026-7

6. Sawyer Merritt, “I rode a Waymo robotaxi in Nashville. It didn’t go as planned...” July, 2026 — YouTube:

And before you start screaming at me, of course you need to disclose it; how can we trust anything you are writing if you are using generative AI for your writing?

I was right there with you 96 hours ago when I started this piece. It was going to be simple; yes, I use AI to help aggregate data on my tinkering. Yes, I fact-check everything I post. Yes, all the ideas I write about are my own. And finally, no, I don’t mindlessly post AI-generated text.

But as I researched the topic, I came to understand that this is not a binary conversation, and that the data and reasons behind disclosing the use of AI-generated text are more nuanced than they appear.

I hope this article helps you think about the topic in a different way.

You may have seen recent headlines.

LinkedIn introduces an “AI Slop” reporting tool to wage war against content quality on its platform.

Hank Green, a YouTube creator and educator, inadvertently admitted to using AI in his process during a video he recorded, prompting swift condemnation from many and bringing the generative AI disclosure debate into focus.

Anthropic is rolling out the ability to watermark AI-generated text in new models, to comply with EU regulation.

Substack partners with Pangram to provide an AI text scanner.

For this piece, I’m going to keep my argument and research centered on LinkedIn, Substack, and YouTube. These are my platforms of choice. I think much of what I’ll assert is valid in other platforms, but I’m not going to take the time here to make that point.

At the time of this writing, none of the platforms have taken a firm stance on outright requiring you to disclose the use of AI-generated content on their respective platforms, except for YouTube, but, as it turns out, their stance is limited to specific use and not necessarily far-reaching.

YouTube requires disclosure of AI-generated content when it results in realistic content that a viewer could mistake as being real. This includes synthetic voices, altered events, or fabricated photorealistic scenes.

This makes perfect sense; it’s a visual platform, and the disclosure focuses on the content displayed.

But what is exempt from their policy is the use of AI to create scripts, ideas, captions, animated content, or thumbnails. In other words, no need to disclose when using AI to help with structure and research, but required when dealing with voice and visuals.

LinkedIn and Substack do not have specific terms of use regarding generative AI on their platforms, but both have given readers tools to flag or check for it. LinkedIn gives you an “AI Slop” reporting button, and Substack lets you scan a piece using Pangram.

So, the case for disclosure is more of an ethical/moral/voluntary choice, not compulsory.

And to throw some fuel on the fire, a research article by Toff and Simon in The International Journal of Press/Politics^[1] asserts that when it is disclosed that AI was used in the writing of articles, trust in the content drops significantly, even though the articles are factually correct. The research also showed that this drop in trust is reversed when specific sources outside AI are used.

So, where does this put creators?

If you disclose your usage of AI, you may be labeled as untrustworthy, even if still factually correct. The damage is mitigated somewhat if you cite sources outside the AI sphere. Creators are also benefiting from using AI in their content creation processes.

But, as the late-great Paul Harvey liked to say, now for the rest of the story (or something like that).

Here is an uncomfortable truth that I suspect will have you throwing your shoes at me. Humans are barely more able to reliably identify AI-generated text than using a simple coin toss.

Yup, your ability to detect AI-generated text is only slightly better than tossing a coin.^[2]

I know, you don’t believe me. There’s the em dashes, the sameness in sentence structure. Lack of rhythm in the work. It’s not X, it’s Y. Not an original thought, etc.

Just head to LinkedIn and ask anyone; they’ll gladly proclaim they can, without a doubt, identify AI-generated text.

The data shows otherwise. People are confident about the wrong signals.

But there is actually one tell that is obvious and tips the scales in your favor: hallucinated facts and fabricated sources.

All at the same time now, “well no sh*t Sherlock.”

And that’s the point: for most people, human detection is more performative art than fact unless the text in question is factually incorrect and the sources are invalid.

It’s such a big point that the EU recently enacted the EU AI Act’s Transparency Code (Article 50(2)).^[3] It says several things, but most notably as related to this article:

AI models need to produce a synthetic content marking when it’s generative AI. This includes having the software machine-mark text, image, audio, and video output so it’s detectable as AI-generated.

