Justina Dong

Hi, I'm Justina!

I'm a planner. I always want to be ready for what's coming, and you can't build resilience against something you can't see clearly. That's part of why I spend so much time with AI. The other part is that it's just really fun. Here's what I do with it, and the messes I make along the way.

Come take a peek at the fun, the work, and the learning.

Show me

The fun

This is my lab.

It’s where I try to make things and then also try to break them.

The problems come from my own days, for example:

I love photography. But I have too many cameras and way too much film.

An open wooden crate packed with film cameras, loose rolls of film, an instant camera and spare batteries.
(this is one of 3 boxes)

I snapped pics of the whole mess and sent my lab one message:

Hey, there’s new photos on the NAS.

Hey, there’s new photos on the NAS.

It automatically knew to:

  1. Mount the NAS
  2. Review the most recent pictures
  3. Look for the geolocation
  4. Identify the cameras and film in the photos
  5. Do research on each item
  6. Write a notes file to document the inventory

Which cameras should I pack for Italy?

It knew to:

  1. Check my calendar for dates and look up the weather
  2. Check my Gmail for confirmations, to pinpoint where I’d be and what I’d be doing
  3. Assess the inventory and suggest the best film and camera setup for the likeliest Italy scenarios
  4. Write a which-camera-when cheat sheet and send it to my Telegram
  5. Send a full manual for those cameras to my Kindle, for longer reading

That was one problem.

See what else it does: dinner, news, lectures →

The work

Once I could see the whole lab, I could see where it might break. So far that’s 21 controls, each tied to something that really did.

Almost all of this was built by AI: the controls, the mapping to the frameworks, and the testing. That’s the experiment: how much of an audit can AI do?

Governance 4GV-01GV-02GV-03GV-04
Access 3AC-01AC-02AC-03
Change 4CM-01CM-02CM-03CM-04
Operations 5OP-01OP-02OP-03OP-04OP-05
Output 5OI-01OI-02OI-03OI-04OI-05
7 enforced and tested11 partly proven3 rule only

Each one is graded, and mapped to the frameworks it fits: NIST AI RMF, ISO 42001, COSO, SOX and OWASP. The third line of defence is still nobody.

  1. 1First lineThe lab. I build it and own what goes wrong.
  2. 2Second lineRisk and controls, built and tested by AI at my direction.
  3. 3Third lineNobody yet. An accepted risk, since I’m the only one at risk. See why →
See more of the work →

The learning

The system and I are both learning, and we both get graded.

It learns from what breaks.

Some of my scheduled AI jobs were writing almost nothing, and every status screen still said success. Now a small check reads what each run produced and flags the empty ones.

How it’s graded: whether each of its 64 scheduled jobs ran on time.

48 healthy9 stale2 failed5 inactive

read 09:40 · 2 Oct · jobs dashboard · rebuilt every 15 min

I learn from what I don’t understand.

When a term stops me, I say so, and it gets written up in plain words with where I met it. Then the system grades how I used AI, with a letter.

How I’m graded: a letter for each day I’m graded. This is the chart on my real report card.
A line chart from my report card: my overall grade for each graded day, on a scale from F to A.
See more of the learning →

What’s next

Thanks for checking out my lab and watch this space for regular updates!

Start overGet in touch