The Leadership Dozen: Reading Notes

Status: seven books finished, five in progress. Full notes on the remaining five will follow as each one is finished.

Ten lessons from seven books

1. Trust is a decision to accept exposure. It is not evidence that the exposure has gone away. Every failure on this shelf began with someone trusting a name in place of looking at the thing itself.
2. Whoever controls the root controls the system, whatever the org chart says.
3. Speed moves judgment upstream. When decisions outrun review, the only real human input is the guardrail written before the clock started.
4. A score is only as honest as the person who set the weights. If an instrument has never embarrassed its sponsor, it is measuring loyalty.
5. A dependency is a strategic choice even when nobody remembers making it.
6. An exception without an expiry date becomes a policy without an author.
7. The rewards concentrate and the costs disperse. That is why these schemes run for years, and why the early signal, not the courtroom, is the real protection.
8. Institutions change through process and people, not through ideas.
9. The only honest test is the one that can disappoint you. Everything else is theater.
10. Character is what you do with power when the easier path pays. It is not shown by staying away from power.

The rest of these notes is where those lines come from.

The comfort of a green dashboard

There is a particular comfort in a green dashboard. The boxes line up. The numbers sit in range. Someone has done the work of turning a messy world into a surface a busy leader can read in thirty seconds. Sometimes that work is excellent. Sometimes the dashboard is the best organized part of a system nobody has looked at closely.

In September I published The Leadership Dozen, twelve books chosen on a simple idea. If artificial intelligence is moving from answering questions to taking actions, leaders need a more demanding reading diet than another stack of books about AI. Only one of the twelve is about AI on its face. The rest are about deception, war, finance, concentrated power, engineering and institutional change. Seven are now finished. Five are on the nightstand, and I am keeping that line honest. The finished books have earned interpretation. The unfinished ones have earned only the topic they were chosen for.

One theme emerged, and it was not the one I expected. The worst institutional failures in these histories rarely began with no information. Almost always, someone had the information and it did not fit the story. An engineer had a damaged seal. A bank had an oddly structured payment. An analyst saw a model fail in the field. The organization also had a procedure, a credential or a reassuring report, and the contest between the uncomfortable fact and the comfortable account was rarely fair.

The deeper story is about people. Deception, ambition and collusion can produce extraordinary private rewards while the people who insist on the truth are overruled. Sometimes there is a conspiracy. More often it is ordinary people protecting careers, contracts or access. The costs seldom stop with the decision-makers. Employees absorb retaliation. Investors and taxpayers absorb losses. Communities inherit weakened services and lost trust. Power has an ugly accounting trick. It keeps the rewards close and sends the bill to people who never approved the transaction.

Justice, when it comes, comes late and diluted. A decade can pass between the first warning and the first verdict, and by then the money is spent and the public has moved on. That is why these notes are about prevention. The courts are the backstop. The early signal is the front line, and the early signal is a skill anyone can learn.

The subjects of these books are not morally interchangeable. A law enforcement sting is not fraud. The stakes of military targeting dwarf those of a corporate scoring tool. The comparisons that follow are structural, not moral. They are about how authority, evidence and judgment behave once a system becomes powerful enough to escape close inspection. My working rule is simple. Ask for the artifact before accepting the attestation, then ask two questions an audit can miss: who benefited, and who paid? That is the argument of Evidence Over Attestation, and this shelf is the reading behind it.

The reading list at a glance

Seven books that changed the questions

Dark Wire, by Joseph Cox

The most effective back door was the front door of trust.

The surprise in Dark Wire is not that law enforcement read encrypted criminal messages. It is that criminals helped distribute the system that betrayed them. The FBI and the Australian Federal Police quietly ran ANOM, an encrypted phone brand that spread through trusted underworld resellers. It had everything buyers expected: handsets, updates, support and an air of security. But the operator controlled the system, and by the June 2021 takedown authorities had collected more than 27 million messages.

The technology did not need to beat cryptography. It needed users to believe the people controlling the endpoint were on their side. Buyers checked the social standing of the seller far more carefully than the technical power of the operator. That is an uncomfortable mirror for enterprise procurement, where we ask who else uses a service and which analysts endorse it, and rarely ask who can change the code underneath us, who holds the keys, and what the operator can see.

