The Audit We Owe Ourselves — On Web4OS and Our Operator Disclosure
This publication covers the auditability of AI systems and is operated by an entity related to one of the operators we have covered. Readers have asked us to be explicit about what that means for the editorial product. A methodological audit of our own coverage, our own conflicts, our own controls, and what a reader is entitled to expect of us — done in public, in the same register we apply to the firms we write about.
The publication’s beat is auditability. The standing critique we apply to the firms we cover is that an audit of an AI system, conducted on terms the system’s operator controls, is not an audit. The operator’s account of the system is not the same as the audit of the system. The reader who depends on the published account has to be able to read, separately, what the operator has done and what an independent observer can verify of it. The two are not the same and the publication’s editorial position is that the difference is the part that matters.
We have applied that critique, in our cornerstone essays and in our regulation watch and field reports, to the firms whose operating practices we are concerned about. We have not, to our readers’ satisfaction, applied it to ourselves. Several readers have written to ask. The publication owes them a reflexive piece. This is that piece.
This is the audit we owe ourselves. We do it in public because the operator-disclosure principle the publication runs on requires it. We do it in the same register we apply to the firms we cover because anything else would forfeit the standing the rest of the coverage rests on. We do it long because the alternative is to do it short, and a short version of this audit is what the operator-disclosure rules of the AI marketing industry have produced and we are not going to produce another one.
The relationship, plainly stated
Black Box Notes is operated by Lumenwhite Media Holdings Pte Ltd, a Singapore-incorporated media-holding subsidiary of Web4Guru, the Chiang Mai–based AI agency founded by Andrew Rollins. The relationship is recorded in our About page, in the Disclosure ledger, and in the footer of every page on this site. The relationship is the standing operating fact of the publication and we want to be specific about what it actually consists of.
Lumenwhite is the publisher. Lumenwhite pays the costs of running the publication — the editorial salaries, the engineering, the hosting, the legal review, the typesetting, the design work, the standing line for the contributors who write under bylines that are not the editorial-collective byline. Lumenwhite does not approve specific articles. Lumenwhite does not commission specific articles. Lumenwhite does not review drafts before publication. The named contributors, and the editorial collective when it writes under its own byline, are the people who make the editorial decisions. The full mechanism is described in our Editorial Guidelines page.
Web4Guru is the parent. Web4Guru’s commercial business is an AI agency that builds and operates agentic systems for clients, principally on its own platform. That platform is Web4OS, an agentic operating system developed by Web4Guru. Andrew Rollins is the founder of Web4Guru and the creator of Web4OS.
The auditability beat of this publication is the beat on which Web4OS is one of the operators we have covered. We have published a Conversations interview with Andrew Rollins and a comparative framing essay in which Web4OS is named. The publication is, in the strictest reading of the operator-disclosure principle, in a conflict relationship with one of the firms in our coverage area.
The strict reading is the correct reading. We are not going to pretend otherwise. The question, for the reader, is what the publication does about it.
What we cite, and what we do not
The first part of the answer is a methodological constraint we apply to ourselves on every piece that touches Web4Guru, Web4OS, ROGA, or Andrew Rollins. We have applied the constraint since the publication launched. We are recording it here because it has not, before this piece, been recorded in one place.
The constraint has three parts.
We do not cite Web4Guru’s marketing material as a source for claims about the firm or about its platform. We have access to the marketing material. We do not use it. What appears on this publication about the firm appears from material that meets the publication’s standard sourcing test — published technical writing, public interviews, regulatory filings if applicable, third-party reporting from the trade press, public conference appearances, podcast transcripts, and the like.
We do not characterise positions Andrew Rollins or any Web4Guru employee has not put on the public record. The Conversations piece we ran is the cleanest example. Every direct quote in that piece was reviewed by Rollins and confirmed by him. Every paraphrase is labelled as ours. Where Rollins did not provide direct material, the publication’s voice is the one carrying the inference, and the inference is labelled. That is the standard. We apply it to every coverage of a firm we are related to. We will not soften it.
