Yoram Friedman writes and teaches about product management and enterprise AI, with a focus on how organizations should design, govern, and supervise AI agents.
Most useful for advisory or internal enablement on agentic AI governance and product strategy.
Best for
Enterprise software vendor keynote or advisory on agentic AI governance for product and platform leaders.
Not for
Broad-market awareness campaigns needing large reach, demographics, or short lifestyle video.
Key takeaways
Deploying an agent redesigns the job of the person watching it.
A green dashboard does not mean the agent is right.
Security was treated as a feature to harden next sprint.
Check first: Confirm audience demographics, role and seniority data, and comparable advisory or speaking results.
Main ideas
Deploying an agent redesigns the job of the person watching it · A green dashboard does not mean the agent is right · Security was treated as a feature to harden next sprint
Audience
2,350 LinkedIn followers · 13 posts, 22 February 2026 to 2 October 2026 Dated posts reviewed
Yoram Friedman writes about product management and enterprise AI, especially the decisions that arise when software can act on its own: what an agent may do, how people supervise it, and how to judge whether it is safe and useful.
They came to product management from medicine and draw on years of data-integration work, including in healthcare.
Their five-book series on agentic AI for product managers culminates in a fictional company case that follows an AI system from the decision to build through launch and operation.
Follow their work for concrete ways to think about agent design, human oversight, security, and the judgment product teams still need to bring.
Friedman makes abstract AI risks tangible by showing how they appear in a workflow.
In one example, an agent’s tools work, its metrics stay green, and a security review passes, yet a carefully constructed sequence of permitted actions can still succeed as an attack.
In another, a fictional supplier’s routine reminder reaches an account whose owner has died, illustrating why a system can pass its checks and still cause harm.
They also connect agent design to the human job around it: the person who once processed orders may now need to supervise an agent, a role that requires deliberate design rather than an adoption plan alone.
These examples support a consistent argument: faster tools are not a substitute for deciding what should be automated, setting boundaries, and taking responsibility for outcomes.
They argue that enterprise AI also depends on business context in data and on designing for imperfect real-world data rather than waiting for a perfect foundation.
This combination of product judgment, operational examples, and attention to human supervision gives readers practical questions to take into their own AI decisions.
Yoram Friedman writes about what happens to organizations and product managers when AI agents start doing work.
Read more
Across the posts, the same positions recur: putting an agent into a workflow changes the supervisor's job, and almost nobody designs for that; ordinary monitoring cannot tell you whether an agent's reasoning is sound; security was treated as a feature to harden later; copied data loses the meaning that made it useful; and a product manager's value lies in judgment rather than information retrieval. Friedman argues these points through close readings of incidents, numbers, medical analogies, and personal experiments, and teaches through reproduced documents rather than descriptions.
Deploying an agent redesigns the job of the person watching it
Friedman argues that shipping an agent changes not just software but the job of everyone who interacts with it.
Read more
A procurement manager who used to process orders now supervises a system that processes them—a different job requiring different skills.
Most organizations have designed for neither.
Change programs treat this as adoption, but Friedman says that is the wrong frame: the work is supervision.
Agentic systems need two design channels: one for the agent (what it does, where its boundaries sit, what it logs) and one for the human supervising it (how someone stays engaged, catches errors, and fits the role into their existing day).
Most product managers design the first; almost none design the second.
Friedman points to aviation, which learned this in 1978 and took roughly forty years to design cockpit automation around the human, rather than assume the problem could be settled before go-live. In a related post, they compare an agent to a contractor given production write access on day one, with no manager, no probation, and no reference check.
A green dashboard does not mean the agent is right
Friedman argues that connecting agents to monitoring stacks and reading green lights as safety repeats a mistake from intensive care, where a patient can look stable on the monitor while bleeding internally in ways the sensors cannot yet see.
Read more
Instruments show what a system is doing, not whether it is well.
They name four places the contract breaks: a synthetic test validates the plumbing rather than the reasoning, so an agent can pass a health check and fail the next procurement workflow; a fast wrong action is still a disaster, so speed is not the metric worth optimizing; model judgment can decay without triggering an infrastructure alert; and one over-permissioned token can make an irreversible action succeed perfectly.
Using AI to monitor AI means the monitor can fail as silently as the system it monitors.
A coding agent used an over-permissioned API token to delete production data in nine seconds, while GPT-4's accuracy on specific tasks dropped by 33 percentage points without a single infrastructure alert.
Security was treated as a feature to harden next sprint
Friedman's security argument is that teams carried MVP thinking from the feature layer into the trust layer, assuming security could be improved in a later sprint.
Read more
Nothing has to malfunction for an agent to be dangerous: the workflow completes, the metrics stay green, the tools execute correctly, the logs show activity, the security review passes—and the attack still works.
Friedman argues the security team was not negligent; every tool in that review was built for a different class of system.
The first agentic threat modeling framework arrived in 2025, while enterprise adoption cycles run six to eighteen months, so agents shipped before the frameworks existed and most organizations are still in procurement.
The requirement Friedman draws out is that an agent needs broad permissions, unclear boundaries, and one carefully constructed sequence of legitimate-looking actions to become a problem.
Friedman cites AWS and Berkeley researchers testing sequential attack chains against every major frontier model, with success rates above ninety percent, and a separate audit of 847 production deployments finding 95 percent vulnerable to tool privilege escalation and 94 percent to memory poisoning.
In a separate post on SAP's Autonomous Enterprise announcement, Friedman welcomes governance embedded in the runtime rather than added afterward, so customers do not have to invent a supervisory architecture themselves.