There’s one important limitation to this legislation worth noting.^[4] The watermark ONLY proves the AI touched the content it’s producing, but doesn’t indicate who wrote it or how much of the text is generated; i.e., stuff heavily edited by a human after the fact will no longer necessarily bear the watermark. As such, the watermark isn’t enough to purely indicate that content is AI-generated, and thus any claims to be able to identify AI text are more performative than quantifiable.

So, this article is getting lengthy; let’s summarize quickly before moving on.

• We are more likely to distrust AI-generated content, even when factually correct.

• AI is proving to be a very effective tool for generating content and researching topics.

• People’s ability to identify AI-generated text is slightly better than a coin toss; the signals we rely on are unreliable. The ability to detect AI-generated text changes when it hallucinates or cites non-existent sources.

• Disclosing AI usage is more a matter of principle than a compulsory rule.

Where does this leave someone like me, someone without a well-known brand, but liked by my colleagues (for the most part), who is starting on a new journey to publish works in the public space? Should I or should I not disclose the use of AI as part of my workflow?

Interestingly, it was difficult to find straightforward examples of more well-known creators disclosing their use of AI. The few I found include Katie Harbath, Carlo V. Santiago, Hank Green’s personal policy, and Complexly’s institutional policy.^[5] And that was it. It’s not to say others don’t disclose their use, nor does it imply people aren’t being honest about it, but what it does signal is that the topic, while hot, isn’t necessarily being addressed by widespread acceptance of disclosing AI use.

For me, I’m all for disclosure. I’m beginning my creator journey, and it’s not just about publishing my thoughts, but about building trust in what I’m doing so I can share what I’m creating with you, and you can see my process.

In 2025, I started posting on LinkedIn to build a personal brand. It was more of an experiment than driven by a specific cause, and it yielded modest results.

When I began the process, I was all in, leveraging Claude to help generate content. This included taking my ideal customer profile (which AI helped me create) and asking about the pain points people were experiencing in my areas of expertise. I’d find a pain point and write my own thoughts around it, more of a brain dump than a structured article.

I fed my brain dump into an AI process I created, which helped me write two versions of the same article. The first was a story-based arc and the second was a contrarian take on the original idea. A third process compared the dueling articles, scoring them against an opaque rubric (again created by AI) and recommending which version to publish.

Maybe not ironically, the scores were often 39 out of 50 vs. 37 out of 50. Read into this what you will, but I find it funny that the two different arcs converged into near sameness when quantified by AI. The humor lands hard when looking back on that time.

Not only was there the sameness, but the articles that were being produced were flat, uninteresting, and void of soul.

The output I was reading looked eerily similar to so much of what I was seeing on LinkedIn. As it turns out, a peer-reviewed study confirmed that people who frequently use AI for writing are better detectors of AI-generated content.^[6]

I was producing AI slop. The same slop I rolled my eyes at so often when scrolling.

What was produced was a sanitized, watered-down version of a brief I fed to the AI that looked like so many other posts.

I tried to rewrite them to follow the arc of the winning article. If the measure of success for the posting was engagement and views, I had a few land well, but most of the articles posted didn’t move the needle.

The frustration was mounting with the lack of results, especially as I started writing more about the business I was starting.

Thinking the problem was that the output was lacking my voice, I launched into a 100-question interview of me to generate a voice profile to give to AI to make it sound more like me, an idea I took from Ruben Hassid’s newsletter article titled “I can be you.”

I reworked my dueling agent process to leverage my newly minted voice profile, and while the quality of the drafts improved and sounded more like me, the output was still flat and lacked soul, so I was rewriting it before publishing.

So, I pivoted my process to where I’m at today. I trashed the dueling agents and replaced them with a muse process I created that takes the output of my weekly tinkering, considers a backlog of article ideas I’ve generated based on things I’m reading, and asks me one question.

“What’s on your mind — tell me the idea or the moment, like you’re talking it through.”

