Sr. Content Developer at Microsoft, working remotely in PA, TechBash conference organizer, former Microsoft MVP, Husband, Dad and Geek.
156719 stories
·
33 followers

Why Accessibility Is An Operational Capability, Not A Feature

1 Share

This article is a sponsored by Level Access

We know that right now, a senior engineer is shipping a checkout flow they “built” in a single afternoon. AI assistant does the heavy lifting, happy path runs clean, and a rotating chevron spins on the order summary. Two weeks later, engineering gets a notice from customer support: a blind customer using a screen reader can’t complete the purchase because the “Pay Now” control is a <div> with a click handler. No role. Not focusable. Not working.

That gap — between code that runs and a product people can actually use — is becoming one of the defining engineering challenges of the AI era. Teams can generate UI faster than ever, but they still have to guarantee that what they ship is usable, secure, and maintainable.

Accessibility sits right in the middle of that problem.

This is not an article about compliance checklists or end-of-project audits. It’s about engineering systems. Specifically, why accessibility should be treated as an operational capability — alongside privacy, security, reliability, and observability — and what that looks like in practice.

The Audit Trap

For years, the default way to “do” accessibility was the one-time, audit-only approach: hire a firm, get a list of 200 findings, fix some of them, file the report. A lot of teams have now moved beyond this model — and the reason is worth looking into.

Audits do matter. For sales, procurement, governance — they’re essential. When a buyer asks for a VPAT or an ACR, you need one. When legal asks if you’re meeting requirements, you need documentation. Audits serve those purposes well.

But audits don’t help you build accessible features during sprint planning. Audits can cost points during a sprint. They don’t catch problems before merge requests. They don’t scale with deployment velocity. The mistake, essentially, is tackling accessibility as a snapshot when you really need constant monitoring. Six months after the audit, the product has shipped dozens of releases, multiple new features, and a redesigned nav. The report is now fiction. Compliance is not a state you reach — it’s a state you maintain, and complexity fights you the whole way.

The WebAIM Million report, which scans the top one million home pages every year, found that 95.9% of pages had detectable WCAG failures in its 2026 run, with an average of 56.1 errors per page. The number of page elements jumped more than 20% in a single year, likely driven by AI-enabled development and 'vibe coding’ — and more elements mean more places to break. Accessibility debt behaves exactly like technical debt: every inaccessible component you ship becomes a future remediation project, and the interest compounds.

Any strategy that treats accessibility as a periodic event rather than a continuous property of the system is going to lose.

The AI Problem Nobody Wants To Name

With the scale at which teams now generate UI, the gap doesn’t just persist; it multiplies.

Start with how fast this arrived. In February 2025, Andrej Karpathy coined “vibe coding” — a way of working where you "fully give in to the vibes" and "forget that the code even exists". You describe intent, the model generates, you accept the diffs without reading them. It was meant for weekend projects. It did not stay there. Y Combinator reported that 25% of its Winter 2025 batch had codebases that were 95% AI-generated.

Models don’t land on non-semantic markup by accident — three forces push them there. Most React code on GitHub uses non-semantic “soup”, so that’s what the models learn. Human reviewers and evaluators judge output visually, so the feedback loop rewards looks, not semantics. And <div onClick> is fewer tokens than <button aria-expanded="true" ...>, so absent a constraint, the model takes the cheap path.

Here’s the thing about AI-generated UI: it’s inaccessible by default. Not occasionally — by default. A developer writing in Frontend Masters tested AI-generated React components across multiple tools and documented the pattern. A typical AI-generated sidebar had ten distinct accessibility failures in twenty-nine lines: no landmark, no heading, no list structure, elements with click handlers instead of buttons, no aria-expanded, no keyboard handling, and unlabeled icons. The accessibility tree — the structure screen readers actually read — came back as flat, unstructured text. “Same pixels” as the author put it. “One is a door. The other is a painting of a door”.

Now connect this to security, because the two failures come from the same root. Veracode’s 2025 GenAI Code Security Report tested large language models across dozens of coding tasks and found that a large fraction of AI-generated code introduced security vulnerabilities — including OWASP Top 10 flaws. Cross-site scripting failures were particularly common, and security performance did not meaningfully improve with newer, larger models. The issue wasn’t model intelligence. It was process: developers generating code without specifying security constraints and accepting output without systematic verification.

The same shortcut that skips the security review skips the accessibility review. At scale, AI won’t close the accessibility gap — it has industrialized the very thing that creates it.

The fix is not to ban AI. Your developers are already using it. The fix is to constrain it and verify it — to treat AI as a very fast teammate who always needs guardrails.