Once the sting worked, it also produced more urgent threats than the agencies could act on. Collecting evidence creates a duty to respond, and AI monitoring is arriving at the same problem.

ANOM was a lawful operation and its deception is not fraud for private gain. What it shows is how dangerous social trust becomes when an insider’s endorsement is mistaken for independent assurance. Trust is a decision to accept exposure. It is not evidence that the exposure has gone away.

The question it leaves me: which product in my stack would still be trustworthy if its operator became untrustworthy tomorrow?

Project Maven, by Katrina Manson

A human checkpoint is real only if the human can still change the outcome.

Maven began with a practical problem. Analysts were receiving far more drone video than they could watch, and computer vision promised to sort it. Manson follows the program from its 2017 start through its internal battles, its field deployment and its growth into a broad system of AI-enabled analysis, shaped by a driven Marine colonel, imperfect data, operational pressure and public controversy.

The consequential detail is not that AI made an analyst faster. It is that speed changes the task. When a model turns hours of watching into minutes of recommendations, the human at the end appears to keep authority. But a person facing an accelerating queue, with limited context and a presumption that the machine has already screened the cases, is in a different position from a person with time to think. A target detected is not a target lawfully identified. The useful measure is not how many approvals appear in a log. It is whether humans can catch and stop the mistakes the automation actually makes.

Running a system in shadow mode, alongside operations rather than inside them, is how it learns the limits of its competence before other people pay for the lesson. And the Google employee revolt belongs in the architecture story: the intended use of a technology decides whether the people able to build it will stay.

Automation can accelerate an answer without accelerating anyone’s ability to judge it. When those two speeds diverge, a human in the loop becomes a human in the paperwork.

The question it leaves me: if an agent acts a hundred times faster tomorrow, which permissions must be narrowed today so that a meaningful refusal remains possible?

The Mastermind, by Evan Ratliff

The one person who sees the whole system is both its sovereign and its weakness.

Paul Le Roux understood what good software architects understand. A distributed organization becomes enormously productive when specialized people perform narrow tasks under a common orchestrator. Ratliff follows a gifted programmer whose encrypted communications and remote operations knit together a sprawling criminal enterprise. Participants understood only their own assignment. Le Roux understood the machine.

That asymmetry gave him reach, secrecy and leverage, and it created a severe fragility. The whole system depended on one person’s private map. When law enforcement captured him and secured his cooperation, the concentration of knowledge that had protected the enterprise brought it down. This architecture organized wrongdoing, and its efficiency multiplied the harm to victims while shielding the people giving orders. Sophisticated coordination without conscience is a force multiplier for harm.

The lesson is that architecture allocates power long before any governance chart catches up. A system can look decentralized at the edges and be absolute at the center. Agent-driven organizations will meet a gentler version of this when one founder or engineer is the only person who understands the prompt chains, the credentials and the overrides. The answer is not to give everyone every secret. It is to make authority legible: durable agent identities, explicit permissions, action records, and a tested way to recover without asking one person to narrate what happened. If we cannot say who controls the root of a system, we cannot honestly say who governs it.

The question it leaves me: could a capable successor reconstruct our most important automated workflows tomorrow without asking their creator to explain them?

Chokepoints, by Edward Fishman

A dependency is a strategic choice even when nobody remembers making it.

Fishman, who helped design sanctions at the State Department and the Pentagon, shows how global integration created narrow passages through which extraordinary power can be exerted: dollar finance, payment messaging, advanced semiconductor equipment. The power comes less from size than from the inability of others to route around a node quickly.

The book’s value for technology leaders is its attention to the second move. The first use of a chokepoint can be devastating. It also teaches the target to build an exit, so leverage has a half-life whenever the people who feel it can invest in escaping it. The commercial parallel is immediate. A company can claim a multi-vendor strategy while every vendor depends on the same identity provider, chip supply or model API. Diversity on the invoice can hide concentration two layers down.

A chokepoint is a dependency you discover at the moment someone else changes the terms. Good governance discovers it earlier, and a contingency plan is a tested failover, not a second logo on a slide. This book is also the foundation for The Chokepoint Thesis, the research I built after reading it.

The question it leaves me: which supposedly redundant service in our business would fail with the same upstream provider, and when did we last rehearse the exit?

