I Broke the Site. Then I Made My AI Agent Write a COE.

Posted: May 29, 2026 | Author: | Filed under: Personal, smallbizai.au | Tags: , , , , , | Leave a comment

The blog went down for two and a half hours on a Friday afternoon in May. Not a graceful failure. A full 500 error. Every page.

My AI agent, Claw, had added a PHP code snippet to clear a cache. The snippet called a non-static method statically. PHP threw a fatal error. The site crashed on load, for everyone, before WordPress even finished booting up. I was out. Claw tried to fix it remotely. The gateway IP was blocked by the firewall plugin. The cPanel UI on mobile was unusable. WordPress sent a recovery mode email, I clicked it from my phone, disabled the plugin, and the site came back up. Two and a half hours gone.

When something breaks, the instinct is to fix it and move on. Patch the file, flip the switch, pretend it didn’t happen. That’s what most people do.

I did something different. I made Claw write a COE.

If you haven’t worked in enterprise tech, you might not know the term. COE stands for Correction of Errors. Amazon runs them after outages. Google calls theirs postmortems. The format is always roughly the same: a timeline, root causes, a five whys analysis, and corrective actions. The point isn’t to assign blame. The point is to not do the same thing twice.

I run one now too. With an AI writing it about its own mistake. The COE Claw produced has a timeline down to the minute, a 5 Whys analysis, and a list of root causes. It also has a line that I did not prompt:

“Claw wrote this rule. Claw then violated it two days later.”

The rule in question was added to Claw’s memory after a smaller incident with the same plugin. Two days later, Claw broke it anyway. And then it wrote a document saying exactly that, without softening it. That kind of accountability is worth something. The root cause breakdown is honest. The immediate cause was the bad PHP call. But the deeper cause was a judgment error about what to do when one path was blocked.

The right fix was Rank Math Redirections. Add a redirect rule in the admin UI. Thirty seconds. Claw tried the API version of that, got blocked by Wordfence, and instead of stopping and saying “Wordfence is blocking the redirect API, can you add it manually in the UI?” it went looking for another route. Found Code Snippets. Made things progressively worse. One message. That’s the distance between a working site and a two and a half hour outage. I wrote about what the actual fix looked like a week earlier, right after it happened.

The COE doesn’t just say the snippet was bad. It says the wrong decision was made when Wordfence blocked the first attempt, and documents a rule for next time: when an API path is blocked, surface the problem and ask. Don’t go looking for a workaround that touches production. That’s a process change. Not a blame note. An actual change to how things get done.

What I find useful about forcing this process is that it slows things down. Fixing and moving on is fast. Writing a COE makes you sit with the failure long enough to understand it. What actually went wrong. What you assumed that turned out to be false. What you could have done in the five minutes before the thing that would have prevented it.

Most AI workflows right now optimise for speed and output. More posts, more code, more content, faster. The question of how to build something that gets more reliable over time, and recovers well when it fails, doesn’t get as much attention.

I’m interested in that part.

The site is back. The rule is enforced. Next time Claw touches a code snippet, it runs through a checklist. If the checklist says no, the snippet doesn’t run.

That’s the point of the exercise. Not the document. The behaviour that comes after it.

What AI Actually Can’t Do

Posted: May 26, 2026 | Author: | Filed under: Personal, smallbizai.au | Tags: , , , , , | Leave a comment

Over the past few weeks, I’ve written a lot about what Claw🦞 (my Openclaw agent) can do. The daily crons. The memory system. The dashboard that updates while I sleep. The 790+ posts that largely run themselves.

Time to be honest about the other side.

It doesn’t know what not to do

Ask Claw🦞 to write a comparison post, and it will write a good one. Ask it to research a company, it’ll do thorough research. Give it a brief and it’ll execute.

But it won’t tell you the brief was wrong.

Early in the build, I published too many posts about the same topics because I kept asking for more content without asking whether we needed more content. Claw🦞 didn’t push back. Why would it? It was doing what I asked.