Velocity and Accessibility Are Not Enemies

This is usually where someone says, “Guardrails? Sounds great, but they will slow us down.”

In practice, the opposite tends to be true.

Shift-left is the entire DevOps thesis, and it applies cleanly here. An accessibility issue caught during design review is a comment. The same issue found in production is a remediation project.

Catching an accessibility issue as a component is built takes minutes. Fixing one after the fact — discovering it in an audit, diagnosing the root cause, restructuring the markup, applying the necessary fix, writing tests — can easily take hours. Multiply that across hundreds of findings from a late-stage audit, and you have weeks of unplanned work that earlier automated checks — whether in design reviews, development workflows, or CI — could have prevented.

Teams that integrate accessibility into everyday workflows avoid the expensive surprises: emergency audits, remediation sprints, procurement blockers, and redesigns that quietly break core user journeys. Accessibility doesn’t reduce velocity. Unexpected work reduces velocity. In-flow accessibility is one way of eliminating unexpected work.

What Enterprise-Ready Actually Looks Like

The organizations that scale accessibility successfully do not rely on heroes. They rely on systems.

The highest-leverage place to start is the design system. One accessible component can be reused thousands of times. The GOV.UK Design System is a useful example: components undergo both automated and manual testing using assistive technologies such as JAWS, NVDA, VoiceOver, and TalkBack. The team is explicit about the limits of automation and supplements tooling with user testing involving people with disabilities. They’re equally clear that using the design system doesn’t “magically” make a service accessible; it just gives you a higher starting point.

Accessibility becomes infrastructure. That’s the lesson.

From there, it moves into the engineering workflow:

  • Accessibility requirements are included in the Definition of Done.
  • Pull request reviews include explicit accessibility checks.
  • Interactive controls use semantic elements (<button>, <a>) by default.
  • Keyboard navigation and focus management are treated as standard engineering concerns, not optional polish.

Finally, accessibility becomes enforceable through automation:

At that point, accessibility stops depending on memory and starts depending on the process. It becomes part of your platform.

Patterns That Actually Scale

A few implementation patterns consistently show up in teams that do this well.

Constrain AI Before It Generates

Instead of fixing accessibility after generation, bake requirements directly into tooling through Cursor rules, Copilot instructions, or repository-level standards. Tell the model to use semantic HTML. Tell it when to use buttons versus links. Tell it to expose the state and labels correctly. Models follow persistent constraints far more reliably than one-off prompts.

Stop Hand-Rolling Complex Widgets

Comboboxes, menus, tabs, modals, and similar controls routinely become accessibility hotspots. Libraries such as Radix UI, React Aria, and Headless UI already solve many of these problems. The scalable approach is not about repeatedly implementing accessibility correctly. It’s inheriting accessible behavior from well-tested primitives.

Capture Accessibility During Design Handoff

Focus order, labels, heading hierarchy, and interaction states should be specified before implementation begins. If accessibility requirements are absent from the design artifact, they are often absent from the final product. A simple memo at design handoff — what is the tab order, what are the labels, what happens on error — removes a huge amount of guesswork later.

None of these patterns is exotic. They’re just DevOps and platform thinking applied to accessibility.

The Broader Business Impact

Engineering leaders rarely prioritize accessibility solely because of regulations. But regulations, procurement requirements, user retention, and product quality all point in the same direction.

Legal pressure continues to increase. Digital accessibility lawsuits in the United States have stayed in the thousands per year, and they are not limited to large enterprises. The European Accessibility Act is now enforceable across the EU, applying to e‑commerce, banking, ticketing, telecoms, and more, regardless of where the company is headquartered. The message is clear: accessibility is no longer a “nice-to-have” in the eyes of regulators.

But compliance is only part of the story. The bigger story is the market you leave on the table. The World Economic Forum (December 2023) estimates that the world’s 1.3 billion people with disabilities, “along with their friends and family, has a spending power of $13 trillion”; disabled consumers alone control roughly $8 trillion in annual disposable income, per the Valuable 500.

In the UK alone, the Click-Away Pound Report 2019 found the “Click-Away Pound has risen to £17.1 billion” — more than 4.9 million users with access needs who abandon inaccessible sites and spend elsewhere, up almost 45% from £11.75 billion in 2016. People don’t file a bug report. They leave and buy from a competitor.

There is also a procurement reality that turns accessibility from a cost into a moat. If you sell B2B or to government, you will increasingly be asked for proof of accessibility — VPATs/ACRs or equivalent documentation. According to Level Access’s Seventh Annual State of Digital Accessibility Report, 75% of organizations now require proof of accessibility at least most of the time when purchasing digital products — essentially unchanged from 74% in the previous report, but with a notable shift towards stricter enforcement, as those that always require it rose from 27% to 31%. A strong ACR accelerates the sales cycle; a weak one, or none at all, creates redlines that stall or kill it. For some buyers, this is a hard requirement before your product can even enter evaluation. A strong accessibility story accelerates the sales cycle. A weak one creates redlines that stall or kill it.