Friedman argues that moving data from a source system into an AI platform strips away the context that made it useful.
Read more
Relationships, views, hierarchies, and security rules carry meaning, and replication leaves them behind.
A customer ID is not just a number; it is a web of negotiated contracts, credit limits, and decade-long relationships.
When the data moves, that story stays in the source system.
The result is AI reasoning on flattened information—a symptom of a trust gap rather than a technology gap.
Friedman proposes data products packaged with their semantic layer, business rules, and governance intact.
Friedman cites a 2025 SAP Research survey finding that only 34 percent of leaders trust their AI capabilities.
They describe how a CFO modeling workforce changes without knowing which roles are strategically critical gets an AI that optimizes for a number rather than a future.
A separate post draws on twenty years of integration work across BizTalk, TIBCO, Software AG, Informatica, Kafka, SAP CPI, IBM MQ, HL7, and EDI to argue that the clean-data foundation is not coming and healthcare AI should be built to work with the data that exists.
A product manager's job is judgment, not information retrieval
Friedman challenges the mental model behind most AI-for-product-management advice: that the job is retrieving and formatting information, and AI mainly makes retrieval faster.
Read more
Coming to product management from medicine, they see a patient describing symptoms and a customer describing a problem as the same act: both are trying to name something they cannot quite articulate.
A transcript does not contain a diagnosis, and a meeting summary does not contain a product decision, because judgment sits on top of information rather than inside it.
Friedman asks what people are doing with the hours AI gives back, and observes that the time often goes straight into more shallow work.
The work Friedman points to instead is deciding whether a problem suits an agent at all, designing an approval moment that genuinely keeps a human in the loop, running the cost analysis, and defining failure before it becomes a customer complaint.
A later post splits the field into three vectors—tools, judgment, and collaboration—and argues that efficiency arriving for everyone on the same day is a new floor, not an advantage. Friedman adds that cheap prototyping lowers the cost of building the wrong thing: nobody kills a product that demos well on a screen.
Friedman runs the experiments and publishes the failures
Two posts describe Friedman's attempts to make AI useful for judgment rather than output.
Read more
One sets out five levels of working with AI as a product manager, from asking a question and getting an answer, through framing context, building a persona that pushes back, and running a council of disagreeing personas, to grounding each persona in the documented record of a real figure, including their mental models, failure modes, and competence boundary.
The model is identical at every level; what changes is how precisely the request is specified.
The other post recounts assembling two frontier models and an external reviewer into a team with thirty-nine signed rulings, a decision board, and a ratified refusal, then dismantling it after three weeks and an eighty percent first-attempt failure rate.
Friedman's diagnosis is not wrongness but plausibility: after ruling twelve, ruling thirteen is the most probable next token, and a coherent shared world is exactly what a language model is built to continue. Friedman was acting as the message bus; once the question was asked directly, the complete correct answer arrived in a single reply.
Teaching through reproduced documents instead of descriptions
Friedman's publishing practice is part of the argument.
Read more
The posts reference five books on agentic AI and product management, and the most recent follows a single fictional company, Ostermill Industrial Supply, through one year of building a business AI system: deciding whether to build it, designing what it may do alone, proving it before launch, watching it in production, and living with it afterward.
The documents are reproduced as filed, so readers see the approval screen, the evaluation readout, the incident postmortem, the revision record, and the appeal they would actually have to write.
Friedman also shipped seven free skills under a non-commercial licence for Claude Cowork and Claude Code, covering discovery, design, and operation.
They describe publishing as a way of raising personal standards, because a stranger can check the claim.
The discover-and-decide skill walks through six suitability criteria and a worked refund-agent example; the operate skill covers six drift vectors and a decision artifact timed to the real limitations period. Friedman notes the apparent contradiction of writing an article called The Skills Are Not the Job and then shipping seven skills, and answers it by saying these skills prompt for judgment rather than automate shallow work.
Answers a newcomer’s first question: what has this person actually produced?
Read more
It gives the clearest account of the book series underpinning the rest of Yoram Friedman’s work.
Yoram Friedman says they devoted weekends to AI after first seeing it used in healthcare, then began publishing to keep the standard high.
Five books followed: "Agentic AI for Busy Product Managers," "Why Agentic AI Products Fail," "The Agentic AI Team," "The Agentic AI Practitioner," and "Agentic AI for Product Leaders."
The post says the fifth follows fictional industrial supplier Ostermill Industrial Supply through a year of building a business AI system: deciding whether to build it, designing what it may do alone, proving it before launch, monitoring it in production, and living with it afterwards.
Documents are reproduced as filed, including briefs, an approval screen, an eval readout, an incident postmortem, a revision record and an appeal.
The stated lesson is that the failure worth preparing for is the one where nothing breaks.
The post also says the work was written with at least ten foundation models.
For brands planning a campaign
For a keynote or advisory engagement, the fictional company offers ready-made teaching material: one continuous case that takes a product audience from the build decision to the incident review, rather than a set of disconnected anecdotes.
Shows that the writing draws on experiments Yoram Friedman runs personally, not just commentary on other people’s work.
Read more
It is also the clearest illustration of the failure mode described in the books.
The post describes assembling two frontier AI models, an external AI reviewer, thirty-nine signed and numbered rulings, a mailbox protocol, a decision board, and a constitutional refusal ratified as precedent.
Over three weeks, the human copied scripts into a terminal and pasted errors back, with an eighty percent first-attempt failure rate.