The judgment about whether to do something, that’s still mine. AI is very good at execution. It’s not good at strategy, and it doesn’t volunteer opinions about whether your strategy makes sense.

It can’t read context that wasn’t written down

A few weeks ago, a former colleague mentioned over coffee that he was considering an acquisition. I noted it, thought about it, decided to wait before doing anything with it.

Claw🦞 didn’t know about that conversation. It couldn’t. It wasn’t there. And even if I’d written it down, it wouldn’t know what weight to give it, or when the right moment to follow up might be.

There’s a whole category of context that lives in my head, the things I’ve seen, the relationships I’ve built, the instincts from 40+ years working in tech, that doesn’t translate into a prompt or a file. Claw🦞 works with what I give it. The stuff I haven’t written down doesn’t exist for it.

It doesn’t know when something feels off

Last month, Claw🦞 produced a post that was technically correct but somehow wrong. The sources checked out. The logic was sound. The format was right.

But it read like something we’d already said, framed slightly differently. It lacked the original angle that makes content worth reading.

I caught it before it published. Claw🦞wouldn’t have.

There’s a kind of editorial judgment, does this add something, or does it just fill space, that I haven’t managed to fully systematise. I can give Claw🦞rules and checklists and avoid-AI-writing audits. What I haven’t cracked is: is this actually good? That’s still mine to call.

It has no skin in the game

I care about this site. I built it on a career break, with my own money, on my own time. When a post is wrong, it reflects on me. When something gets cited by Bing AI, I feel it.

Claw🦞doesn’t. It executes tasks with the same energy regardless of stakes.

That’s mostly fine. But it means I can’t delegate the things where caring matters. The Sunday Specials need genuine argument. The origin posts need honesty. The newsletter needs a real voice. These aren’t tasks, they’re acts of communication. Claw🦞can help structure them. It can’t own them.

It can’t build the relationships

The site now gets occasional messages from startup founders who saw their company profile and wanted to connect. A former AWS colleague is referring people to the site. Someone in the US reached out about the Bing citations data.

None of that came from Claw🦞. It came from me being visible on LinkedIn, at coffee, in old networks.

AI can help you produce the content that earns attention. It can’t follow up on an email in a way that builds real trust. It doesn’t know the person behind the message. It hasn’t worked with them for a decade.

When to automate, when not to

Automate: anything that follows a consistent process, runs on a schedule, has clear inputs and outputs, and doesn’t require judgment about whether it should happen.

Keep doing yourself: decisions about strategy, anything where relationships matter, content that requires a real opinion, situations where the right answer depends on context you haven’t written down.

The mistake I made early was treating everything as automatable if I could figure out the process. Some things have a process but still need a person. The judgment about whether to run the process is often the most important part.

The honest version

I started this series partly to prove something. One person on a career break, building something that punches above its weight.

The proof worked. But the honest version is: I’m not really one person. I’m one person with a system. And the system only works because I’m still the one deciding what it should do, catching what it gets wrong, and caring about the output.

AI didn’t replace judgment. It just removed the friction between judgment and execution.

That’s still a lot. But it’s not magic.

The Day I Took the Site Down

Posted: May 20, 2026 | Author: | Filed under: Geek, Personal, smallbizai.au | Tags: , , , , , , , , | Leave a comment

Friday 15 May. Mid-morning. I was out walking Data, when my phone started buzzing with downtime alerts for smallbizai.au.

The site was returning 500 errors. All of it. Every page.

I’d done this to myself. Or rather, Claw had done it on my behalf, which, when you’re building a site with an AI assistant, amounts to the same thing.

How it happened

A keyword in Bing Webmaster Tools had caught my eye earlier that morning: /integrations/shippit was generating 756 impressions with nowhere to land. The URL was redirecting to the homepage. Wasted traffic, wasted clicks, wasted ranking signal.

The fix should have been simple. Add a 301 redirect in Rank Math Redirections and move on.