Step back and the deeper pattern is clear: accessibility is a proxy for engineering maturity. A team that ships semantic HTML, manages focus, exposes state correctly, and tests it in CI is a team that has its house in order. The same discipline that produces an accessible component produces a maintainable, testable, less buggy one.

For dev and product leaders, that’s the real business case: accessibility work is platform work. It pays off every time a feature ships faster and more smoothly, with less rework, than it otherwise would have.

Systems, Not Sprints

If you take one thing from this, make it this: accessibility doesn’t come from an audit, a hero, or a heroic remediation sprint before launch. It comes from systems.

An accessible design system so components start right. A Definition of Done so they stay right. Automated testing and CI gates so regressions fail the build. Governance, so someone owns it. Guardrails for AI-assisted development so your fastest tool stops being your biggest liability.

None of those practices is particularly glamorous. That’s exactly why they work. They’re the same kinds of boring, reliable systems you already trust for security, reliability, and performance.

But there’s one thing no tool on that list can do. No linter, no automated scanner run, no dashboard will ever tell you what it’s actually like to use your product as a blind person with a screen reader, or to navigate your checkout with a keyboard because a tremor makes a mouse inoperable. So build the systems — you need them, and they’re the only way accessibility survives contact with a real release schedule. But test with real users with disabilities regularly. The first time you sit behind someone using JAWS to fight through a form your team thought was “done”, something changes. The tooling tells you whether you passed. A real person tells you whether it actually works.

Accessibility is not a feature. It’s an operational capability. Treat it that way, and you get something dev and product leaders already care about: a faster, safer, more reliable way to ship software.



Read the whole story
alvinashcraft
39 seconds ago
reply
Pennsylvania, USA
Share this story
Delete

JuneteenthConf Celebrates Diversity in Tech

1 Share

On June 19, 1865, Union troops marched into Galveston, TX, to announce that all formerly enslaved people were now free. This announcement was issued more than 18 months after the Emancipation Proclamation and a month after Robert E. Lee surrendered the Confederate Army. This date is now celebrated as Juneteenth, a Holiday Observed every June 19, commemorating the end of slavery in the United States.

To commemorate Juneteenth in my industry, Michael Brown started JuneteenthConf - a conference that celebrates African Americans in the Information Technology field. JuneteenthConf began as an online conference, but we held it in person at the Microsoft office in downtown Chicago on June 19 and 20, 2026. June 19 consisted of five presentations and an interview - all featuring African American tech leaders. On June 20, we held a hackathon to learn more about building apps with Agentic AI.

Day 1

Here are some notes on each presentation:

Pierre DeBois

PierreDeBoisPierre DeBois, Founder & CEO of Zimana, presented "Owning Our History in the Age of AI."

He addressed the opportunities and challenges presented by artificial intelligence. He encouraged attendees to understand and preserve the historical context of Black innovation while thoughtfully engaging with emerging technologies. His session underscored the importance of ensuring that AI development and adoption reflect diverse perspectives and experiences.


Ramatu Kandakai

RamatuKandakaiRamatu Kandakai, Founder of My Hyphen, presented "Betting on Yourself: Don't Trade Your Values for a Seat at the Table."

She emphasized that success should never come at the expense of personal values or authenticity. Ramatu challenged attendees to evaluate opportunities not by their prestige or visibility, but by whether they align with the person they want to become. Her key message was that values are not just personal principles; they are a strategic guide for building a meaningful and sustainable career.


Ashley Janelle

AshleyJanelleAshley Janelle, Founder of Empathive UX Bootcamp, presented "Building a Business When No One's Hiring."

This was Ahsley's second time speaking at JuneteenthConf. She shared how she transitioned from her corporate role at Amazon to running her businesses full-time. She provided practical advice on validating ideas, building side projects while employed, and gradually creating alternative income streams. Her message encouraged attendees to stop waiting for perfect conditions and start building opportunities for themselves, especially during uncertain job markets.


Hamdi Hassan Shahid Jr.

HassanShahidHamdi Hassan Shahid Jr., Founder & CEO of Lamma+, presented "No CS Degree, No Permission, No Problem".

He shared his unconventional journey into technology, proving that a computer science degree is not the only path to success. Drawing from experiences as a youth worker, musician, community organizer, and single father, he described the persistence required to transition into engineering and entrepreneurship. His story highlighted the resilience needed to overcome imposter syndrome, financial challenges, and barriers often faced by underrepresented professionals in tech.