It takes my long-form brain dump of an idea, often transcribed, and helps identify the threads to pull on, the ones to leave alone, and the ones to cut out altogether. It asks clarifying questions, restates what it understands, and iterates to help fully develop the article’s scaffolding. Not prose, just a scaffolding that looks like:

I use scaffolding to craft the article, and when satisfied with the content, I feed it into Grammarly to help with grammar, punctuation, and sentence structure.

The result of the process is the article you are reading now.

With the backstory out of the way, it’s time to formalize my disclosure statement:

What I have learned is that creating content is hard. The urge to find shortcuts in the process is real, and AI genuinely eases friction in it. This creator economy is always in flux, and the idea of AI disclosure, while not new, has taken on renewed vigor due to the proliferation of creators, pressures to produce, recent legal changes, and the high-profile case of Hank Green.

As I look at what happened with Hank Green, the court of public opinion hasn’t been kind to him for doing something he never fully explained. Clearly, I don’t know his intent or how widely AI was used in his process, but for me, I’m willing to give him the benefit of doubt. I’ve enjoyed the videos he’s produced over the years. What I’m taking away from his situation, disclosing how I use AI early in my creator journey is important to me. And how that disclosure looks includes what tools I use, how I use AI, and when I use AI.

Sources

1. Toff, B., & Simon, F. M. (2025). “Or They Could Just Not Use It?”: The Dilemma of AI Disclosure for Audience Trust in News. The International Journal of Press/Politics, 30(4), 881–903. https://doi.org/10.1177/19401612241308697

2. Human detection of AI-generated text hovers near chance — or worse — across multiple independent studies:

   
   Penn State News, “Q&A: The Increasing Difficulty of Detecting AI vs. Human Text” (May 14, 2024): https://www.psu.edu/news/information-sciences-and-technology/story/qa-increasing-difficulty-detecting-ai-versus-human

   
   Yale Daily News, “Readers Can’t Accurately Distinguish Between AI and Human Essays, Researchers Find” (Nov. 18, 2024): https://yaledailynews.com/blog/2024/11/18/readers-cant-accurately-distinguish-between-ai-and-human-essays-researchers-find/

   
   Berber Sardinha, T. (2024). AI-Generated vs Human-Authored Texts: A Multidimensional Comparison. Applied Corpus Linguistics, 4(1). https://www.sciencedirect.com/science/article/abs/pii/S2666799123000436

   
   “Bot or Not: Can People Tell the Difference Between Stories Written by a Human or by an AI System?” Judgment and Decision Making (Cambridge Core): two studies, N=424 and N=481 adults — 39.39% and 51.97% correct respectively, both at or significantly below chance. https://www.cambridge.org/core/journals/judgment-and-decision-making/article/bot-or-not-can-people-tell-the-difference-between-stories-written-by-a-human-or-by-an-ai-system/45E6DC0BB90AA648654D5AE243F6C667

   
   Milička et al. (2025). Learning to Detect AI Texts and Learning the Limits. PLoS One. Baseline (untrained) accuracy 55.4% (N=254), rising to 65.1% with corrective feedback training — still short of reliable. https://pmc.ncbi.nlm.nih.gov/articles/PMC12527182/

3. The EU AI Act’s Transparency Code (Article 50) itself, effective Aug. 2, 2026:

   
   European Commission, “Safer and More Transparent AI” (Aug. 2, 2026): https://commission.europa.eu/news-and-media/news/safer-and-more-transparent-ai-2026-08-02_en

   
   EU Artificial Intelligence Act, Article 50 transparency obligations, explainer: https://artificialintelligenceact.eu/transparency-rules-article-50/

4. Anthropic’s own published limitations on its text watermark:

   
   Anthropic Support, “How Claude Marks AI-Generated Content”: https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content

   
   TechCrunch, “Anthropic Says It Will Watermark Text Generated by Its AI Models” (Aug. 11, 2026): https://techcrunch.com/2026/08/11/anthropic-says-it-will-watermark-text-generated-by-its-ai-models/