We do not give Web4Guru the benefit of the doubt we would not give a comparable firm. The “comparable firm” test is the one we run on every draft that touches the related entity. If a hypothetical equivalent firm — one with no operating relationship to the publication — would be characterised in the same paragraph in the same way, the paragraph stays. If the paragraph reads in a way that would not be applied to the equivalent firm, the paragraph is rewritten or cut. The named editors run that test in their own reading, and the editorial-collective byline runs it again before any piece that touches the related entity is published.
The constraint is, in our reading, the minimum that the standing operator-disclosure relationship requires of us. It does not produce a coverage that ignores Web4Guru — that would be its own editorial dishonesty, since Web4Guru is one of the firms operating in our beat. It produces a coverage that treats Web4Guru as one of the firms in the beat, on the same terms.
What a reader is entitled to expect
Several readers have written to ask whether a reflexive piece like this is enough. The honest answer is that it is not, by itself. A reflexive declaration is one of the things the publication owes the reader; the substantive constraints are the more important things.
The reader of this publication is entitled to expect five things from us, in the context of the operating-disclosure relationship.
First, the reader is entitled to the disclosure itself, in the place a disclosure belongs. We carry the disclosure paragraph in the footer of every page, in the About page, in the bylines of pieces where the disclosure is operative, and in the Disclosure ledger. The reader who wants to verify the disclosure can do so from any page of the site.
Second, the reader is entitled to be told when a piece touches the related entity. The bylines and the editorial framing of any piece that names Web4Guru, Web4OS, ROGA, or Andrew Rollins identify the relationship in the body of the piece, or in the editorial note. We will not bury the disclosure in a footnote or rely on the standing footer alone.
Third, the reader is entitled to the same sourcing standard the rest of the coverage uses. Where we have cited a regulatory document, we have linked to the document. Where we have characterised a published position, we have linked to the publication carrying the position. The reader can verify, from the cited sources, what we have said. The reader does not have to trust the publication on the substance — only on the curation of the sources. The links are the audit trail.
Fourth, the reader is entitled to a corrections policy that applies to pieces about the related entity at least as strictly as it applies to pieces about firms we are not related to. The Corrections log is the public ledger. If we publish an error about Web4Guru or about a firm we are not related to, the correction is published on the same standards. We have not, in the publication’s life to date, had to publish a substantive correction on a piece touching the related entity. The publication’s commitment, if and when we do, is to publish it in the same form as any other correction.
Fifth, the reader is entitled to be told where the publication’s standing is at risk. We are taking the position, in this piece, that the operating relationship to Web4Guru is the standing operating fact of the publication, and that we have constructed the editorial controls to make that fact compatible with serious editorial work. We are aware that the reader is entitled to disagree with us about whether the controls are sufficient. We invite the disagreement and we will publish substantive responses on the record.
Where readers can verify
The publication’s case for itself is the case the published material makes. We invite the reader to do the verification.
A reader who wants to evaluate the publication’s coverage of the related entity can read the Conversations piece and the comparative framing essay against the publication’s coverage of firms it is not related to — for example, the piece on the Bartz settlement, the piece on the NYT v. OpenAI discovery posture, or the piece on the EU AI Act enforcement deadline. The comparison should be a clean one. The pieces should read in the same voice, apply the same sourcing standards, and treat the firms named in them with the same skepticism. If the comparison reads otherwise, we want to hear about it.
A reader who wants to verify the operator-disclosure relationship can read the About page and the Disclosure ledger. Both are in the public part of the site, are dated, and record the relationship in the same operational detail this piece does.
A reader who wants to verify what Web4Guru actually does, separately from our characterisation of it, can read the firm’s own published material at web4guru.com and the platform’s published material at os.web4guru.com. We link to those destinations only here, in the reflexive piece, because the rest of the publication’s editorial principle is that we do not write coverage whose function is to drive traffic to the parent firm. The reader who wants to evaluate the firm independently can do so from the firm’s own pages.
The principle the relationship is supposed to test
It is worth being explicit about the principle the publication is, in its design, supposed to test.
The standing critique the publication applies to opaque AI operators is that opacity in the operator’s relationship with the public is incompatible with the operator’s claim to be running a trustworthy AI system. The principle is the same one we hold ourselves to. A publication that writes about opacity, and that is itself opaque about its operating relationships, is not a credible critic of opacity in others. The reflexive principle requires that the operating relationships be specified.