Clarene Mitchel

ClareneMitchelClarene Mitchell, Founder & CEO of TCM Communications, presented "LinkedIn Power Moves to Grow Your Business."

She demonstrated how entrepreneurs can use LinkedIn as a powerful platform for business development and relationship building. She explained how consistent engagement, strategic networking, and effective use of LinkedIn's features can increase visibility and credibility with potential clients. Attendees left with actionable tactics to strengthen their professional brand and generate new business opportunities.


Madison Butler

MadisonButlerMadison Butler, Founder of Blue Haired Unicorn & Black Speakers Collection, delivered the Keynote address to close the conference.

Her keynote challenged attendees to stop performing expected versions of themselves and instead lead with authenticity. Drawing from her experiences promoting psychological safety and navigating the tech industry as a visibly different leader, she argued that authenticity is a strategic advantage rather than a soft skill. In a candid closing conversation, she explored identity, resilience, and self-care, inspiring attendees to embrace their full selves both professionally and personally.


Day 2

JuneteenthConfHackathonOn Saturday, about a dozen people returned to the Microsoft office for an AI workshop. After a brief introduction to vibe coding, we began designing and building an application by issuing prompts to an AI engine. The application we chose recorded activities and output them into a weekly status report. We asked the AI to create business objects based on our description; then to build a UI to capture data; and business logic to handle the data. Although we did not finish the application, we made more progress than we likely would have if we had coded it ourselves.


Conclusion

Juneteenth2026ConfSpeakersThe event was not without challenges. A canceled flight, a speaker who canceled at the last minute, and a glitch in the registration page all presented challenges. But together we adjusted - sometimes on short notice. Pierre stepped up to act as MC until the flight arrived. We adjusted the schedule to fill in gaps.

Those who attended the presentations on Friday enjoyed what they heard. Those who attended on Saturday learned something new. JuneteenthConf was not large event, but it was a successful one.

Read the whole story
alvinashcraft
58 seconds ago
reply
Pennsylvania, USA
Share this story
Delete

Scott Hanselman, AI, Career Development, and the Chicago Community

1 Share

Success is often a combination of preparedness, opportunity, and work. Scott Hanselman's presence at a local user group last week proved this.

Inspiration

Scott, David, Eric, And AprilI discovered an opportunity when my friend Michael Blumenthal emailed me that Microsoft Vice President Scott Hanselman was scheduled to deliver a keynote presentation last week at the Chicago Accelerate conference, to be held in the Willis Tower. Michael suggested we organize a community event the same week and invite Scott as the featured speaker. I immediately recognized a great idea and leaped into action.

I emailed Scott the next day. If he was willing to speak at a community event, I was happy to organize one. He agreed, and we settled on Tuesday, June 23. We went into action, planning, promoting, and executing on the event.

In this article, I will talk about the evening, Scott's presentation, and how a group of volunteers made it happen.

Scott's presentation

I will begin at the end with Scott's excellent presentation.

He titled his talk "AI for Normal People Who Aren't Totally Bought In" and covered a variety of topics, including Artificial Intelligence, Apprenticeship, and Knowing How to Drive a Stick Shift.

It was entertaining, thought-provoking, and full of memorable analogies.

Scott described himself as an "AI vegan." He uses AI extensively but has little interest in image or video generation. He also pointed out that AI-generated websites and content often have a recognizable look and feel. In one example, he joked about LLMs' apparent love of text gradients.

He illustrated the importance of clear communication. Scott also referenced research showing AI can optimize for passing tests without actually solving the underlying problem. One example involved fixing a race condition by adding a sleep statement that made the test pass while leaving the real issue unresolved.

A recurring message was that software development with AI is becoming less about writing code and more about sculpting it. The engineer's role shifts from authoring every line to shaping, validating, and refining what AI produces.

My favorite analogy compared AI to Uber and engineering fundamentals to driving a stick shift. Uber is convenient. But knowing how the machine works is what helps when something breaks. The engineers who matter most in the future won't be the ones with the best prompts. They'll be the ones who understand what's happening beneath the surface and can recognize when AI is confidently wrong.

One theme that resonated with me was Scott's distinction between mentorship and preceptorship. Mentors give advice. Preceptors work alongside less-experienced engineers and pass along judgment, context, debugging instincts, and engineering taste. As AI takes over more routine coding tasks, this transfer of knowledge becomes more important, not less. Scott argued that AI will not eliminate the need for junior developers. Instead, we'll need better systems for helping both people and AI agents become trusted contributors. Junior developers and AI agents share one thing in common: both can be capable and confidently wrong.

