Jean-Luc Martel

Jean-Luc Martel works on technology for regulated financial institutions and writes Load Path Research: the review docket and the blog.

Jean-Luc Martel works on technology for insurers, wealth managers and pension funds, across engineering, data science, architecture and operations. Much of that work is build-operate-transfer: he builds a capability, runs it, and then hands it over to the team that will keep it going.

Handing a system over shows quickly which security controls are real. If nobody can explain exactly what a control does, it cannot be passed on. And when the architecture diagram and the deployed system disagree, the next team to operate it finds out first.

That is where the reviews on this site come from. Each one takes a common claim, such as “the API gateway handles authorization” or “the KMS is our key management”, and shows where the mechanism stops short of the security property people expect from it. These mix-ups are rarely dishonest. They happen when a tool is bought to close an audit finding that was written in the vocabulary of tools.

The blog is less formal. It covers the operational side of security in a large organization: recovery, backups, vendors, change control, offboarding, and the accounts and systems nobody quite owns. The same questions now apply to AI agents, which act through tool access and permissions that the model itself does not govern.