The Fund, by Rob Copeland

Every score has an author, even when the interface hides the signature.

Ray Dalio built an extraordinary investment firm and promoted a philosophy of radical truth and written principles. Copeland examines what those ideals could feel like inside Bridgewater, where meetings were recorded, colleagues rated one another, and quantified traits shaped judgments about credibility. His account is sharply critical. Dalio and Bridgewater have disputed substantial parts of it, and their response deserves to be read alongside the book.

The governance question does not require settling every contested episode. Picture any organization that scores colleagues, ranks whose judgment counts, and treats the resulting dashboard as more objective than ordinary disagreement. Who chose the weights? Who hears an appeal? Can the system produce a conclusion that the person who commissioned it must accept? Once judgment acquires numbers, people stop seeing the judgment inside it. A score of 94 feels more scientific than a written disagreement, even when the formula is a compressed record of preferences and power.

I think about this every time I review an AI evaluation harness or an executive dashboard. A leader can build a machine that agrees with him at scale and mistake consistency for independence. If a metric cannot embarrass its sponsor, it is probably measuring obedience as much as performance. That line is my inference, not a quotation from either side, but it is the test I take from their dispute.

The question it leaves me: have we written down, in advance, what number on our dashboard would mean our strategy is failing, and is there someone besides the strategy’s sponsor who is allowed to act on it?

Unit X, by Raj M. Shah and Christopher Kirchhoff

The rules for buying technology quietly decide which future an institution is allowed to build.

Two insiders describe the effort to connect the Pentagon’s procurement machinery with the faster cycles of commercial technology. The Defense Innovation Unit did not begin by inventing a new drone. It began by changing the path through which a government customer could state a problem, find a supplier, sign an agreement and field something useful.

That sounds less glamorous than the products. It is often more consequential. A procurement process built around multiyear specifications will exclude smaller companies that iterate software in months, so the procedure has already chosen which firms can participate. Process becomes policy by deciding the possible outcomes before anyone evaluates a prototype. Shah and Kirchhoff write from inside the reform, so the book carries both valuable detail and the view of people defending a project they built. Read beside Project Maven, it shows that innovation needs urgency and champions, and also real users, repeatable authority, budgets and evidence that the fielded system works.

This book is a counterweight to the darker shelf. Not every use of influence is corrupt. People can use access and determination to remove waste and serve a public purpose. One caution belongs here. Faster acquisition is a clear good when the capability is defensive. The same speed lowers the threshold for capabilities whose use is far more debatable, and a reform that accelerates the process has to ask what the process is accelerating. The bureaucracy you cut determines the errors you stop catching.

The question it leaves me: are we helping a customer clear a real institutional obstacle, or demonstrating technology on the wrong side of it?

Regime Change, by Maggie Haberman and Jonathan Swan

An exception without a record becomes a precedent without an author.

Haberman and Swan report on the first year of Donald Trump’s second presidency and the people, loyalties and structures around it. The book rests on extensive access reporting and its interpretation is politically disputed. Readers should weigh the accounts, the incentives of the participants and the responses of those criticized. The constitutional stakes are real and specific, not a management parable. What interests me for this project is one pattern inside those stakes: what happens when decision authority concentrates and procedural friction is treated as an obstacle to sweep aside.

Formal processes are carried out by particular people who decide whether to ask the second question, record a dissent or refuse a requested act. When decisions move from documented channels into private conversations, the institution gains speed and loses the ability to establish later what was authorized and why. Institutions need room to act in emergencies. They also need to know when the emergency ends. A permanent exception is a new rule without the honesty of an open rulemaking, and the same pattern appears in technical governance when a team widens an agent’s privileges temporarily or waives a deployment test because a deadline is near.

The decisive measure of accountability, in this book as in The Fund and The Mastermind, is the fate of an inconvenient objection. A system that allows dissent only when the powerful agree with it has not distributed judgment. It has staged consultation.

The question it leaves me: when authority overrides a safeguard, can a later reviewer find the request, the reason, the objections, the decision and its expiration date?

Still on the nightstand

Five books are in progress. I will not summarize a book I have not finished or draw lessons from chapters I have not reached. It is too easy to become so taken with a thesis that every new chapter appears to prove it, which is the error this shelf warns against. Here is only the question each one was chosen for, as stated in the September note.