Scott closed with a personal note: he announced that he has 941 days until retirement and wants to use that remaining time effectively. Despite grouping himself with an older generation of IT professionals, he peppered his presentation with Gen-Z jargon. "AI output is mid," he quipped, indicating that LLMs gravitate toward the average, while humans are more likely to explore ideas outside the norm.

Preparing for the Event

We pulled this event off in a short period of time, thanks to the hard work of a small group of individuals.

Scott, Michael, and I are all passionate supporters of the tech community. In fact, I know the two of them because of my involvement in this community. I emailed Scott the day after hearing from Michael.

Eric Boyd and I run the Chicago Cloud Computing Meetup Group, which meets once a month at the Microsoft office in downtown Chicago. We had already scheduled a June meeting, so we decided to hold a rare second meeting during the month. I reserved the Multipurpose rooms at the Microsoft office for Tuesday, created a registration page, and began promoting the event.\

Promotion proved to be a challenge because the event was not far off and because I was helping to organize two other events within a few days of this one: our group's regularly scheduled monthly meeting (June 18) and JuneteenthConf (June 19-20). Recognizing that oversaturating a message can yield poor results, I left some time between promoting each event. I promoted via the following channels: Social Media posts; word of mouth; emails, texts, and private messages; and internal Microsoft Teams channels. Some of those who heard from me spread the word to others. The strategy worked: over 80 people attended a meetup despite the short notice.

Money was another challenge. Because our user group meetings take place in the evening, we always supply dinner - typically pizza and salad. Food is the primary expense for our meetups, and Eric's company, ResponiveX, has been great about covering our food costs at most meetings. Not wanting to burden them with another large expense, we reached out to potential sponsors. Progress stepped up, agreeing to buy all food and drinks for the meeting. In exchange, we displayed Progress's logo prominently, thanked them multiple times during the meeting, and played a 5-minute video at the start of the meeting.

The Meeting

The meeting was excellent.

We began with Progress's video and a lightning talk from one of our members. We allow members to give a 10-minute presentation at the start of each meeting to gain experience in public speaking.

I introduced Scott by telling the audience, "They say you should never meet your heroes, but I have very real evidence that this is not true," before explaining that I was a fan of Scott Hanselman for years before we finally met. I learned what a genuine person he is and how much effort he puts into helping others.

The Aftermath

I attended Scott's keynote presentation the next morning, where he gave a talk similar to the one he delivered at my group. When it was over, he flew back to Portland - two more presentations in the books. He will soon be on the road for another conference, another keynote, and another audience. But this one will remain with me.  It is an example of how a talented speaker and a group of passionate individuals can quickly put together an event that  provides value to the community.


NOTE: Pete Rodriguez contributed to this content

Read the whole story
alvinashcraft
1 minute ago
reply
Pennsylvania, USA
Share this story
Delete

Command Line Basics for Beginners

1 Share

If you’ve ever watched a developer or DevOps engineer rapidly typing away into a blank, dark window filled with text, it might have looked like pure wizardry. That "blank window" is the command line and it is one of the most powerful tools in a programmer's toolkit.

To help you learn this important tool, we just released a complete Command Line Basics for Beginners course on the freeCodeCamp.org YouTube channel.

Learning the CLI allows you to:

  • Boost Your Efficiency: Perform complex file operations in seconds.

  • Unlock Advanced Tools: Many essential developer tools, cloud platforms, and data analysis packages only run via the command line.

  • Prepare for the Industry: Whether you want to go into software development, DevOps, or data science, command line proficiency is a non-negotiable skill.

By the end of this course, you will know how to set up and use the terminal locally on your own computer.

Here are some of the core commands and concepts you'll master:

  • Navigating the File Tree

  • Managing Files

  • Handling Directories

  • Reading and Writing Data

Watch the full course on the freeCodeCamp.org YouTube channel (1-hour watch).



Read the whole story
alvinashcraft
1 minute ago
reply
Pennsylvania, USA
Share this story
Delete

From Unplanned Risk to Lasting Resilience: The Role of Immediate Risk Reduction

1 Share

How Immediate Risk Reduction (IRR) brings teams together to tackle urgent risks quickly while strengthening the foundations for long-term resilience.

by: Ebony Love, Director, Immediate Risk Reduction

Quick Bytes

  • IRR focuses on resolving meaningful, unplanned security issues quickly, without slowing down the business
  • It’s a deliberately cross functional effort, bridging across McDonald’s to break down silos and drive coordinated action
  • By standardizing the way urgent risks are handled, IRR helps embed resilience directly into McDonald’s cybersecurity DNA

In a global, fast-moving organization like McDonald’s, unplanned risks aren’t an exception; they’re an expectation. As our technologies evolve, infrastructure modernizes, and platforms innovate, risks are continuously identified, ranging from foundational hygiene issues to more complex security challenges. These rarely arrive neatly scoped or conveniently timed.