The first problem: Wordfence. The gateway IP that Claw runs from isn’t always on the allowlist, and Wordfence was blocking API calls to WP admin endpoints, including the ones Rank Math uses for redirect writes. Legitimate request, refused at the door.

So Claw went around it via Code Snippets. Got a couple of redirects working that way. Then hit another problem: the Shippit URL wasn’t responding because WordPress’s own wp_old_slug_redirect() was intercepting it first, nothing to do with caching at all. Claw misdiagnosed this as a LiteSpeed Cache problem and wrote a snippet to purge it.

That snippet called LiteSpeed\Purge::purge_url() as a static method.

It is not a static method.

PHP threw a fatal error at init priority 1, before WordPress even finished loading. Every page request crashed. The site went to 500 at 11:50am.

The irony

Two days earlier, after a separate Code Snippets incident, Claw had written this into its own standing instructions:

Never use do_action('litespeed_purge_all') in a Code Snippet, it causes a fatal 500 and takes the site down instantly.

Claw wrote the rule. Then violated it 48 hours later with a variation of the same pattern.

I’ve been in software long enough to know this isn’t unique to AI. Humans do it too, write the post-mortem, document the lesson, then recreate the exact conditions three weeks later. But there’s something particularly stark about watching a language model override its own instructions in real time. The rule was right there in memory. It didn’t matter.

The recovery

The next 2.5 hours were not fun.

Deactivating Code Snippets via the API didn’t work. The site was already 500, so most calls weren’t registering. Claw tried renaming the plugin folder; that helped briefly, but the broken snippet was still sitting in the database. The moment the folder came back, the crash came back with it. cPanel’s phpMyAdmin was unusable on mobile. Wordfence was blocking admin endpoints from the gateway IP.

What actually worked: WordPress’s recovery mode email.

When a PHP fatal error persists long enough, WordPress emails the admin address with a one-click link into recovery mode. You click it, you get into WP Admin, you deactivate the offending plugin. No SSH. No cPanel. No command line.

That’s the hero of this story. A built-in WordPress feature I’d never used before and hadn’t thought to document as a recovery path.

The actual fix

Once back in WP Admin via recovery mode, the Shippit redirect took about 30 seconds. Rank Math Redirections, add rule, done. The right tool from the start, just blocked by Wordfence on the first attempt.

That’s the part that stings. The correct path was: Rank Math Redirections UI. Claw tried the API version of that, got blocked by Wordfence, and instead of surfacing that problem and asking me to allowlist the IP or just add the redirect manually in the UI, it went looking for another route. Found Code Snippets. Made things progressively worse.

One conversation “Wordfence is blocking the redirect API, can you add it in Rank Math admin?” and none of this happens.

The WP stack as a system

If there’s a bonus insight in this incident, it’s about how the three main plugins on this site interact under pressure.

Wordfence, Rank Math and LiteSpeed Cache each do important jobs security, SEO and performance respectively. They’re all genuinely good tools. But they also form a triangle of competing concerns. Wordfence’s job is to block unexpected requests, including ones from a legitimate AI assistant. Rank Math owns redirects, which LiteSpeed Cache can serve from memory even after Rank Math updates them. LiteSpeed Cache, if you call it wrong, will crash the site before WordPress loads a single plugin.

Understanding which layer owns which problem matters. Redirects are a Rank Math problem. Cache is a LiteSpeed problem. Security rules are a Wordfence problem. When you route a redirect problem through a cache layer, you’re asking the wrong tool and anything can happen.

What I’ve taken from this

I’m not writing this to bag on AI-assisted development. Most sessions building smallbizai.au have been productive. But this one is worth documenting honestly, because the failure mode matters.

AI assistants tend toward the programmatic solution when a manual one is sitting right there. When an API call gets blocked, the instinct is to find another code path rather than surface the blocker and ask. That’s the wrong call on a production site.

That’s on me too. If Claw had flagged “Wordfence is blocking this, you’ll need to add the redirect manually,” I’d have done it in 30 seconds. I was available. It just didn’t ask.