Billion Dollar Whale, by Tom Wright and Bradley Hope. Institutional verification failing at global scale.

Challenger, by Adam Higginbotham. Evidence, normalization and institutional pressure.

Nuclear War: A Scenario, by Annie Jacobsen. A stress test of concentrated authority and automated logic under compressed time, read as a scenario rather than a forecast.

When the Heavens Went on Sale, by Ashlee Vance. Iteration against capital-intensive incumbents, where the physical test renders the verdict.

Biological War: A Scenario, by Annie Jacobsen. The same method applied to a threat that spreads instead of strikes.

The arguments these books have with one another

Reading seven books as seven summaries would miss the best part. They disagree across subject, era and moral position, and the friction teaches more than any list of principles.

The profit in dishonesty. If deception pays reliably and candor is punished, dishonesty stops being an individual defect and becomes a behavior the institution is training people to repeat. A code of ethics is weak when the rewards point the other way. The surest evidence of institutional character is what gets rewarded when the transaction is profitable and the truth is costly.

The cost that never reaches the ledger. The gain is visible and the loss is dispersed. A taxpayer never sees the chain from a favored deal to a weakened service. The employee who objected lost the opportunity long before the scandal broke. The wrongdoer gets a transaction. Everyone else gets a consequence.

Borrowed certainty. ANOM traveled through trusted distributors. Bridgewater’s disputed scoring raises the question of whether numbers can lend authority beyond what the observations deserve. More validators can mean less validation when each one assumes the others have already checked. Somebody must own the artifact rather than the handoff.

The missing time. Maven asks what oversight means at machine speed. Unit X asks how to remove delays that add nothing. The distinction is between dead time, waiting caused by an avoidable handoff or a queue nobody owns, and thinking time, when an expert notices an assumption or declines a harmful action. An efficient institution knows which is which. A reckless one measures both as latency and congratulates itself for removing them.

The unappealable score. Every dashboard has a theory built into its design. What was measured? What did the aggregation discard? Which failure would force an honest revision? A score with no path to correction is a verdict disguised as an instrument.

The hidden sovereign. The Mastermind shows the operator with complete knowledge. Chokepoints shows the gatekeeper everyone must pass. Regime Change shows procedure under concentrated authority. Having visibility, holding technical control and holding legitimate authority are three different things, and the most powerful party in an organization may be whoever holds the credentials, sets the weights or approves the exceptions.

The early signals

Prevention is a skill, and it comes down to recognizing a pattern while it is still small. Each tension above has an early form that shows up in an ordinary week, long before anyone would call it a scandal. Here is what each looks like at that stage, the question that exposes it, and the book where it grew to scale.

1. A name is doing the work of a check. It sounds like “they use it too.” Ask: who looked at the artifact itself, and what did they see? Dark Wire.
2. One person or service can see the whole system and nobody else can. It sounds like “ask him, he set it up.” Ask: if that person were gone tomorrow, who could reconstruct this? The Mastermind.
3. A score has never once embarrassed the person who commissioned it. It sounds like “the dashboard has been green all quarter.” Ask: what number would have to appear here for us to change course, and has anyone written that number down? The Fund.
4. An exception has no expiry date and no author. It sounds like “we turned that check off during the launch.” Ask: who approved it, what was the objection, and when does it end? Regime Change.
5. Speed is being measured, but nobody can say which minutes were thinking time. It sounds like “we cut review from a week to a day.” Ask: which delay added knowledge, and which was waste? Project Maven and Unit X.
6. A supposedly redundant service shares an upstream. It sounds like “we have two vendors for that.” Ask: do both depend on the same gate two layers down, and when did we last rehearse the exit? Chokepoints.

None of these proves anything on its own. Each is a reason to ask one more question while the question is still cheap. That is the whole skill.

The evidence test I now take into a meeting

I would rather leave a meeting with a handful of hard artifacts than a binder of confident assurances. The NIST AI Risk Management Framework’s four functions, govern, map, measure and manage, give the structure. The table makes it concrete for systems that can act.

