The Model Can See, Code and Prove; Governance Still Cannot

The awkward development in AI is not that models can now write code, inspect a screenshot, or solve an Olympiad problem. It is that these acts are becoming routine enough to be treated as ingredients. The expensive part is becoming everything around them: deciding what the model may touch, proving what it did, catching what it missed, and paying the invoice without convening a postmortem in FinOps.

Jeremy Morrell’s useful framing is that users have acquired the capacity to create tailored software by describing it. As he puts it, “In the past year your users have suddenly acquired the ability to speak code into existence.” That is a real shift in the economics of the long tail: a workflow too peculiar to justify a product team may now justify a prompt. But a generated script with customer-data access is not an adorable personalisation feature. It is an application, with all the tiresome adult obligations that word entails.

Meanwhile, Dylan Barrell argues in a Forbes Technology Council post that consumption pricing is making the gap between flashy usage and useful output impossible to ignore. The central question for engineering leaders is therefore less can the model do this? than what portion of the job is probabilistic judgment, and what portion is a verification problem wearing a polite hat? The former may merit an LLM. The latter probably deserves software that does not need encouragement to check the 9,847th case.

Morrell’s proposal for extensible web software gets the architecture right: let an accountable core be customized by generated code, but execute that code in a constrained environment. His illustrative scraper permits no ambient fetch, limits reads and traversal depth, caps private SQLite storage at 128 KiB, and gives a transform 5,000ms of CPU time. Those limits are not regrettable friction around the magic. They are the product. The magic is just TypeScript with good public relations.

The key design principle is narrow, capability-based access rather than raw API keys or unrestricted network access. A customization should receive a reference to the specific approved action it needs, not a master key and an invitation to discover its inner entrepreneur through cryptocurrency mining. Morrell surveys interpreters, V8 isolates, microVMs and WASM/WASI, while favoring a Cloudflare-oriented approach; that preference comes with an explicit employer disclosure, so treat it as an informed platform argument rather than a neutral bake-off. The underlying essay is more valuable for its threat model than for its vendor adjacency.

DeepSeek’s experimental vision API documentation supplies the operational counterpart: images have formats, byte limits, request limits, resize rules, token costs, endpoint-specific message rules, and failure modes. An image_url at low detail is reduced to 512×512; images are capped at 384 tokens after resizing; inline base64 contributes to a 48 MiB request-body limit; and a picture placed in the wrong Chat Completions role earns a 400. The docs are not a benchmark, but they are a reminder that multimodality is not “the model sees.” It is data ingress, latency budgets, billing, interface semantics and a remarkably specific collection of ways to be wrong.

That distinction matters when vision moves from demos to internal tools. A screenshot reader connected to a ticketing system is not merely an OCR upgrade. It is a new path by which data enters a reasoning system and perhaps a workflow. The sensible engineering response is not to panic, nor to paste “be careful” into a system prompt. It is to make permissions, resource ceilings, observability and revocation first-class interfaces.

Barrell’s accessibility analogy is the most salutary antidote to agentic intoxication. Accessibility testing often requires exhaustive, repeatable checks against known rules. In that territory, he argues, deterministic tools should do the checking, while models handle judgment, synthesis and explanation. That is not anti-AI. It is simply refusing to hire a gifted improviser as a compliance database.

The cost argument arrives with the same lesson. The post cites reported concern about AI cost management among financial-operations practitioners, an IDC projection that Global 1,000 firms will underestimate AI infrastructure costs through 2027, and an anecdote of uncontrolled spending that the author himself says is merely circulating. The precise horror story needs verification, but the category error is already familiar: organizations measure tokens consumed because it is easy, then vaguely hope useful work shipped occurred nearby. Uber’s reported formulation is admirably blunt: “the "link is not there yet"”.

For CTOs, the practical metric is not model usage, nor even nominal productivity. Track cost, speed and quality at the workflow boundary. Did the review catch more defects? Did remediation time fall? Did accessibility debt shrink? Did the agent generate a confident explanation of why it had not checked the code it was supposed to check? Agentic loops can raise reliability by repeatedly calling tools and revising work, but they also turn every unresolved edge case into a meter running in a locked room.

The sensible division of labor is therefore unglamorous and robust: rules engines and static analysis for exhaustive validation; models for ambiguity, summarization and prioritization; humans for accountability when the stakes exceed a retry budget. Barrell’s conclusion is the right one, even if it should be engraved above every AI procurement portal: “The solution isn't less AI. It is the appropriate application of AI.”

The frontier is genuinely moving. The Irish Times reports that several AI systems received perfect 42-out-of-42 results at the 2026 International Mathematical Olympiad, where only 1 per cent of students reportedly achieved a perfect score. It also reports a claimed LLM breakthrough on an Erdős unit-distance problem. If these results hold up, mathematics will gain powerful new machinery for searching, checking and perhaps proposing results.

But Olympiad questions have known solutions. Open research does not come with a concealed answer key and a judge who has already seen the patch. The article itself supplies neither model-level technical detail nor independent verification or peer-review status for the reported research result. That is not a reason to dismiss it. It is a reason to distinguish a remarkable capability signal from a settled account of autonomous mathematical discovery—a distinction the industry routinely deletes somewhere between the lab blog and the earnings call.

The more credible near-term future is collaboration: systems that inspect a mathematician’s work, surface possible inconsistencies, search enormous spaces, and make formal checking less punishing. Terence Tao’s vision, as relayed in the article, is of systems that “automatically check our progress in real time ... immediately flagging logical blunders and other inconsistencies.” Notice the verb: check. It is the same word looming over extensible apps, vision pipelines and accessibility audits.

That is this issue’s connective tissue. The model may be acquiring eyes, hands and a talent for difficult proofs. Production still demands a conscience made of permissions, deterministic checks, logs, budgets and someone empowered to say no. Intelligence is becoming a component. Trust remains a system design problem.