Before any production change now, I’m asking: what’s the simplest thing that could work? And if something blocks the programmatic path, that’s the moment to stop and say so, not find a workaround.

Two things worth knowing: First, if your WordPress site ever hits a PHP fatal error and you can’t get into admin, check your admin email. WordPress will have sent you a recovery mode link. It works from a phone. Document it before you need it. Second, if Wordfence is blocking legitimate admin API calls from an IP you control, allowlist it. Wordfence → Firewall → Allowlisted IPs. Takes 30 seconds and saves a lot of grief.

The damage

Site was down 2.5 hours on a Friday afternoon. GA4 tracking paused. Newsletter signup forms offline. Gumroad webhook missed (no purchases in that window, fortunately). The homepage mascot widget went dark.

Everything’s back. The full post-mortem is filed. The rule is back in the instructions with more emphasis this time.

On to the next build.

The First Sale — AU$9 and What It Meant

Posted: May 4, 2026 | Author: | Filed under: smallbizai.au | Tags: , , , , | Leave a comment

On a Sunday in April, my phone buzzed with a Gumroad notification.

Someone had bought the AI Prompts for Professional Services pack. Nine Australian dollars.

I’d spent a few weeks building SmallBizAI.au. At that point it had around 650 posts, 40-odd newsletter subscribers, and had cost me a few hundred dollars in API credits and hosting. I wasn’t doing this for money — I’m on a career break. But this was different.

Someone found the site, read enough to trust it, pulled out their card, and paid nine dollars for something I made.

That’s not revenue. That’s proof.

Here’s what I’d built: a prompt pack for accountants, lawyers, and consultants. Fifty copy-paste prompts covering client intake, proposal writing, meeting prep, and client updates — the tasks that eat billable hours. Priced at AU$9. Low enough that a sole trader wouldn’t think twice. High enough to filter for people who’d actually use it.

The buyer is in professional services. They found the pack on a Sunday and bought it. I don’t know whether the prompts saved them any time. But they chose to pay for something on a site that had been giving everything away for free.

That matters.

I’ve spent most of my career in technology, forty years across Microsoft, Telstra and AWS, building things where success is measured in millions of users and billions in revenue. The metrics were always big.

AU$9 is not a big metric.

Career breaks reset your sense of scale in useful ways. Nine dollars from a stranger on the internet, for something you built with your own hands, in a domain you care about — that hits differently. It’s not a Series A. It’s not an enterprise contract. It’s cleaner than both.

It means the thing works.

SmallBizAI.au exists because Australian small businesses are being underserved by generic AI content. Most of what’s out there is written for US audiences, priced in USD, and assumes tools that don’t work here. Fair Work isn’t a thing in Kansas. GST isn’t VAT. Xero is everywhere in Australia and barely mentioned in American AI guides.

The site covers the Australian angle specifically: local pricing, local tools, local compliance. Whether AI can actually help a café owner in Fitzroy or a bookkeeper in Fremantle. Not theory — specific, practical, AU-focused.

Hundreds of posts. One sale.

The ratio sounds bad. It isn’t. Search traffic takes months. Newsletter lists grow slowly. That first sale didn’t come from a viral post or a paid campaign. It came from someone searching for exactly what I’d built, finding it, and buying it.

That’s how it’s supposed to work.

There are now six products in the Gumroad store. Prompt packs at AU$9 each — for tradies, hospitality, allied health, professional services. An AI Tools Comparison Guide for AU$15. A 200-prompt pack for AU$19.

None of this replaces a salary. That’s not the point. The point is building something that earns trust through useful content and eventually converts that trust into revenue. Slowly. Deliberately.

Someone started that. At AU$9 a time.

If you run a professional services business: AI Prompts for Professional Services] — AU$9.

And if you’ve used any of the packs and have feedback on what worked (or didn’t), I’d like to hear it.

Sources

SmallBizAI.au Resources page — all Gumroad products and a bunch of free downloads and guides as well.

This is part of an ongoing series about building SmallBizAI.au in public. Also published at SmallBizAI.au.

