The last mile of AI work

The hard part moved, and it is easy to miss, because it moved somewhere unglamorous.

Getting a machine to write a genuinely useful report — a claims loss analysis, an infrastructure audit, a weekly finance pack — went from impossible to ordinary in about eighteen months. It will keep improving without any of us doing anything.

Getting that report to the six people who need to read it has not improved at all. It works the way it worked in 2010, because it is the same act: a file, a host, and a link pasted into an email.

That gap is what we are building for. This post is the argument that it is a real gap and not a positioning exercise.

What everyone actually does

You ask your agent for the quarterly pack. It produces a good, self-contained HTML page. Genuinely good — charts, structure, the lot.

Then: download it. Find somewhere to put it. Work out who should be allowed to see it, and settle for anyone with the link, because that is the only access control the host actually offers. Paste the link into an email.

Next Friday the numbers move. Publish again, at a new address, send a second email. Now two links exist and only one of them is right, and the person who matters most has the other one open in a tab.

Nobody in that story did anything wrong. That is the whole point. It is what a file and a host give you.

Four things break

The link is the credential. Whoever holds it is authorised, and nothing about that is revocable. It gets forwarded to a colleague, then to their personal address, then it sits in an inbox that is still being read three jobs later. You will never know, because there is nothing to know it with.

The version and the address are the same thing. Every update is a new URL. That means every update is also a new email, a new "sorry, use this one", and a small permanent uncertainty about which numbers anyone is looking at. The document is alive; the link is not.

There is no record. Not for compliance — for the ordinary question of whether the thing you spent Thursday on was read by anybody. Storage does not know who opened a file. It cannot; that was never its job.

Generated work leaks in a way handwritten work does not. An agent that reads your infrastructure in order to audit it can paste a key into the audit. It is not being careless — the key was in the material and the material was the input. This is the failure mode nobody plans for, because for thirty years the author of a document was a person who knew what a secret looked like.

That last one is why every publish here is scanned before it reaches anybody, and why some findings stop the publish outright rather than warn: AWS access keys, private key blocks, GitHub and Slack tokens, live Stripe keys, OpenAI and Anthropic keys. A version that trips one of those is kept in the history as a record that it happened, and has no button anywhere that puts it back in front of readers.

Why the obvious answers do not close it

A shared drive. Hands your reader a download rather than a page, so the report you spent effort on arrives as a file icon. Access is per-file and set by hand. And no agent is going to keep it tidy for you.

A static host. Publishes to the world. The access control on offer is an unguessable URL, which is the problem restated rather than solved.

A wiki or docs tool. Good at documents people type. Poor at a 300 KB generated page with its own layout, and the version people see is whatever someone last pasted in.

Emailing the file. Every recipient now holds a copy that can never be corrected.

Each of these is good at the thing it was built for. None was built for a document a machine will rewrite next week, read by named people, some of whom do not work for you.

The shape we think is right

Four properties. Any one of them exists somewhere already; having all four at once is the only part we would claim as ours.

1. Publish to people, not to URLs. A report is sent to a named person, a team, or a verified guest. Access is evaluated every time it is opened, so forwarding the link forwards nothing.
2. One address, every version. Share it once. You and your agents keep changing what sits behind it. Nothing is overwritten — every version is kept, and you can put an old one back or freeze what readers see while work continues underneath.
3. Every open is a decision, and the decision is written down. Who opened it, when, which version they got.
4. Nothing leaves without being read for secrets first.

None of that asks anything of your reader. They still get a link. It simply asks who they are.

What this is not

We have a section on the home page listing what is not built, and it stays there for a reason, so here it is again plainly.

Deliverd does not write your report. It has no opinion about which model you use, and the open-source skill we publish for building good HTML artifacts works with no account here at all.

It is not a BI tool. A report is a snapshot that you or an agent republish. Making a published report query live data on its own is the largest thing on our list and it is not built.

SCIM provisioning, OpenID Connect, and first-party Slack and Teams apps are not built either. Outbound webhooks work today and are how people wire up notifications in the meantime.

Tell us what we have wrong

We are a small team and we would rather be corrected early than politely ignored.

If the delivery step in your setup hurts somewhere we have not described — or if you read the four properties above and thought that is not my problem at all — we would like to hear it. Get in touch, or leave a comment on any report you publish; we read those too.

If you want to try the version of this that takes about a minute, the setup prompt is in the welcome post, and the CLI, API and MCP server are on the developers page.