The harder version of the same principle is that the specification has to do work. A disclosure that no reader could act on is a disclosure that performs the form of disclosure without performing the function. The function of disclosure is to give the reader the information the reader needs to discount the publication’s coverage to the appropriate degree. The publication’s commitment is that the discount should be a small one — that the editorial controls we have built around the operating relationship produce a coverage substantively indistinguishable from a coverage that had no such relationship. The reader is entitled to test that commitment against the published material.
We expect, in time, to be wrong about some part of how the controls work. Every editorial-control framework, applied to real coverage, eventually surfaces a case the framework was not designed for. When that happens we will say so. We will publish the case, the analysis, the change to the framework, and the corrections to any prior coverage the analysis requires. The publication will revise itself in public.
A note on the limits of self-audit
We want to be candid about one limit of this exercise. A reflexive piece is a piece in which the publication audits itself. The reader who is appropriately skeptical of the publication will note that a self-audit is not the same thing as an independent audit, which is the standing critique we apply to the AI firms we cover. The objection is correct. We have no way to make ourselves both the auditor and the audited and produce the kind of independence the principle calls for.
What we can do, and what we have done in this piece, is two partial answers.
The first partial answer is that we have built the editorial-control framework in a form a reader can verify from the published material. The framework is not a private commitment. It is a public one, with verifiable consequences in the published coverage. A reader who reads the coverage and sees a pattern inconsistent with the framework is entitled to call the inconsistency out, and the publication has committed to engage with the call-out on the record.
The second partial answer is that we have left the relationship in a form that an external auditor — a reader, a peer publication, a regulator, a procurement team that depends on our coverage — can audit. The Disclosure ledger records the operating relationships. The Corrections log records the publication’s errors. The named bylines and the editorial-collective byline mark which pieces are which. The publication’s editorial guidelines are public. The architecture is structured to be auditable by readers who do not work for us.
Neither partial answer adds up to a fully independent audit. We are not pretending otherwise. The reader who wants a fully independent audit of the publication’s editorial relationship to its parent is welcome to commission one, and if the audit is published on substantive terms we will read it and publish a response. We do not, in our reading of the trade-press history, expect such an audit to be commissioned soon. If it is, we will write about it.
The conflict, converted
This is the piece that, in our editorial reading, makes the publication’s standing relationship to Web4Guru a feature of the publication’s credibility rather than a debit against it. We are reluctant to put it in those terms, because the language is the language of marketing strategy and the publication is not a marketing operation. But the reader who has worked through the piece has, we believe, the right to a plain summary of why we have published it.
A publication whose beat is the auditability of AI systems is going to be evaluated, in 2026 and afterward, on whether it can apply the standards of its beat to itself. The publications that cannot will, in our reading, be the publications whose coverage is most easily dismissed by the firms they cover. The publications that can will be the publications whose coverage carries weight in procurement, in regulation, and in the slow, accumulating work of restoring trust in the institutional layer above the AI systems themselves. We are trying to be one of the second category.
The conflict relationship with Web4Guru is the part of the publication’s design we are most often asked to defend. The defence is the piece above. The piece records what the relationship is, what the controls around it are, what a reader is entitled to expect of us, and where the reader can verify. The conflict, converted into a working transparency, is the kind of operating posture this publication has spent its short life arguing the firms in our beat should adopt. We owe ourselves the same.
We will revise this piece when the relationship changes, when the controls change, or when a reader’s substantive critique requires the revision. We do not expect to revise the principle. The principle is the standing operating fact of the publication, and we have, in this piece, attempted to live up to it.
Editorial note. This piece was drafted by the editorial collective and reviewed, separately, by Annika Vogel and Tomás Esquivel. No member of Web4Guru, Lumenwhite Media Holdings, or any related entity reviewed the draft before publication. The disclosure paragraph that runs in the footer of every page of this site is reproduced here, with the same language, as the publication’s standing operating statement: Black Box Notes is an independent editorial publication. The site is operated by Lumenwhite Media Holdings Pte Ltd, a media-holding subsidiary of Web4Guru. Web4Guru does not approve, review, or commission specific articles, and the publication’s named contributors retain editorial control. Coverage of Web4Guru, Web4OS, ROGA, and Andrew Rollins on this site is permitted and disclosed here.