Start from the beginning:

Australian Boards Don’t Understand AI. Here’s Why That’s A Problem For All Of Us.

Posted: April 21, 2026 | Author: | Filed under: Geek, Personal, smallbizai.au | Tags: , , , , | 3 Comments

frank arrigo career timeline

I’ve spent 40 years in technology. Starting at Aspect Computing in the 80s as a graduate, then 22 years at Microsoft both in Australia and Seattle, 4 years at Telstra, and finally 6 years at AWS covering Australia and APJ. I’ve sat in boardrooms, executive briefings, and strategy sessions across Australia, the US, and the Asia-Pacific region.

And I’ll tell you what I’ve noticed: the people making technology decisions at most Australian companies often understand finance, law, and general management very well. They understand technology considerably less well.

New research from Queensland University of Technology has put numbers to something I’ve experienced firsthand. Out of the 500 largest ASX-listed companies, more than half have zero directors with STEM expertise. Over 15 years — covering smartphones, cloud, and now generative AI — that number moved from 8% to 13%. Meanwhile, accountants, bankers and lawyers still hold 42% of board seats.

I don’t think these are bad directors. Many are excellent at what they do. But technology is no longer a back-office function. It’s strategy. And you can’t set strategy for something you don’t understand.

What I saw at Microsoft and AWS

At Microsoft, I spent years as a technical evangelist — explaining technology to businesses, developers, and yes, executives. The best executive conversations I had were with people who had at least some technical background. They asked better questions. They made faster decisions. They weren’t paralysed by the fear of making the wrong choice because they didn’t understand the options.

At AWS, I ran teams focused on helping Australian organisations adopt cloud and AI. Again: the organisations that moved fastest had at least one person close to the top who genuinely understood what they were adopting. Not necessarily an engineer — but someone who had shipped software, run a tech team, or built something with technology.

A former colleague of mine who focused specifically on AI governance and board-level education at AWS put it well: boards tend to either dismiss AI as an IT problem or panic about it as an existential threat. Very few engage with it as what it actually is — a general-purpose capability that changes what’s possible across every function of the business.

Why this is urgent now

The QUT research only goes to 2022. AI as we know it today — ChatGPT, Claude, Copilot, Gemini — arrived after that. The urgency has increased dramatically since then.

ASIC has told Australian boards that cybersecurity is their responsibility, not the IT department’s. AI brings similar responsibilities: data privacy, algorithmic bias, liability when AI systems make mistakes, regulatory compliance under an evolving Privacy Act.

The Australian government signed an MOU with Anthropic in April 2026 — the first arrangement under the National AI Plan. Billions are flowing into data centres. Anthropic is opening a Sydney office. The investment appetite is real.

But investment without governance is how you get expensive technology initiatives that deliver nothing, or worse, that create serious legal and reputational risk.

The question I keep asking myself

I’m on a career break right now. Building SmallBizAI.au — a practical guide to AI for Australian small business owners. It’s been a fascinating experiment in what one person can build with the right AI tools and infrastructure.

But the boards research made me think about what’s next. Not just for me personally — though if you’re looking for someone who’s spent 40 years in technology, led teams across Microsoft, Telstra and AWS, and is now building AI-native products, I’m worth a conversation. But more broadly: what does Australia lose when the people overseeing our biggest companies don’t understand the most important technology shift of our lifetimes?

The research has an answer. Companies with more STEM expertise on their boards invest more in innovation and are valued more highly. That held even in low-tech industries. The boardroom gap isn’t just a governance problem. It’s a competitiveness problem.

What good looks like

I’m not arguing every board needs a software engineer. I’m arguing boards need at least one person who has operated at the intersection of technology and business — who can ask the right questions, interrogate vendor claims, understand the real risks, and push management to move faster when the opportunity is clear.

That person exists in Australia. There are thousands of us — people who came up through technology, moved into leadership, and understand both sides. We’re not all in boardrooms. Some of us are on career breaks building websites about AI for small business owners.

That might need to change.

Sources