When they do show up, even manageable ones can stall, escalate, or compete with day-to-day priorities if there isn’t a clear way to bring the right people together and address them.

The Immediate Risk Reduction (IRR) team exists to close that gap. These risks can take many forms; it could be a market escalation, an internal audit finding, simple hygiene tasks, or a software update that introduces an unexpected risk. Regardless, by providing a clear, repeatable way to respond to urgent risks, we make sure they’re addressed before they impact the business.

To put it simply: IRR has changed how McDonald’s handles unplanned risks, reducing exposure faster, limiting business impact, and making us better at cybersecurity over time.

The result is a quicker resolution today, and stronger resilience for whatever comes next.

Building a bridge across McDonald’s
IRR exists for one simple reason: real cybersecurity risks don’t fit neatly in a box, aligning only to one team or function. On paper, we’re part of Global Cyber Security, but in practice our team bridges across the entirety of McDonald’s.

When you think about any large organization, the biggest risks they face don’t come from a lack of expertise. Instead, they come from coordination breaking down, too many people being involved, or a lack of accountability — all inevitably leading to inertia.

When you don’t have a business function focused on this connection or momentum, issues will slow down — or fall through the gaps entirely. We stop that from happening by establishing clear accountability, consistent prioritization criteria, and time‑bound expectations.

Whether it’s supporting markets to resolve issues with the Cyber Market Engagement team, addressing findings from internal audits carried out by our Cyber Defense team, or supporting Global Technology Infrastructure & Operations as they modernize McDonald’s, IRR thrives in partnership. It’s what allows us to move quickly and reduce friction.

IRR brings together the right people at the right time, making sure they’re aligned on what matters, and what needs to be done. By acting as a bridge across teams, IRR removes the friction that so many organizations struggle with. Now, when an issue is identified, there’s clarity around who needs to engage, how communication flows, and what “done” looks like. That clarity allows teams to focus on remediation instead of navigation.

For any organization operating at scale, this kind of function isn’t a luxury, it’s a necessity.

Bringing the right team together
Cybersecurity is often perceived as highly technical work, happening behind the scenes and understood by specialists only. In reality, a lot of what makes IRR effective comes down to something much more human: our people.

Yes, technical understanding matters. But it’s equally important that we’re able to take complex, technical findings — whether they originate from cloud tooling, audit results, or our own cyber intelligence — and translate them into something that anyone can understand and act on. IRR focuses on making risk easily understandable and actionable, so partners know exactly what’s needed from them and why.

We don’t just focus on remediation; we also focus on relationships. When trust is already there, teams can move faster and work with confidence. After all, cybersecurity is a team sport.

McDonald’s Immediate Risk Reduction (IRR) team

Making communication work
One of the challenges IRR has faced in achieving this quick action is making communications stand out in an organization as large as McDonald’s. Many of our stakeholders receive hundreds of emails each day. So, how do you make sure your message is seen, heard, and actioned?

For us, the answer has been consistency and standardization. By structuring communications in a familiar way, teams learn what to look for and how to respond. This can be as simple as stating up front whether action is needed, or ensuring a deadline is front and center of a message.

Now, when something comes through with an IRR signal, there’s immediate clarity on the issue and the expected action. The impact of this has been noticeable on our business; teams are now spending less time clarifying expectations, and more time moving directly into action. In a complex environment that spans the globe, it’s this familiarity and quick action that saves time and reduces uncertainty.

Scaling without adding complexity
As a team, we’ve already made great strides in cementing IRR as an integral part of McDonald’s cybersecurity processes. Today, we support a significant number of issues across the business, but we’re not stopping there.

IRR isn’t about owning every security issue, or diving into critical incidents. Instead, we’re here to make things easier, more efficient. When the next unexpected risk crops up, which it inevitably will, teams shouldn’t have to guess who they need to speak to, or what the next step is.

As we continue to grow, our goal is simple: continue reducing friction, continue increasing consistency. Fewer “how do we handle this?” moments. By standardizing that process, teams will spend less time working out the process, and more time fixing the issue.

The payoff is real. Clearer expectations. Faster progress. And a lot less frustration when something unexpected lands. By pairing immediate remediation with durable process improvements, IRR strengthens McDonald’s security foundations and measurably improves our overall cybersecurity posture.