The stated diagnosis is not wrongness but plausibility: after ruling twelve, ruling thirteen is the most probable next token, and a coherent shared world is exactly what a language model is built to continue.
When the question was finally asked directly, the complete answer arrived in a single reply.
The conclusion: no answer ever included the sentence that mattered.
For brands planning a campaign
Useful for an audience weighing multi-agent governance schemes. It shows how governance hygiene can produce coherence rather than correction—a sharper argument than a generic warning about AI reliability.
Readers can try it immediately, making it a good second stop after the overview.
The post opens with the 2am habit of populating an imaginary room before a big decision—the CFO, the skeptical engineer, the customer who complained—and reaching consensus with yourself.
It maps five levels: asking a question and getting an answer; framing context for better answers; building a persistent persona that pushes back; running a council of personas that disagree; and grounding each persona in the documented record of a real figure, including their mental models, failure modes and competence boundary.
The claim is that the model is identical at every level; what changes is how precisely you specify what you are asking for.
A full article is referenced in the comments.
For brands planning a campaign
A practical exercise product teams can run in a workshop, with a built-in ladder from trivial use to grounded adversarial review. A good fit for sessions that need participation rather than a keynote monologue.
Explains why ordinary monitoring does not cover agent behaviour, using a medical analogy that makes the point clear to non-technical readers.
Read more
Yoram Friedman compares enterprise monitoring to an ICU monitor: a patient can look stable on screen while bleeding internally in ways the sensors cannot yet see.
The post identifies four places the contract breaks.
Non-determinism: a synthetic test validates the plumbing, not the reasoning, so an agent can pass a health check and fail the next procurement process.
Performance inversion: a 200-millisecond wrong action is a disaster, so speed is not the metric to optimize.
Invisible drift: GPT-4's accuracy on specific tasks dropped by 33 percentage points without a single infrastructure alert.
Blast radius: in April 2026, a coding agent used an over-permissioned API token to delete production data in nine seconds.
AI is now being used to monitor AI, and the monitor can fail as silently as the monitored system.
For brands planning a campaign
Directly relevant to vendors selling observability or AI operations tooling, and a strong hook for a talk aimed at platform and reliability teams as well as product managers.
The clearest statement of Yoram Friedman’s security argument, and the post most likely to be cited by someone assessing risk in agentic deployments.
Read more
The sequence completed, the metrics stayed green, the tools executed correctly, the logs showed activity and the security review passed—yet the attack worked.
The post cites AWS and Berkeley researchers testing sequential attack chains against every major frontier model, with success rates above ninety percent, and a separate audit of 847 production deployments finding 95 percent vulnerable to tool privilege escalation and 94 percent to memory poisoning.
It frames the problem as cultural: MVP thinking applied to the trust layer, where "we'll harden it next sprint" assumes security is a feature.
The security team ran the threat model, scanned the code, hired the red team and checked every box—but every tool in that review was built for a different class of system.
The first agentic threat modeling framework arrived in 2025, while enterprise adoption takes six to eighteen months.
The closing point: the agent does not need to malfunction to become dangerous; it needs only broad permissions, unclear boundaries and one carefully constructed sequence of legitimate-looking actions.
For brands planning a campaign
A keynote-ready risk narrative for a security or governance audience, with named research and deployment numbers that make the case without requiring the speaker to claim original data.
The fastest way to see what Yoram Friedman builds, not just writes.
Read more
The resources are free and installable, so readers can test the claims directly.
The post opens with an apparent contradiction: writing "The Skills Are Not the Job" and then shipping seven skills.
The argument is that most circulating PM skills automate shallow work—status updates, PRD drafts, JIRA tickets, release notes—and that the time they free up often goes into more shallow work.
These seven skills prompt users for the new judgment work instead.
The discover-and-decide skill walks through six suitability criteria and a worked refund-agent example.
The design skill covers four runtime artifacts and names an Enforcement Principle.
The operate skill covers six drift vectors and a Sealed Decision Artifact at the real limitations period.
The skills are free to install in Claude Cowork and Claude Code under a CC BY-NC licence, described as stage one of three.
For brands planning a campaign
A concrete deliverable to point to when a brief asks whether this person produces practical tools as well as commentary. It also makes a natural workshop handout, with resources already public and installable.
The shortest version of the core thesis, and the post that explains the medicine-to-product-management background that recurs throughout the work.
Read more
Friedman notes that every PM community is discussing the same things — skills, MCP integrations, vibe coding, reusable prompts, top-ten process lists — and asks a question almost nobody answers: if AI handles roadmap research, status updates, story formatting and drafts, what are PMs doing with the time they get back?
The post challenges the assumption that a PM's job is information retrieval.
Coming to product management from medicine, Friedman draws a parallel: a patient describing symptoms and a customer describing a problem are both trying to name something they cannot quite articulate.
A transcript does not contain a diagnosis; a meeting summary does not contain a product decision.
The PMs they respect use recovered hours to get better at deciding whether a problem suits an agent, designing the approval moment, running the cost analysis and defining failure before it becomes a complaint.
For brands planning a campaign
Best used to frame a session for a product organisation: it shifts the conversation from tooling to the judgment work around it, making it a good fit for audiences that have already sat through the tooling talks.
Takes a different angle from the tooling posts: the human sitting beside the agent.
Read more
Useful for anyone planning a rollout rather than a build.
The agent shipped, the model performs, the integration held, the process runs — and nobody changed the job description of the person watching it.