5. Named creators with published AI-disclosure policies:

   
   Katie Harbath, “How I Use AI” (Anchor Change newsletter): https://anchorchange.substack.com/p/how-i-use-ai-newsletter-workflow

   
   Carlo V. Santiago, “Coming Out (AI Edition)”: https://carlovsantiago.substack.com/p/coming-out-ai-edition

   
   Hank Green / Complexly AI policy (YouTube Community post, ~2026-08-09): https://www.youtube.com/post/UgkxbXRPEpONUqoIf0Zu2OPNaKBtd95IIgxU

6. Complication — frequent AI-tool users are a real exception:
   
   Russell, J., Karpinska, M., & Iyyer, M. (2025). “People Who Frequently Use ChatGPT for Writing Tasks Are Accurate and Robust Detectors of AI-Generated Text.” Accepted, ACL 2025. Five annotators who write with ChatGPT frequently reviewed 300 non-fiction articles against multiple frontier LLMs (GPT-4o, Claude, o1); majority vote misclassified only 1 of 300 — outperforming commercial detection tools, even against paraphrasing/evasion tactics. https://arxiv.org/abs/2501.15654

“...I’m in a long lifetime battle with email terrorism... it’s something that I battle every day, about three or four times a day.”

I snort laugh when I hear the term email terrorism, but continue listening.

“I purchased something for my new apartment... I know when I checked out it was like, ‘Sign up for our savings email blast.’ And I was like, uncheck. Want no part of this.”

“I’m talking I’m like eight emails deep after I purchased like some towel hooks. Something incredibly pedestrian... something you would never write a review about unless you’re a complete whack job bored to tears.”

“So I unsubscribed. And then it pops up, ‘Thank you. We’re sorry to see you go. Thank you for unsubscribing. This will take 48 hours to update.’ Which is total — and a pathological lie.”

“In those 48 hours after I declined the survey... I unsubscribe. And in the ensuing 48 hours, six emails per day, 12 additional nukes to my inbox.”

“Here’s what I hate — you put the unsubscribe when you’re checking out, but they have your email for billing. So then they keep emailing you. So you unsubscribe twice.”

“A lot of these retailers are abusive husbands. And the consumers are the battered wives... everything’s a hustle. Everything’s a shakedown. Everything’s a harassment.”

”Will you ever buy anything from that company again?”

”If I need it, I probably will... that’s the problem. I’m just being honest... the instant gratification person in me... I’ll be like, tap the vein, hit it... let’s go with the emails. I’m ready. I’m locked and loaded.”

It’s too much. I stopped the lawnmower, turned it off, and then pulled my headphones off. I was belly laughing at what I just heard. I’d been mowing the yard listening to the podcast “I’ve Had It” for the first time, where the hosts Jennifer Welch and Angie Sullivan discuss all things political pop culture.

Buried in the podcast, the hosts described one of the problems that led me to build bwak email. There is real frustration when you opt out of receiving emails from a company. Most of the time, you opt out of receiving promotional or product updates, but you still receive emails asking you to “rate the product you bought” or to “tell them about your shopping experience.” And the colonization of your inbox happens as you receive these unwanted emails.

When it happens, you feel powerless and don’t know what else to do, nor do you have many good options today other than to write a rule in your inbox or mark the emails as spam.

And the scary part- not scary like The Amityville Horror kind of scary, but scary like What a coincidence, I was experiencing something similar with emails I was receiving from LinkedIn the other day.

Bwak email is one of the Tinkers I’m working on today. It is an email alias gateway that sits in front of my real email address and acts as a gate for emails I receive. The inbound emails require explicit human opt in approval before reaching my inbox. I can give anyone an alias that passes through the gate and gets delivered to my email if I’ve approved the sender.

Since I began tinkering with this idea, I’ve approved over 130 senders to different email aliases I’ve created for my k3bert.net domain. And after several weeks, I started to feel like I was experiencing déjà vu as I approved six different senders from LinkedIn.