After all, IRR isn’t just about resolving today’s risks; it’s about ensuring teams are ready for the next one.


From Unplanned Risk to Lasting Resilience: The Role of Immediate Risk Reduction was originally published in McDonald’s Technical Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Read the whole story
alvinashcraft
1 minute ago
reply
Pennsylvania, USA
Share this story
Delete

Your AI Agents Are Stuck in Pilot. It’s a Data Problem, Not a Model Problem.

1 Share

The hard part of building production AI agents was never the model. It’s the data layer underneath. Today Couchbase is changing that. 

We’re excited to announce that the AI Data Plane is now generally available for self-managed Couchbase Enterprise deployments, extending beyond Capella for the first time. The Couchbase AI Data Plane is a high velocity unified data infrastructure layer for enterprise AI agents, giving them persistent agent memory, real-time context retrieval, and consistent data access from cloud to edge and into their lakehouse architectures. By collapsing the fragmented data services that have stalled agent deployments into a single, governed layer, enterprises can move from pilots to production-grade agents that resolve a customer’s issue without making them repeat themselves, reach live business data through one governed interface instead of a new integration per agent, and stop paying to resend the same context on every turn. Here’s why agents stall, and how a unified data layer gets them to production.

Why you need a unified data infrastructure layer

Every enterprise has built the same demo by now: a chatbot that answers questions, an assistant that drafts emails, an agent that looks genuinely capable in a controlled setting. The demo works. But then it goes to production, and it falls apart.

The agent forgets what a customer said five minutes ago. It can’t reach the operational data it needs without a custom integration written from scratch. Nobody can explain why it made a particular decision or which prompt version produced a bad answer. Costs climb as the same context gets resent on every turn. The impressive pilot becomes a project that never ships.

Models are rentable, interchangeable, and improving on their own. The real challenge is the data layer underneath: persistent memory, governed access to live enterprise data, traceability, prompt and tool management, and low-latency interaction with the systems that actually run the business. That foundation is what the Couchbase AI Data Plane provides.

Why the usual approaches fall short

Teams trying to get agents to production usually reach for a stack of specialized point products: a vector database for semantic search, key-value store for fast data access, relational database for complex SQL, a separate store for memory, an in-memory cache for low-latency reads, a feature store, a graph database for relationships between entities, and a search engine, all stitched together with custom integration code. Every common approach has a structural weakness:

  • Bolted-on memory stores sit apart from your operational data, so agents reason over stale or disconnected context and you have to maintain yet another system.
  • Ungoverned data access means every new agent needs custom development to reach enterprise data, with no standard interface, no access control, and no audit trail.
  • A fragmented point-product stack spreads memory, caching, vector search, tools, prompts, and traces across multiple vendors, multiplying cost, latency, and the integration tax on your best engineers.
  • A stitched-together stack caps your scale. Each point product scales on its own model and its own limits, so the system is only as scalable as its weakest link. As agent traffic grows, the seams between them become bottlenecks, and scaling up means scaling, tuning, and paying for every piece separately.

Each seam is a place where context breaks, latency compounds, and trust between operational data and AI insight is lost.

Couchbase AI Data Plane: one governed layer for production agents

The AI Data Plane unifies fragmented services into a single governed layer where operational data, context, and memory work together as one fabric across cloud, edge, and lakehouse architectures. It brings three essential components together on Couchbase’s JSON-native, scale-out, memory-first architecture:

  • Agent Memory. Persistent, reusable memory across sessions, restarts, users, and frameworks, in close proximity to operational data. Agents retain business context instead of starting from scratch every time.
  • MCP Server. Enterprise-supported, standardized agent access to Couchbase operational data, vectors, documents, and cache, so agents connect to your systems through a governed interface rather than bespoke integration code.
  • Agent Catalog. Manages tools, prompts, metadata, and end-to-end traces so teams can inspect, reuse, and govern agent behavior, and see exactly which tool an agent used and which prompt version shaped a response.

The principle is simple: the model is rentable, your data is strategic, and the AI Data Plane puts it to work. Your data and vectors run natively on one operational foundation.

What’s in this release

This release widens what agents can reach across your data, gives developers faster ways to build and operate on Couchbase, and extends the platform to the edge and mobile.

Reaching more of your data: An agent is only as good as the data it can reach. These features let agents reason over more of your data, in place, without waiting on ETL or copying it first. The more of your operational and analytical data an agent can see in real time, the more accurate and grounded its decisions, instead of reasoning over a stale or partial copy.