None of these artifacts proves a system permanently safe. They make its claims contestable and its behavior reconstructible. Documentation alone does not produce integrity, since an institution can keep perfect records of misconduct and still reward the person responsible, so I add three questions to every review. Who stands to profit if we accept this assurance? Who absorbs the harm if it is false? Is the person with the most to gain also controlling the evidence used to approve the decision?

One principle joins all eight tests. The evidence must keep the ability to disappoint the person who asked for it. Without that, measurement is theater.

The unfinished lesson

A good dashboard lets people see what would otherwise be lost in noise. I am not arguing against that. I am arguing for the demanding relationship it must keep with reality.

At the end of a long meeting, a leader wants a coherent story. The most valuable thing anyone can bring into that room is the piece of evidence that makes the story less coherent: a failed field test, an unexamined root credential, a payment with no purpose, a warning repeated so often it has become wallpaper. Such evidence may embarrass the sponsor and delay the launch. That is an expensive kind of honesty. It is also the only kind that compounds.

An organization reveals its real culture at the moment the uncomfortable artifact arrives. Do its leaders ask to see it? Does the person who found it get a fair hearing? Does the record survive the meeting? Does the next decision change? A printed value statement cannot answer those questions. The room will.

Seven books have strengthened my belief that a trustworthy system needs a written boundary around authority, testing against real conditions, a record that survives its creators, and a way to correct the people in charge. The other five may challenge that framework. I hope they do. Reading ought to make a thesis more exact, not merely more certain.

The ten lessons, once more

Trust is a decision to accept exposure. Whoever controls the root controls the system. Speed moves judgment upstream. A score is only as honest as the person who set the weights. A dependency is a strategic choice even when nobody remembers making it. An exception without an expiry date becomes a policy without an author. The rewards concentrate and the costs disperse. Institutions change through process and people. The only honest test is the one that can disappoint you. Character is what you do with power when the easier path pays.

The question I carry into every board discussion and every AI deployment is this one. If the system were wrong in a consequential way, how would we know, who could say so, who would profit from silence, and who would pay the price? The answer is not on the dashboard. It is in the evidence the institution is willing to let speak. If you have read any of the twelve, I would like to know which one you would hand a board first.

Books and verification notes

The lines in bold are my own interpretations unless attributed. The seven finished-book sections describe my readings of the works, not an adjudication of every contested account. The five in-progress entries state only the question each book was chosen for.

1. Cox, Joseph. Dark Wire: The Incredible True Story of the Largest Sting Operation Ever. PublicAffairs, 2024. Operation Trojan Shield facts checked against the US Department of Justice announcement of June 8, 2021.
2. Manson, Katrina. Project Maven: A Marine Colonel, His Team, and the Dawn of AI Warfare. W. W. Norton, 2026. NPR interview with the author, March 2026.
3. Ratliff, Evan. The Mastermind. Random House, 2019.
4. Fishman, Edward. Chokepoints: American Power in the Age of Economic Warfare. Portfolio, 2025.
5. Copeland, Rob. The Fund: Ray Dalio, Bridgewater Associates, and the Unraveling of a Wall Street Legend. St. Martin’s Press, 2023, read alongside Bridgewater’s November 2023 public response.
6. Shah, Raj M., and Christopher Kirchhoff. Unit X: How the Pentagon and Silicon Valley Are Transforming the Future of War. Scribner, 2024.
7. Haberman, Maggie, and Jonathan Swan. Regime Change: Inside the Imperial Presidency of Donald Trump. Simon & Schuster, 2026.
8. Wright, Tom, and Bradley Hope. Billion Dollar Whale. Hachette Books, 2018. In progress.
9. Higginbotham, Adam. Challenger: A True Story of Heroism and Disaster on the Edge of Space. Avid Reader Press, 2024. In progress.
10. Jacobsen, Annie. Nuclear War: A Scenario. Dutton, 2024. In progress.
11. Vance, Ashlee. When the Heavens Went on Sale. Ecco, 2023. In progress.
12. Jacobsen, Annie. Biological War: A Scenario. Dutton, 2026. In progress.
13. National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework (AI RMF 1.0). US Department of Commerce, 2023.

Related: The Leadership Dozen: Twelve Books for the Intelligence Era, Evidence Over Attestation, Part One and the twenty-one-point standard.