# Reading list

> The sources the framework leans on: the adjacent disciplines, the security and governance regimes, and the evidence behind the theses.

Source: https://brocs.fyi/resources/reading/
Framework: BROCS (Build, Run, Observe, Control, Secure), brocs.fyi. CC BY 4.0, attribute to brocs.fyi.

---


BROCS borrows more than it invents, and this page is the borrowing made explicit.
Primary sources over commentary, free over paywalled wherever a free canonical exists,
and each entry says which letters it feeds. If a claim on this site does not trace to
something here or to a source in the [failure-mode library](/resources/failure-modes/),
tell us and it will be sourced or cut.



## The adjacent disciplines

BROCS borrows more than it invents. These are the bodies of work each letter leans on, and the fastest way to get strong at a letter is still to read its discipline.

- **DORA research program** (build): The delivery-performance metrics BROCS borrows directly, lead time above all. Years of evidence that speed and stability are not a trade-off, which is also the right frame for AI enablement. https://dora.dev/research/

- **Google SRE books** (run, observe): Free, canonical, and still the best writing on error budgets, golden signals, toil, and being on call. The Observe and Run letters assume this vocabulary. https://sre.google/books/

- **The FinOps Framework** (secure): Inform, optimise, operate. The cost half of Secure is FinOps applied to inference, and the framework transfers with one amendment: monthly is too slow. https://www.finops.org/framework/

- **Platform engineering community** (build, run): The paved-road, platform-as-product school BROCS leans on hardest. If your organization has no platform practice, start here before starting with AI. https://platformengineering.org/blog

## Security and governance

The Secure letter's homework. The first two are the references for what actually goes wrong; the second two are the regimes the evidence has to satisfy.

- **OWASP Top 10 for LLM Applications** (secure): The community consensus on LLM-specific failure classes: prompt injection, insecure output handling, excessive agency. The vocabulary your security review should be conducted in. https://genai.owasp.org/llm-top-10/

- **AI Incident Database** (secure, observe): The closest thing the field has to an aviation-style incident registry. Several entries in the failure-mode library cite it; browsing it is a fast way to calibrate what actually happens versus what gets speculated about. https://incidentdatabase.ai/

- **NIST AI Risk Management Framework** (secure): Govern, Map, Measure, Manage. Voluntary, widely referenced, and maps cleanly onto the surface: Map and Measure land on Observe, Manage on Control, Govern on Secure. Speak both vocabularies and audits get shorter. https://www.nist.gov/itl/ai-risk-management-framework

- **EU AI Act (Regulation 2024/1689)** (secure): The primary text, not a summary. The operational consequence for engineering teams is record-keeping, which is the agent trace with a retention policy. The implementation-tracker at artificialintelligenceact.eu is the readable companion. https://eur-lex.europa.eu/eli/reg/2024/1689/oj

## Evidence for the theses

The numbers and cases the site cites, so you can check the homework and reuse it in your own decks.

- **Cisco 2024 Data Privacy Benchmark Study** (secure, build): The shadow AI numbers: 48 percent of organizations admitted entering non-public company information into generative AI tools, 27 percent banned the tools at least temporarily. A survey of 2,600 privacy and security professionals. https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m01/organizations-ban-use-of-generative-ai-over-data-privacy-security-cisco-study.html

- **Wiz Research: the exposed DeepSeek database** (run, secure): The reference case for vendor-side risk: over a million log lines, chat history, and API keys on an unauthenticated ClickHouse. What your builders send to an endpoint lands in someone's logs. https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak

- **EchoLeak: zero-click prompt injection in production (arXiv:2509.10540)** (secure): The first documented zero-click prompt injection exploit in a production system, written up properly. The reason "untrusted content is an instruction channel" is a design constraint rather than a talking point. https://arxiv.org/abs/2509.10540

- **Moffatt v. Air Canada, 2024 BCCRT 149** (control, secure): The tribunal decision itself: a company is liable for what its chatbot tells a customer. Short, readable, and the strongest single argument for a retrieval boundary that legal has ever handed engineering. https://s3.amazonaws.com/IGG/AI+Part+1+-+Materials/Moffatt+v.+Air+Canada.pdf