It took the 6th approval to finally catch on to an issue I’m having with the user experience. Each time I received an email from LinkedIn, I approved it, and each time I thought to myself, I had already approved the sender on LinkedIn, not realizing each approval was for a different sender from LinkedIn. I was only keying on the domain LinkedIn, and that was the missing piece for the application.

The original design for the app included a per-sender (From) AND per-receiver (To) address approval process, which would mean if I received emails from different senders, albeit the same domain, I’d have to approve them all explicitly.

The answer: build a DOMAIN-level approval/denial mechanism.

In other words, give the user the option to Opt In to all emails from a specific domain (a.k.a. website) and forgo the explicit approval process for each sender.

And this is what I built in version v0.6.0 of bwak email. A unified 5-state approve/block model (sender/domain/alias scopes) replacing the previous asymmetric terminology I developed.

The five states?

1. Let newsletters-noreply@linkedin.com through

2. Trust everyone from linkedin.com

3. Block just newsletters-noreply@linkedin.com

4. Block everyone from linkedin.com

5. Block anyone emailing linkedin@k3bert.net (To)

With this approach, a block action (domain or sender) ALWAYS overrides an approve. Domain-level actions override sender-level approvals.

This approach creates a streamlined user experience, giving them the control they need over their emails.

Looking back at the discussion between Jennifer and Angie, if they had bwak email, they wouldn’t have to worry about unsubscribing; they would potentially have the option to block the “review the product emails”, but approve “order update emails” because they come from different senders. And if they ever got annoyed to the point of no return, they could go nuclear and block ALL the emails from the sender.

I just rolled this out last week, and I’m testing it. I’ve tested with sample data, but I couldn’t test all the usage/approval/denial paths due to limitations in my ability to send emails from different senders, so I’m fishing with bait, waiting to see how the system performs in the real world.

Charlotte’s grandchildren hadn’t ever shot arrows before, but they instantly fell in love. After a few hours, they were drawing the arrow back and hitting the target like a pro. This is life on the farm. When you visit, we create an experience you take home with you. Charlotte’s grandchildren now have their own archery range back in Texas, set up by their parents.

Visits to our farm are not casual; they are experiences carefully planned, created, curated, and executed by us.

I’ve been on LinkedIn for two decades now, and I’ve been posting regularly for the past several years. More recently, I started posting with a purpose. After experiencing a career disruption, instead of jumping back into the familiar corporate life, I decided to bet on myself and post on LinkedIn with the purpose of promoting a business I started.

The performance of those posts has been lackluster, and it would be easy to blame the algorithm for killing my reach. I refuse to assert that my posts are flopping. No, I failed to realize the strength of the LinkedIn platform and how to succeed on it. I’ve been a stubborn donkey not reading the room.

With new resolve and a shift in focus, I’m going to refine the work I’m doing on LinkedIn AND extend my outreach to include Substack.

LinkedIn is the snack bag you get on a short airline flight. You open the bag and pick through the contents while reading the nutritional information on the back. It’s the platform you open up at work when you have a few minutes and scroll to kill time. You enjoy the saltiness of the posts; they are quick, tasty hits of time management, leadership development, and other career-growth flavors that reflect your interests.

Substack, on the other hand, is the dinner you sit down to once you arrive on the farm. It follows a day of activities like archery. It’s a time where you receive a multi-course meal with an appetizer, main course, dessert, and a relevant drink pairing. It’s a time to reflect on the day’s activities and wonder what tomorrow will bring.

We have a seat waiting for you. Subscribe to The Weekly Tinkerer.

It’s time to turn the opt-out model of email on its head to fix it.

I wanted another Apple HomePod speaker for our home. Found it online for in-store pickup at my local Electronic Express. I added it to the cart, checked out as a guest, and forgot about it.

A couple of years later, I received a spam message addressed to: electronicexpress-0921@k3bert.net. I was confused; I didn’t create an account with them. Why am I receiving spam?

I looked up the address on Have I Been Pwned and found out that in Feb of 2023, Eye4Fraud, an online fraud protection system used during payment transactions, was breached and the data made available to hackers.