  • Apache Iceberg federation. Query Iceberg lakehouse tables in place from Enterprise Analytics 2.2, without the operational complexity of ETL or data duplication.
  • Trino adapter (coming in Q3). Run federated SQL queries from Trino-based engines, including AWS Athena, Amazon EMR, Google Dataproc, and Starburst, directly against live Couchbase data, with no extract or replication step.
  • iQ multi-model natural language query. Choose AWS Bedrock or OpenAI for Capella iQ, governed by org-level provider policies.

Building and operating: More agents mean more load and more upkeep. These features give developers a faster runtime and platform automation instead of manual setup. As agent fleets grow, the platform underneath has to scale and stay manageable without a linear increase in engineering toil, or the operational cost of agents outruns their value.

  • Rust SDK. A new server SDK for building high-performance applications on Couchbase, with async-native access to key-value, query, Full-Text Search, and vector indexing without the overhead of a garbage collector.
  • Expanded infrastructure-as-code support. Generate custom usage reports through the billing management API, with programmatic configuration of App Services and Eventing functions coming in Q3, so teams can manage Couchbase through automation rather than manual setup.
  • Azure XDCR over Private Link. Cross-data center replication over private connectivity, off the public internet.

Edge and mobile: Agents are only as useful as the data they can reach, and that data increasingly lives on devices and in disconnected environments. These updates keep that data synced and accessible at the edge, so it’s ready when agentic workloads extend there.

  • Bluetooth peer-to-peer sync. Couchbase Lite 4.1 syncs data over Bluetooth in fully disconnected, zero-network edge environments.
  • React Native 1.1. Enterprise Edition React Native support for high-performance cross-platform apps, on Couchbase Lite 4.1.
  • Sync Gateway. Rolling upgrades, faster large-dataset resync, and system metadata isolation.
  • Edge Server 1.1. Client-level access control, CORS, credential rotation, and Windows/ARM support.

One platform, deployed your way

The AI Data Plane is how AI runs on Couchbase data, spanning both deployment models. Couchbase Capella delivers it as a managed service, while Couchbase Enterprise delivers it as a self-managed solution. In either model, every agent gets the same memory, governed data access, context, and tooling on one foundation.

Agent Memory, MCP Server, and Agent Catalog are now available as self-managed services on Couchbase Enterprise, extending the AI Data Plane beyond Capella and bringing these capabilities to self-managed deployments for the first time. The AI Data Plane builds on Couchbase’s multi-model architecture: JSON documents, key-value, SQL++, full-text search, eventing, and vector search in a single distributed system.

Why Couchbase

Couchbase gives enterprises a single operational data foundation for production AI agents, enabling agents to remember, access data, use governed tools, explain decisions, and scale, without having to stitch together a fragile stack of point products. Several long-standing architectural choices are uniquely suited for agent workloads:

  • One data layer, not a stack. Agent Memory, MCP Server, Agent Catalog, and core Couchbase capabilities come together as a unified plane, with no additional data layers to manage.
  • Handles AI data variety. A native JSON document model fits varied, fast-changing data: profiles, sessions, memory records, cache entries, metadata, tools, traces, and agent state.
  • Fast enough for agentic workloads. A memory-first architecture delivers low-latency reads, writes, searches, and lookups, extending performance to repeated prompts.
  • Scales with agent growth. Scale-out architecture absorbs unpredictable demand as teams build more agents, without brittle scale-up patterns.
  • Always-on by design. Global HA, powered by a K-safety model and active-active cross data center replication (XDCR) to keep the data layer available and writable across regions, enables agents to support your customers, employees, operations, and revenue through node, datacenter, or region failure.
  • Consolidation that improves operations. One foundation for operational data, memory, caching, vector search, tools, prompts, and traces translates to lower TCO and fewer systems to run, while removing the cross-product seams that slow agents down with latency and stale context.

Why it matters now

The AI conversation has been dominated by models. But as models converge, the real bottleneck is shifting underneath them to the data layer: memory, governed retrieval, and the ability to act on live enterprise data with agentic speed and scale. The enterprises that win the agent era will be those whose data infrastructure can keep up, not those with marginally better models.

Couchbase has spent more than a decade building a fast, scalable, memory-first data platform as a core strategic strength, not a bolt-on afterthought. The AI Data Plane brings that foundation to agent workloads, powering demanding production environments today. The engineering time typically spent stitching together and maintaining a fragile AI stack can now go toward improving agents and creating competitive advantage.

Learn more

Visit the AI Data Plane page. 

For more details on today’s release, visit the Couchbase Product Release Announcement page

The post Your AI Agents Are Stuck in Pilot. It’s a Data Problem, Not a Model Problem. appeared first on The Couchbase Blog.

Read the whole story
alvinashcraft
1 minute ago
reply
Pennsylvania, USA
Share this story
Delete
Next Page of Stories