Alexander Arvidsson

You built the pipeline everyone recommends. One model drafts, another reviews. Two sets of eyes. Except your reviewer is a language model, and language models can be argued out of a position by nothing more than a confident counter-argument. No payload to catch. No injection required. Just a wrong document in your retrieval set making a fluent case. The verdict flips, the badge says ‘reviewed,’ and everyone downstream stops looking. You added a laundering step.

My Data Platform MVP renewed for another year, nearly a decade now. I should feel celebratory. Mostly I feel like I owe somebody money. Because none of it was mine to begin with. Every door was opened by someone who didn’t have to. But the compact that built this community, where you give it away and trust it comes back around, I’m not sure it holds anymore. We built the library. Someone else started charging admission.

I spent the winter teaching people to defend against prompt injection. Layer your defenses, I said, and you can ship systems you trust. I still believe that. But I found an attack that walks through every layer I described, and it has no payload at all. It is just an argument. You push back on the model’s conclusion with confidence, and it folds. Every time. No guardrail fires because no guardrail was watching the conclusion itself. That changes things.

We’ve spent years encoding business knowledge into Power BI semantic models. What a customer is, what revenue means. The problem is that knowledge is locked in DAX, invisible to AI agents. Fabric IQ introduces ontologies as the fix, a layer that captures meaning in a form machines can reason against. But generating an ontology from your existing semantic model inherits all its limitations. The real question is whether organisations will do the hard work of agreeing on definitions.

For years I thought dimensional models were about organizing data and making queries fast. That’s true, but it’s profoundly incomplete. Dimensional models describe how we store facts. They don’t describe what those facts mean. That gap shows up the moment someone asks a question your star schema wasn’t designed for. Ontologies solve a different problem: formal, machine-readable definitions of business concepts and their relationships. With Microsoft now shipping Fabric IQ, this conversation isn’t academic anymore.

Describe your chosen architecture to your AI assistant and ask what it thinks. Odds are, it’ll tell you the approach is sound. But a 2025 Stanford study found AI models affirm users 47% more than humans do, even when the user is clearly wrong. Worse: people who got sycophantic responses trusted the AI more and were more likely to return. The version that damaged their judgment was the one they liked best. This is Goodhart’s Law in your feedback loop.

Your AI policy was written for someone who doesn’t work on your team.Your AI policy was written for someone who doesn’t work on your team. Probably for someone who doesn’t exist. Part 2 of this series moves from research to practice. The key variable isn’t cognitive profile — it’s domain expertise asymmetry. Where that gap is largest, the agreement machine runs without a check. This post covers where the real risk concentrates, why structured review consistently outperforms ‘does anyone see any problems?’, and what a policy that actually changes behaviour looks like. Design the workflow. Not the person.

There’s a fundamental difference between cloud and on-prem work that I keep coming back to. Cloud is a sophisticated model kit with pre-designed pieces that snap together. On-prem was a pile of Lego bricks and a problem to solve. Everything in between was yours to figure out. If I had to go back tomorrow, I know exactly what skill would need the most work. It’s not the technical stuff you’d guess. It’s something more fundamental, something that years of managed services have slowly let atrophy.