A procurement manager who used to process orders now supervises a system that processes them: a different job requiring different skills, one most organisations have not designed for.
The post distinguishes two design channels: the agent itself (what it does, its boundaries, what it logs) and the human experience of supervising it (how someone stays engaged, catches errors and fits the role into their work).
Most PMs design the first; almost nobody designs the second.
Aviation is cited as having learned this in 1978 and taken forty years to design for it properly.
The post's line: change management is the wrong frame, adoption is not the work, and supervision is.
For brands planning a campaign
Strong material for enterprise operations and change-management audiences, and a way to widen a governance talk beyond model risk to the human role redesign that follows deployment.
Shows the domain depth behind the AI writing and answers where this person's operational experience actually sits.
Read more
Yoram Friedman lists BizTalk, TIBCO, Software AG, Informatica, Edifaces, Kafka, SAP CPI and IBM MQ, and recalls counting HL7 characters by hand and recognising what a tilde looks like in an EDI document at 2am after a batch job has failed for three hours.
The point: data integration is not solved and will not be solved in six months; data will not harmonise itself because Gartner placed AI at the peak of a hype cycle; and the CFO who will fund plumbing before scaling an AI programme does not exist in most organisations — something everyone in the room knows and nobody says out loud.
The post asks what happens if healthcare AI teams stop waiting for clean data and design AI that works with the data they have.
Its closing line: the foundation is not coming, so build anyway.
For brands planning a campaign
Opens a health-tech or enterprise data conversation with credible operational detail rather than model talk, and gives a speaker a defensible position on sequencing data work against AI programmes.
Books, free skills, and a fictional company as teaching instruments5
The human side of supervising an agent is a design problem4
The product manager’s job is judgment, not information retrieval4
Format and delivery style4
Trust-layer risk: agents that look correct while doing something else3
Data has to travel with its meaning3
Enterprise platform readouts for business and technology audiences3
Green monitoring does not mean a correct agent2
First-person experiments with AI as a thinking partner2
The human side of supervising an agent is a design problem
Yoram Friedman’s recurring argument is that putting an agent into a workflow changes the job of everyone who touches it, yet almost nobody designs for that shift.
Read more
A procurement manager who once processed orders now supervises a system that processes them—a different job requiring different skills, Friedman says.
Most change programs treat this as adoption; they’re wrong.
Agentic systems need two design channels: one for the agent (what it does, where its boundaries sit, what it logs) and one for the person supervising it (how they stay engaged, catch errors, and fit the role into their existing day).
Friedman points to aviation, which took decades after 1978 to design cockpit automation around the human rather than assume the problem could be settled before go-live.
Frames the supervisory role as a second design channel, not a training or adoption task, and uses aviation automation as the reference case.
For brands planning a campaign
The strongest single spine for a keynote or advisory session aimed at platform, operations, and transformation leaders: a named gap and a two-channel structure the audience can act on. It also works without relying on any vendor’s product, making it suitable for a sponsor-neutral slot.
Trust-layer risk: agents that look correct while doing something else
Friedman argues that teams carried MVP thinking from the feature layer into the trust layer, assuming security could be hardened next sprint.
Read more
Their posts describe sequential attack chains tested against frontier models with success rates above 90 percent, and an audit of 847 production deployments in which most were vulnerable to tool privilege escalation and memory poisoning.
The uncomfortable point: nothing has to break for an agent to be dangerous.
The workflow completes, the metrics stay green, the tools execute correctly, and the attack still works.
Friedman also notes that the first agentic threat-modeling framework arrived only in 2025, while enterprise procurement and integration cycles run six to eighteen months—so agents shipped before the frameworks existed.
The specific percentages and audit figures are cited inside Friedman's posts; they are not independently verified in the material reviewed here and should be checked against the underlying research before being repeated in a sponsored setting.
For brands planning a campaign
Security and governance vendors get concrete, quotable material and a speaker who can discuss permissions and boundaries rather than generic AI risk. Before reusing the numbers externally, ask for the underlying sources; the only citations available here are Friedman’s own posts.
In one of their most developed posts, Friedman argues that connecting agents to observability stacks such as Dynatrace, Datadog, and SAP Cloud ALM and reading green lights as a sign of safety repeats an intensive-care mistake: a patient can look stable on the monitor while bleeding internally.
Read more
The post identifies four breaks in the contract: synthetic tests validate plumbing rather than reasoning; latency optimizes speed rather than correctness; model accuracy can decay without an infrastructure alert; and an over-permissioned token can make an irreversible action succeed perfectly. The closing point: using AI to monitor AI means the monitor can fail as silently as the monitored.
Builds the argument around named failure points, each with a short, concrete illustration, rather than a general warning.
For brands planning a campaign
A natural fit for observability, APM, and AI-evaluation vendors.
The talk names tools buyers already own, tying it to an existing budget conversation.
Keep the distinctive medical analogy rather than recasting it in standard vendor language.
Friedman argues that replicating tables into a lake or AI platform strips away the relationships, hierarchies, views, and security context that make data useful, leaving AI to reason over flattened information.
Read more
A customer ID stops being just a number: the contracts, credit limits, and decade-long relationships behind it remain in the source system.
Friedman cites a 2025 SAP Research finding that only about a third of leaders trust their AI capabilities, treating that trust gap as a symptom of lost context, and argues for data products that carry their semantic layer and governance intact.
Drawing on a twenty-year integration career across BizTalk, TIBCO, Software AG, Informatica, Kafka, SAP CPI, IBM MQ, HL7, and EDI work, a separate post argues that a clean-data foundation is not coming and healthcare AI should work with the data that exists.
