Track one

Infrastructure & trust

Why this track exists

Rungs 1 and 2 are a sealed box: the model touches nothing, so questions about servers, credentials, and attack surfaces simply do not arise. You can live at rung 2 forever knowing none of this.

Crossing into rung 3 changes that in one stroke. The moment the AI acts outside the chat, you inherit responsibility for what makes that safe — not as an optional enrichment, but as part of what standing on rung 3 means. This track is that inheritance, organized. The half-joking summary: everyone becomes a little bit devops. Not everyone becomes an engineer — but everyone using tool-connected AI ends up needing a working vocabulary for where software runs, where data flows, and what can go wrong in between.

The three clusters

1. Where the model lives

A model is software running somewhere, and where is a decision with consequences: closed weights, cloud/API (the model is a service you call; your data makes a round trip to the provider's machines) · open weights (published for anyone to download and run — open weights ≠ open source) · cloud/SaaS vs. on-prem/self-hosted (consume someone's hosted service, or run it on machines you control) · local inference (run the model on your own device; data never leaves — quantization is what makes this practical) · data residency / sovereignty (where data physically and legally lives, and whose law applies — the question that forces all the above choices to be made deliberately).

2. Data, trust, and the attack surface

What can go wrong once an AI reads the world and acts on it: prompt injection (rung 3) escalating to indirect prompt injection (rung 4, when an autonomous agent reads content with no human watching) · data poisoning · jailbreaks (a user pushing the model past its rules — distinct from injection, which is third-party content subverting it against the user) · data exfiltration / leakage · least privilege (rung 4) · sandboxing (rung 4) · credentials/secrets — never in a chat window, ever; minimal grants everywhere.

3. Ops literacy

The recognition-level vocabulary of running software, because tool-connected AI lives in that world: deployment and rollback, environments (dev/staging/prod), containers, endpoints, version control (Git), logging/monitoring. All defined in the glossary.

The two ideas this track is actually about

Everything above is inventory. These two are the point:

Ops burden = rung × hosting

How much of this track you personally carry is not fixed by how high you climb. It is the product of two dials: your rung, and your hosting choice.

	Managed cloud service	Self-hosted / local
Rung 3	Very little ops: connect approved integrations, mind your data and credentials	Substantial ops: you run the model, the connectors, the logs
Rungs 4–5	Still modest: the provider runs the machinery; you own goals, gates, and audits	The full stack: deployment, sandboxing, monitoring, rollback — all yours

A rung-4 user on a managed platform may carry less operational burden than a rung-3 user self-hosting. Devops is a dial you choose, not a wall you hit. Nobody should stay off rung 4 out of fear of servers; choosing managed hosting is choosing to rent that burden out.

One decision wearing two hats — and it's a trust decision

Open-vs-closed weights and cloud-vs-on-prem look like two separate technical choices. In practice they are one decision wearing two hats, and the decision is about trust, not technology. Closed weights in the cloud: maximum capability, minimum operational work, minimum control — your data leaves, and you trust the provider's handling of it. Open weights on your own machines: maximum control — data never leaves — bought with operational work and, typically, some capability. Every configuration between the poles is a point on the same axis: how much do you need to control, and what are you willing to trust others with? Answer the trust question first — what data is in play, what happens if it leaks, whose rules govern it — and the technical configuration usually picks itself.

Track two

Reading the ladder in a managed workplace

The ladder itself does not change: five rungs, one moving part, judgment at every level. What changes is how the infrastructure & trust track lands on you. If you work somewhere with an IT department, approved tools, and acceptable-use policies, a large share of that track has already been carried by someone else — and a different share has quietly become more important, not less.

The reallocation rule, in one sentence

Anything you would have had to build or run, the organization has absorbed. Anything about what data moves where, you still own — and own harder.

The individual thesis shifts accordingly: less "everyone becomes a little devops," more ops-aware, governance-fluent.

What you can hold at recognition-only

Open vs. closed weights, cloud vs. on-prem. Someone above you already made this call when they chose the approved tools. Your one operational question: which tool is approved for which kind of work? — because that answer dictates everything below.
Quantization, containers, endpoints, environments, deployment, rollback, Git. The machinery of running software — run, in a managed workplace, by people whose job that is. Recognize the words; don't carry the pager.
Logging infrastructure — with one important inversion. You will never set up logging. But know that you are logged: prompts, connected-tool activity, and AI interactions on workplace systems are typically recorded. This isn't a threat; it's the flip side of rung 5's observability story. Behave, and paste, accordingly.
Secrets infrastructure. You won't run a vault. The personal rule survives at full strength: never paste a credential into an AI tool. No approved tool changes this rule.
Sandboxing. If agents run in your workplace, someone sandboxed them. Recognition is enough.

What you own harder than the general reader

The data question, promoted to the whole game. Rung 3's gate asked "can you state where your data goes?" In a workplace this becomes the central skill: for every approved tool, know what classification of data may enter it. Personal information, unreleased figures, contract terms, anything under NDA — each has an answer to "may this be pasted here?", and knowing those answers is workplace AI competence. When you don't know, the answer is "not yet — ask."
Exfiltration. The workplace version is mundane and constant: convenient-but-unapproved tools. The shadow-AI pattern — pasting work material into a personal account because the approved tool is clunkier — is a data-leaving-the-building event, however innocent it feels.
Injection, both kinds. Being in a managed environment protects you from none of this: you still read email, your tools still read documents, and rung-4 agents in your workplace still read the web. Recognizing injection-shaped anomalies stays a front-line skill at every desk.
Human-in-the-loop, reframed as policy. For some categories of work, per-action human approval isn't a rung you're passing through — it's a mandated stopping point. Where policy says a human approves, that approval gate is a load-bearing control someone placed deliberately. Treat "the AI could just do this part too" as a thought to raise, not a workaround to take.
Least privilege, from the other side. As an individual you learned to grant minimal access. As an employee you also live under it: your accounts and tools are scoped to your role. The fluency is understanding that limited access is design, not distrust — and that routing around it is the violation, even in service of getting work done faster.
Escalation. Every autonomy policy has a "must escalate" column; in a workplace, so do you. Knowing which decisions are yours and which must go to a person with the authority to make them — and treating handing-up as competence rather than failure — is the human half of rung 5's escalation machinery.

One caveat

This reallocation is role-dependent. If you build or operate systems for your organization, the full infrastructure track is yours at full weight — nothing here is abbreviated for you. The recognition-only compression applies to the majority whose job is to use AI inside the environment others maintain. And compression applies to attention, never to the reference: every term stays in the glossary at full definition.