# Dtwo Blog > Notes from the team building Dtwo: product updates, engineering deep dives, culture, and the start-up journey, written as it happens. Articles below are listed newest first. For current setup instructions and technical reference, use the Dtwo documentation. ## Articles - [Adaptive Policies](https://blog.dtwo.ai/posts/adaptive-policies): 2026-10-28. A policy written once is wrong by next quarter. Here is the design we are building toward: policies that tighten and widen from how your workforce actually uses AI, from real-time signals like a new CVE, with a human accepting every change. - [Why Agentic AI Needs Dynamic Safeguards](https://blog.dtwo.ai/posts/why-agentic-ai-needs-dynamic-safeguards): 2026-10-27. Static permissions judge each AI agent action alone. Dynamic safeguards react to what the agent already did in the session, so you can say yes to agents on sensitive data. - [How we are building our AI GTM System at Dtwo](https://blog.dtwo.ai/posts/building-an-ai-gtm-system): 2026-10-15. How Dtwo is building an AI GTM system where agents do real work across the stack, and policy decides what they're allowed to do. - [AI Blast Radius](https://blog.dtwo.ai/posts/ai-blast-radius): 2026-10-02. Of all the questions to ask before handing an AI agent access to your systems, one does most of the work: if this goes wrong, what is the worst that can happen? Four versions of that question, and how to act on the answers. - [NVIDIA OpenShell governs reachability. Dtwo governs meaning.](https://blog.dtwo.ai/posts/nvidia-openshell-and-dtwo): 2026-10-01. NVIDIA's OpenShell, announced September 28, decides what an agent can reach. Dtwo sits in its middleware hook and judges each call by its arguments and by what the session already did elsewhere. If you run agents in OpenShell, you still need that layer. - [AI governance evaluation](https://blog.dtwo.ai/posts/ai-governance-evaluation): 2026-09-29. Expressiveness and usability. Everything else on the vendor's feature list is one of those two in disguise. - [I sell agent security. So I gave my agents a boss.](https://blog.dtwo.ai/posts/i-gave-my-agents-a-boss): 2026-09-28. Our founding AE runs his entire sales job through Dtwo — prospecting, CRM, call prep, follow-up — and explains what a single control point actually buys you. - [The Wrong Chris Problem: Why AI Agents Need Smarter Guardrails](https://blog.dtwo.ai/posts/the-wrong-chris-problem): 2026-09-27. There are two Chrises in our Slack — a coworker and a customer. Here's the policy I wrote so an agent picking the wrong one can't turn into a data breach, and what I learned when a policy went too far the other way. - [Connecting Claude to Microsoft 365, Safely](https://blog.dtwo.ai/posts/connecting-claude-to-microsoft-365-safely): 2026-09-14. Security teams keep saying no when users ask to connect Claude to email. The problem isn't access, it's granularity. Here's what a yes can look like. - [My Claude Guardrails](https://blog.dtwo.ai/posts/my-claude-guardrails): 2026-08-30. Claude Code can access our internal systems. Here are the guardrails: the policies that decide what my AI agent can actually reach, all published in our policy catalog. - [Code got cheap. Architecture got iterative.](https://blog.dtwo.ai/posts/code-got-cheap-architecture-got-iterative): 2026-08-15. Cheap implementation moved the work upstream. Every architectural decision is now recorded in the same repo as code. It becomes the context for everything built after it, and gets revised when we turn out to be wrong. - [How CarNow Drove AI Adoption and Developer Productivity with Dtwo](https://blog.dtwo.ai/posts/how-carnow-drove-ai-adoption-with-dtwo): 2026-08-07. CarNow consolidated access into a single Dtwo gateway to drive AI adoption and measurable productivity gains across its engineering team. - [Good policy is the hard part. So we're sharing ours.](https://blog.dtwo.ai/posts/good-policy-is-the-hard-part): 2026-07-01. The risk from AI agents isn't any one system — it's the path between them. Policy guards that path. It's hard to write — so we open-sourced a library of policies. - [Audit kept us honest. Agents don't care.](https://blog.dtwo.ai/posts/why-audit-fails-for-ai-agents): 2026-06-25. Audit worked because people feared getting caught. AI agents don't — so agent security must shift from audit to authorization across every system. - [Securing Claude Cowork](https://blog.dtwo.ai/posts/securing-claude-cowork): 2026-06-12. A practical guide to rolling out Claude Cowork safely: restrict risky access paths, route MCP through a policy layer, and monitor what your agents actually do. - [Agentic AI security: why legacy controls fail AI agents](https://blog.dtwo.ai/posts/why-legacy-security-controls-fail-ai-agents): 2026-06-11. Legacy security controls were built for humans, not AI agents — that's why agentic AI security and governance are breaking. Here's the gap, and how to close it. - [Intent-Based Policies for AI](https://blog.dtwo.ai/posts/intent-based-policies-for-ai): 2026-06-10. The policy model that closes the gap between what organizations mean and what their controls enforce. ## Optional - [Blog home](https://blog.dtwo.ai/): Browse published articles. - [RSS feed](https://blog.dtwo.ai/rss.xml): Subscribe to new articles. - [Dtwo](https://www.dtwo.ai/): Product overview. - [Dtwo documentation](https://docs.dtwo.ai/llms.txt): Guides and reference pages in Markdown.