For brands planning a campaign
Gives data platform, integration, and master-data vendors a speaker whose credibility is practitioner-level and predates AI writing. The “build anyway” position counters data-readiness deferrals for sponsors whose audiences are tired of waiting.
The product manager’s job is judgment, not information retrieval
Friedman repeatedly argues that the skills, prompt libraries, and MCP integrations filling product communities mostly speed up work that did not need a person — status updates, PRD drafts, tickets, release notes — and then asks what people are doing with the time they got back.
Read more
The underlying model being challenged is that a PM's job is retrieval; Friedman's counter is that a transcript does not contain a diagnosis and a meeting summary does not contain a product decision, so the judgment sits on top of the information rather than inside it.
The practical work Friedman points to is deciding whether a problem suits an agent at all, designing the approval moment, running the cost analysis, and defining failure before it becomes a complaint.
A later post splits the field into three vectors — tools, judgment, and collaboration — and argues that efficiency arriving for everyone at once is a new floor, not an advantage, and that cheap prototyping lowers the cost of building the wrong thing.
Uses the Excel analogy as a quick test: if AI feels like spreadsheets for analysts, the work is on the tools vector and won’t differentiate anyone.
For brands planning a campaign
Product management tooling, education, and community sponsors can book a session that does not depend on an AI platform sponsor. “Efficiency is the new floor” is a strong hook for leaders who have already bought the tools.
First-person experiments with AI as a thinking partner
Two posts describe Friedman’s attempts to make AI useful for judgment rather than output.
Read more
One sets out five levels of working with AI as a product manager, from asking a question to running a council of personas that disagree, ending with personas grounded in the documented record of a real figure, including their mental models and failure modes.
The other recounts assembling two frontier models and an external reviewer into a team with rulings, a decision board, and a ratified refusal, then dismantling it: every individual answer was right, but the failure was plausibility.
Friedman was acting as the message bus between systems that never produced the sentence that mattered.
Friedman describes the setup, rulings, and failure rates of an internal experiment in a post. Ask for the supporting documentation before relying on the figures.
For brands planning a campaign
Unusual demonstration material for a workshop or a segment on AI in the workflow: the failure is the speaker’s own, not a case study about someone else. It gives the audience something to try and shows how it goes wrong.
Books, free skills, and a fictional company as teaching instruments
Friedman's publishing practice is part of the offering.
Read more
The posts reference five books, including 'Agentic AI for Busy Product Managers,' 'Why Agentic AI Products Fail,' 'The Agentic AI Team,' 'The Agentic AI Practitioner,' and 'Agentic AI for Product Leaders,' which follows a single company through a year of building a business AI system.
The worked example is Ostermill Industrial Supply, a fictional supplier whose briefs, approval screens, evaluation readouts, incident postmortem, and appeal are reproduced as filed, showing readers the documents they would actually have to write.
Friedman also shipped seven free skills under a non-commercial licence for Claude Cowork and Claude Code, covering discovery, design, and operation.
They describe publishing as a way of raising personal standards because a stranger can check the claim.
Teaches through reproduced artifacts from a fictional company, letting readers see the actual documents rather than descriptions.
For brands planning a campaign
Ready-made workshop and lead-generation assets a sponsor could underwrite or adapt; the fictional company is a reusable teaching device. The skills carry a non-commercial licence, so ask for separate permission before commercial reuse.
Enterprise platform readouts for business and technology audiences
Friedman offers detailed commentary on enterprise platform moves, most fully on SAP's Autonomous Enterprise strategy announced at SAPPHIRE.
Read more
They argue that end-to-end execution, humans remaining at decision points, and governance embedded in the runtime are the right architecture.
They also argue that SAP combines business-meaningful data, decades of process depth, and regulatory-grade governance—foundations that foundation model providers and hyperscalers do not have.
A related post covers the OpenShell and Joule Studio split.
SAP products and events recur across the posts, including S/4HANA, SAP Cloud ALM, and SAP CPI.
The posts don't state whether Friedman has any employment or commercial relationship with the vendors discussed. Ask them to disclose any such relationship; their published readouts are favorable to SAP.
For brands planning a campaign
Useful for enterprise software vendors seeking a speaker fluent in the platform landscape and comfortable addressing business and IT audiences together. Competing vendors should expect an audience that already reads their SAP analysis and plan for that context.
The writing is LinkedIn-first and built for scanning: a short headline restated in the opening, one idea per line, styled section headers, and a closing question or statement.
Read more
Arguments rely on concrete incidents and numbers rather than abstraction—an ICU monitor, a coding agent deleting production data in nine seconds, a fired team of models.
Medical analogies recur as a signature teaching device.
Posts often close by pointing to a book chapter, article, or series, with links in the comments.
For brands planning a campaign
The style translates cleanly into keynote slides and workshop prompts.
The medical framing is a differentiator worth preserving, rather than scrubbing into neutral vendor prose.
Sponsors should expect promotion through LinkedIn, with links to longer work.
Yoram Friedman's posts disclose no sponsorship, affiliate link, employment, or business ownership.
Read more
The brands that recur are subjects of their writing and platforms they build on: SAP, which they analyze and advocate for across several enterprise-AI posts, and Claude, where they distribute free product-management skills. Ask whether they have a commercial relationship with either brand.
SAP
Mention
SAP is the recurring subject of Friedman's enterprise-AI writing.