The forgotten email came back to life until I created an inbox rule to delete any messages sent to electronicexpress-0921@k3bert.net permanently. Opt-out.

And then there was the time I decided to sign up for updates to my Alma Mater, CU. I opted to receive alum emails at cualumni@k3bert.net related to the engineering school, from which I graduated.

I received my first few updates, but then there was a shift. It wasn’t just updates on the School of Engineering; the emails were now boosters for the Alumni Association and covered other clubs and associations within the university. And then, to make matters worse, someone from the Alumni Association started calling. Their whole job is traveling around meeting alumni to “catch up,” which I’m fairly sure means asking for money.

I tried to opt-out through my mail preferences, but the emails and calls kept coming in.

I created an inbox rule to delete any messages sent to cualumni@k3bert.net permanently. Opt-out and blocked the phone number.

And then there was Verizon and Heritage Bank and Trust. For a few years, we did business with these companies until we stopped and permanently closed our accounts. Or at least we thought.

But, for months after closing the accounts, we still received monthly statements of our accounts. Confused, I called several times, explaining the accounts were closed and that there was no need to send us statements anymore. They agreed. The emails kept coming.

I created an inbox rule to delete any message sent to their aliases permanently. Opt-out.

Today, AI agents are augmenting and supercharging inbox rules and, if you decide, will take over your entire inbox for you. But what’s the difference between an AI agent managing your inbox for you versus you manually managing the rules? Other than out of sight, out of mind, it’s still opt-out.

In the immortal words of Buzz Lightyear: “This isn’t flying, it’s falling with style.”

And personally, I’m not all that comfortable with an AI agent crawling through my inbox and noticing who I shop or bank with, what credit cards I have, when I received my tax return, or when I pay my utility bills. This is all personal information that I would like to keep personal.

For years, I’ve been trying to manage the 1,390 unread messages like most everyone else. Giving out my email, receiving unwanted messages, trying to opt-out, giving up, and waving the white flag.

And now, I’m tinkering. I’ve started an experiment with my personal k3bert.net domain that, if successful, I’ll transition the domain my wife and I share for all our household accounts.

The experiment started with a declaration of email bankruptcy, archiving off all my messages into cold storage. And a gate slotted in front of the domain that inspects all senders and aliases, comparing them to an allowed list. When a new email arrives and the sender is not in the allowed list, I have a choice to allow the email to land in my inbox; in other words, I opt-in.

And then something caught my attention. The green highlight text I chose for the site was difficult to read.

I have good color perception. In fact, Charlotte has crowned me the official paint color picker when it comes to decorating our house. So, I figured if the text was difficult for me to read, the roughly 8% of men with red-green color vision deficiency would struggle to read it also.

That wasn’t ok with me.

I was aware of the accessibility guidelines published by the Web Content Accessibility Guidelines (WCAG), but never had to worry about building with them. So I was surprised when I handed the problem off to my AI agent, and it threw up a sample page showing that indeed, the emerald-600 (hex #059669) green color I selected for the website failed the standard.

Standard? What standard? Up until now, my choice of colors was always based on taste and if it reads fine, ship it. I had no idea that the standard specified a way to calculate the contrast and grade it as a means to quantify accessibility usage of your application.

Every color has a computable relative luminance, which is a fancier and more accurate way of saying “how bright it actually reads to the eye.” Take two colors, compare their luminance, and you get a contrast ratio. Identical colors give you 1:1, invisible against themselves. Pure black on pure white gives you 21:1, the ceiling. Everything else falls somewhere in between, and the formula gives the same answer every time, for every viewer, regardless of taste.

My green, emerald-600, measured 3.77:1 against white. WCAG’s baseline standard for normal text is AA, and AA requires 4.5:1. My “fine, it’s just a light green” accent color was failing the accessibility standard I didn’t know existed.

There are two levels worth knowing; AA is the baseline most sites are expected to hit: 4.5:1 for normal text, 3:1 for large text (think 18-point-plus, or bold at 14-point-plus). AAA is the stricter tier, not usually a legal requirement but the one that gives you real margin instead of a bare pass: 7:1 for normal text, 4.5:1 for large. My original green wasn’t even clearing the low bar.