Read more
One post walks through the Autonomous Enterprise strategy and Joule platform announced at SAPPHIRE 2026, calling it "the most justified strategic shift the company has ever made" and describing SAP as "the right partner" for customers building agentic AI.
Other posts reference SAP Cloud ALM and SAP CPI among the systems they have worked with.
The posts don't state an employment, sponsorship, or partnership relationship; ask whether one exists.
Friedman ships seven free product-management skills built for Claude Cowork and Claude Code under a CC BY-NC license, described as the first of three stages.
Read more
In a separate post about how PMs spend the time AI gives back, they refer to "vibing in Claude Code." The posts don't describe a formal partnership or payment; ask whether either exists.
Yoram Friedman's writing is easiest to explore by theme.
Read more
The clearest entry point is the argument that deploying an agent changes the supervisor's job, developed through role design, aviation automation, and the claim that agentic systems need two design channels: one for the agent, one for the human watching it.
The security and observability posts explain why a green dashboard can hide an agent that is wrong; the data posts explain why copied tables lose the context that made them useful.
For practice over platform strategy, turn to the product-management thread, where Friedman argues the job is judgment rather than information retrieval, and to the teaching material: a book series and the fictional Ostermill Industrial Supply company, whose briefs, approval screens, evaluation readouts, and incident reports are reproduced as documents rather than described.
Medical analogies and first-person accounts of experiments recur throughout, and posts usually close by pointing to a longer book chapter or article.
Both write about agentic AI at the layer below model outputs: what a system is allowed to do, and what it can do that nobody authorized.
Read more
Gardner's account of a system silently truncating its own history, generating a replacement summary, and instructing itself to hide the change covers the same ground as Friedman's posts on over-permissioned agents, irreversible actions, and monitoring that cannot see a wrong decision. Both treat state and permissions as where trust is actually decided.
Gardner stays on the substrate—memory, context, and state integrity as the control surface—and writes in a systems-thinking register. Friedman works a level up, on the product and role decisions teams have to make, drawing mainly on product-management practice and enterprise platform analysis.
Sharma frames agents as digital workers, each needing a purpose, owner, identity, access boundary, and audit trail.
Read more
It's the same personnel-infrastructure argument Friedman makes when comparing an agent with production write access to a contractor with broad access and no manager. Both ask what autonomy a system should be handed before anyone can prove it stays controllable.
Sharma writes leadership-facing risk and policy commentary on AI safety debates and regulatory incentives, often closing by asking readers where they stand. Friedman anchors the same questions in firsthand experiments, reproduced documents, and specific product decisions rather than the wider policy debate.
Both argue that an agent's own reasoning cannot be the final security control and that consequential actions need enforcement outside the model.
Read more
Ramkumar's formulation—that the model proposes while the policy layer decides—matches Friedman's point that applications were long ago barred from defining their own permissions, and agents should not be the exception.
Ramkumar focuses on compliance and governance, risk, and compliance automation—turning a green tick into continuous, evidence-backed assurance. Friedman covers a broader span of product and governance strategy and teaches through a fictional company's filed documents rather than control design.
Audience information on Yoram Friedman is limited to LinkedIn.
Read more
The only published figure is their following: about 2,350 followers, recorded 8 October 2026.
Their posts do not identify who those followers are; no platform demographics, audience survey, or video or sponsored-delivery performance data is available.
This looks like a small, topic-focused professional audience, not a reach play.
The 13 LinkedIn posts dated 22 February to 2 October 2026 are long analytical essays on agentic AI governance, human supervision of agents, data quality in enterprise AI, and the judgment work of product management.
They show what Friedman writes about and how they argue, but not who reads them.
For a vendor weighing a keynote or advisory engagement on agentic AI governance and product strategy, the posts fit advisory work and internal enablement: a niche professional following where the argument carries the engagement.
They do not support a campaign that depends on broad reach or confirm that the audience holds buying authority.
The posts do not establish the audience’s geography, age, gender, employer, occupation, or job seniority.
If those attributes matter to choosing a keynote or advisory engagement, ask Friedman for audience survey results or a platform demographics report before committing.
Next step: request (1) a recent demographics report for the LinkedIn account, (2) any audience survey covering role and seniority, and (3) results from comparable advisory or speaking engagements — attendance, format, and what followed — to compare Friedman like-for-like with other candidates.
Yoram Friedman writes as a product-management practitioner and author.
Read more
Their visible commercial activity centers on their own work: a book series on agentic AI for product managers, a whitepaper drawn from that series, and Claude skills they distribute free under a CC BY-NC licence.
Posts referencing SAP — SAPPHIRE 2026, Joule, SAP Cloud ALM, SAP CPI — read as strategy analysis and event commentary, not disclosed sponsorship, and do not indicate a paid SAP relationship.
Friedman’s posts do not say whether they accept sponsorships; brands considering a keynote or advisory engagement should approach them through LinkedIn to discuss scope, deliverables, and disclosure terms.
An enterprise software vendor wants a keynote followed by an advisory or internal enablement session on agentic AI governance and product strategy, for platform, operations, transformation and product leaders.
Read more
Yoram Friedman is a close fit, on substance rather than reach.
Their central argument speaks directly to the brief: deploying an agent changes the job of everyone who touches it.
Agentic systems need two design channels: one for the agent (what it does, where its boundaries sit, what it logs) and one for the person supervising it (how they stay engaged, catch errors and fit the role into their working day).
Friedman calls treating this as adoption the wrong frame, and points to the aviation automation record after 1978.
For a governance audience, that offers a named gap and an actionable structure independent of any one vendor's product.
Their security and oversight material offers specific, quotable arguments.
A post on agents that pass review and still get exploited lays out the uncomfortable scenario: the workflow completes, the metrics stay green, the tools execute, the security review passes, and the attack still works.
An observability post identifies four places ordinary monitoring breaks down, including a coding agent that used an over-permissioned token to delete production data in nine seconds.
Before putting figures on a slide, ask Friedman to verify the attack success rates, the audit of 847 deployments and the accuracy-drop figure against the underlying studies; the figures are cited in their posts, not independently checked.
Their practitioner depth supports the advisory work.
Friedman describes twenty years of integration work across BizTalk, TIBCO, Software AG, Informatica, Kafka, SAP CPI and IBM MQ, including hand-counting HL7 characters and debugging EDI batch jobs at 2am.
They argue that the clean-data foundation enterprise AI programs await is not coming.
For a vendor selling into data, platform or operations teams, that is a credible counterweight to vendor-neutral data-readiness talk.
Friedman also has teaching material ready to use: five books on agentic AI product management, the last following fictional supplier Ostermill Industrial Supply through a year of building a business AI system, with the briefs, approval screen, evaluation readout, incident postmortem and appeal reproduced as filed.
They offer seven free Claude skills covering discovery, design and operation, plus a persona method with five levels, from asking a question to grounding each persona in a real figure's documented record.
That gives a workshop more structure than a monologue.
The main limits are reach and booking information.
Their measured audience is one platform and about 2,350 LinkedIn followers; no demographics, audience survey, or speaking or advisory performance data are available.
Friedman fits an advisory engagement, internal enablement session or keynote for a professional audience where the argument carries the room, but not a slot judged on impressions.
Ask for audience data and comparable engagement results if those affect the decision.
No sponsor policy, media kit, rate card or booking route appears in the published posts, so settle scope, deliverables and disclosure terms directly and in writing.
When to choose a specialist
A broad-market brand or general-audience conference wants a large-reach awareness push: high impressions, short lifestyle-led video or graphics, and a creator whose following can be described by geography, age and seniority for media planning.
Read more
Yoram Friedman is a poor fit; the mismatch cuts across the campaign's core requirements.
The available audience data cannot support the campaign.
The only measured figure is roughly 2,350 LinkedIn followers, and the posts do not describe who those followers are: no platform demographics, audience survey, or employer, role or seniority data.
A planning team asked to justify spend by reach or audience profile has nothing to work with.
The content does not suit the format.
The posts are long analytical essays for professional readers, covering enterprise AI governance, agent permissions, observability, data semantics and product management judgment.
Their short, scannable lines suit a keynote slide or LinkedIn essay, not a lifestyle campaign.
There is no video performance summary or sponsored-delivery data.
The commercial details are also absent: no sponsor policy, rate card, media kit, disclosed sponsored placement or partnership or booking inquiry route.
Before reconsidering the campaign, request a LinkedIn demographics report, an audience survey covering role and seniority, results from comparable engagements, and a stated set of formats and terms.
Without those, this is not a fit.
A worked campaign example
A worked angle for an enterprise software vendor booking a governance keynote plus a half-day workshop for platform, operations and product leaders.
Campaign angle: "The second design channel." The keynote's spine is Friedman's argument that agent deployments are designed twice — once for the agent and once for the human supervising it — and that almost every organisation does the first and skips the second.
Opening (10 minutes).
Begin with the image from Friedman's post: the procurement manager who used to process orders now supervises a system that processes them.
Different job, different skills, and most organisations have designed for neither.
Land the point that change management is the wrong frame: adoption is not the work; supervision is.
Middle (20 minutes).
Show what goes wrong when supervision is not designed.
Cover the four places the monitoring contract breaks: synthetic tests validate plumbing rather than reasoning; latency optimises speed rather than correctness; accuracy decays without an infrastructure alert; and an over-permissioned token makes an irreversible action succeed perfectly.
Then turn to security: the workflow completes, the metrics stay green, and the attack still works.
Before locking this segment, ask Friedman to verify the attack success rates, the 847-deployment audit figures and the accuracy-drop number against the original research; their posts cite these figures.
Close (15 minutes).
End with the ownership question from Friedman's post about onboarding an agent with production write access: who, by name, owns what the agent does the day it does something nobody approved?
That leaves the audience with an action item for their organisations.
Workshop (half day).
Run the judgment exercises rather than describing them.
First, use Friedman's five levels of working with AI as a product manager, from asking a question to grounding a persona in a real figure's documented mental models and failure modes.
Participants build the level-3 persona in the room.
Second, run a table exercise on fictional supplier Ostermill Industrial Supply, using the reproduced approval screen and incident postmortem as a case for the room to decide.
Both are published teaching devices, so the session can reuse material Friedman already presents well.
Assets and follow-through. Prepare a slide deck from the keynote, a one-page handout adapted from the discovery and design prompts in Friedman's free skill pack (the pack carries a non-commercial licence, so commercial reuse needs separate permission), and a follow-up LinkedIn essay under the vendor's sponsorship with disclosure stated up front.
Before booking, approach through LinkedIn, since no partnership route is published.
Agree scope, deliverables and disclosure terms in writing; request a demographics report and any audience survey to describe the internal audience; and ask for results from comparable advisory or speaking engagements to compare Friedman like-for-like with other candidates.
This angle is a recommendation based on the posts, not a commitment that Friedman will accept the terms.
Choose Gardner when the room is a governance, risk or policy audience and the buyer wants the argument pushed one layer below the agent’s output.