I went with the recommended emerald-800 (hex #065f46), a 7.68:1 ratio. Not a bare pass over the AA line, but clear of AAA too, with real margin to spare.

Because the color lived in one config token instead of being copy-pasted into forty places, changing it fixed the accent color across the entire app in one shot: CSS, every transactional email, account and billing pages, badges. All of it, except three admin-only internal tools I left alone on purpose, because nobody outside my team ever sees those.

The part I want to hand you isn’t the story. It’s that this is checkable, right now, on whatever you’re running, without asking anyone’s opinion:

1. Chrome DevTools — inspect any text, click the color swatch next to color in the styles panel, and it shows you the live ratio plus AA/AAA pass or fail, along with a suggested color that would pass. Fastest option, already installed.

2. WebAIM Contrast Checker (webaim.org/resources/contrastchecker) — paste in two hex codes, get the ratio and pass/fail for both normal and large text. It’s the tool most accessibility writeups point to first.

3. Lighthouse (also built into Chrome DevTools) — audits a whole page at once instead of one pair of colors at a time, so it’ll surface every low-contrast spot you didn’t think to check.

4. An AI coding assistant — ask it to build you a side-by-side comparison tool for your candidate colors, with real computed ratios. It’s not a shortcut around the standard; it’s a fast way to see the standard applied to your actual palette, which is exactly what got me here.

You already have a website, an app, a newsletter template, something with text on a background. Open DevTools, click your accent color, and read the number. If it says fail, you now know something concrete instead of something you assumed.

That’s what happened to me today.

“Hey Kevin, I signed up for your service, but I can’t login. Here’s my email address I’m trying to log in with and the device/browser I’m using. Can you help?”

I had 10 minutes before Charlotte and I were to head out for an appointment, so the pressure was on.

Check the logs, yep, there were the three login attempts made. But no indication of an error in the process nor that they received the message saying the magic link the app sent them to failed.

This was going to require intuition and an educated guess.

The difference in the time that the token was created and the time it was used was only a dozen seconds. That seems quick, too quick.

An AI prompt later, the working theory was developed. Somehow, the token for the magic link was already used before my friend could click the link in the email. But, why?

AI had an idea. I didn’t, this was outside of any experience level. I’ve been around a lot of systems in my career, but authentication and authorization mechanisms was an area I didn’t spend a lot of time in.

The most likely cause was that an email security scanner/pre-fetch was loading the link in the email and because the way the /auth end point was written, it was validating the token with the pre-fetch which in turn told the system that the token was valid, and no longer needed and discarded.

That all happened between the email being delivered and the time my friend clicked the link. When they clicked the link, they received the unfriendly message that they couldn’t login.

And to add insult to injury, there was no way in the app for them to reach out and ask for assistance. Luckily, they had my number.

This was the theory, it was easily tested and confirmed.

The fix is simple, don’t validate the token when the /auth end point is called. Instead, put an intermediary step requiring the user to click the link in the email, load a new page with another button to select to finish the login process.

Yes, the solution adds a bit of friction to the process, there’s an extra click now. But, it eliminates any pre-fetch or inadvertent previewing of the page assuring that the token will work when the user intends it to work.

So, the embarrassment is real, I have no way of knowing how many other people have had the issue, more than I’m willing to admit to b/c I can see the similar usage patterns.

The embarrassment was replaced with gratitude quickly b/c someone took the time to say, something wasn’t right and brought it to my attention.

This isn’t about not trusting what AI builds. That’s too easy, and it sidesteps the real responsibility. I understood the design. What I didn’t have was the experience to know there was a gap in it. And building alone means there’s no one else around to catch what you don’t know to look for.

The counter to that is building a system that expects surprises and handles them gracefully. For me, that means an easy way for someone to reach me when something breaks, and auditing every critical process that could stop a user dead and hardening those first.

What tips or techniques do you build with to handle the unexpected surprises that will inevitably hit your system?