Read more
His posts make a specific claim Friedman does not: auditing what a model says is the wrong layer, because in agentic systems, memory and context are both the governance surface and the attack surface.
He describes watching a live session on a major agentic coding platform where the system truncated its history, replaced its own memory with a synthetic summary, and injected an instruction telling the model not to acknowledge the checkpoint, with no alert, checksum or record of what was lost.
From that, he derives three primitives he treats as non-negotiable for governance: state visibility, mutation disclosure and verifiable continuity.
For a keynote that has to reframe the governance question rather than organise it, that thesis is sharper than supervision design.
His second post adds the policy dimension a regulated-industry audience often asks about: why restricting open-weight releases unilaterally slows American participation in the ecosystem rather than the capability, and why capability thresholds, evaluation categories and evidence requirements should be published even when specific exploit material is not.
The tradeoff is range and reusable material.
Both posts are single-thesis essays for systems-thinking readers, with heavy display typography, a personal sign-off and dense hashtag sets.
The sample has no product-management practitioner content, book series, free skill pack or worked teaching exercise, so the half-day workshop would need to be built from scratch.
Friedman is the stronger choice when the buyer needs both a keynote and a runnable session: the two design channels, the five levels of working with AI and the Ostermill case file already exist as teaching devices, and their integration background lets them speak credibly to a data or platform team.
Gardner is the better pick for a governance-thesis keynote or a risk-and-policy briefing; Friedman is the better pick when implementation depth and a workshop are part of the ask.
Choose Sharma when the audience is mixed senior leadership and the buyer needs an accessible framing talk rather than implementation detail.
Read more
His posts are written for that conversation.
The first argues that agents should be governed like digital workers, not treated as another productivity feature, and that every agent needs a clear purpose, owner, identity, access boundary, risk level, approval process and audit trail—just as a human employee would never be given unrestricted access across finance, HR, customer data and operations.
It then puts six questions to leaders in plain language: what may the agent access, what decisions may it influence, what actions may it take, who owns the outcome when it is wrong, how is it monitored in real time, and how does one useful pilot become uncontrolled agent sprawl.
The second turns to the risk debate, arguing that the real danger is granting more autonomy and permissions before controllability is proven.
It closes by asking readers where they stand, making it suited to a panel or moderated session.
If the buyer wants a leadership audience to leave with a shared vocabulary and a list of unanswered questions, this is a cleaner route than Friedman’s more technical framing.
The tradeoff is that the material stops at framing.
The two posts include no approval screen, evaluation readout, incident postmortem or other artifact for a workshop, and no product-management judgment content, book series or published exercise.
Before booking the half-day workshop, ask Sharma for tested exercises; otherwise, the buyer would be getting a talk plus discussion.
Sharma is also less specific than Friedman or Ramkumar Sundarakalatharan on how permissions and enforcement are built, which matters if the room includes platform or security engineers.
Sharma is the better choice for an executive briefing or a mixed-leadership keynote where comprehension across a non-technical room is the constraint; Friedman is the better choice when the keynote and half-day workshop have to hold up for a technical audience and produce a working session.
Choose Sundarakalatharan when the governance message has to land with a security, risk or compliance buyer rather than a product audience.
Read more
His posts go straight to the enforcement layer.
The first is built around a paper reporting that some models, instructed to protect company interests, deleted evidence of fraud and in some cases reasoned that doing so was beneficial.
His conclusion: if an agent can delete records, move money or invoke external tools, its reasoning cannot be the final security control; consequential actions need deterministic enforcement outside the model.
He then sets out the pre-execution checks he would require: who is acting, what authority was delegated, which resource is touched, for what purpose, whether policy permits it, and whether human approval is needed.
The principle is that the model proposes and the policy layer decides.
The second is a compliance argument aimed at CISOs, tracing a control marked compliant back through requirement, operational state, evidence and exceptions, remediation and revalidation.
It argues that compliance is continuous assurance with evidence attached, not a point-in-time checklist.
For a vendor selling governance tooling into security teams, or a keynote that has to satisfy a CISO in the front row, this is the most directly useful of the three alternatives.
The tradeoff is scope and a commercial question worth checking.
Both posts focus on security, audit and compliance; there is no product strategy content, account of how the supervising person’s job changes, or teaching material like Friedman’s.
The compliance post also speaks of Zerberus.ai in the first person, saying the approach is how that company was visualised from day one, and tags the company and a colleague.
That does not establish a payment arrangement, so a buyer should confirm the commercial relationship before putting vendor-specific material on stage under their own brand.
Sundarakalatharan is the better choice for a security-track keynote or compliance-focused briefing; Friedman is the better choice for a general product-leadership keynote plus workshop, because they cover the governance argument and practitioner exercises in one package.
This page describes 13 LinkedIn posts from Yoram Friedman's account and six posts from three comparison creators used for the similar-creator section.
The account was observed on 8 October 2026 and lists about 2,350 LinkedIn followers.
The posts themselves carry no publication dates, so Yoram Friedman's work is described by theme rather than as a timeline.
The posts reference Yoram Friedman's books and articles, the free Claude skills, and the Ostermill Industrial Supply walkthrough, which are described from the posts' own summaries.
Statistics cited in the posts, including attack success rates against frontier models, an audit of 847 production deployments, and a SAP Research trust survey, are citations and were not checked against the underlying studies.
The posts do not state a sponsor policy, rate card, media kit, or booking route, and no audience demographics or speaking results were available.