Six lines an FDE should not cross

A forward deployed engineer sits closer to the customer's data, decisions and people than any other role a vendor sends. That position is the reason the ordinary ethics of a services firm are not enough. The ordinary rules cover what you may do; they say little about what happens when doing it well makes something worse.

The six lines below are the ones this job actually tests, in roughly the order they come up. Each has a field version, because the abstract version is agreed to by everyone and therefore changes nothing.

The lines sit in layers

Three layers, and they compress differently. Commercial ethics — confidentiality, authorisation, data handling — compresses under pressure: a deadline, a renewal, a friendly request. Anything touching physical safety compresses but cannot be skipped. Anything touching your own safety is not negotiable at all, and the narrower layers give way to the wider ones in that order.

Nearly every line in this piece lives in the first layer, which is exactly why it gets crossed. Nobody arrives intending to sell out. They arrive at a meeting where a reasonable-sounding trade is available, and the trade is available because the line was never written down anywhere but in someone's head.

The six

Data ownership stays with the customer. The field version: an export pulled onto a personal laptop because the VPN was slow on a Friday, and a copy kept after handover because it might be useful on the next account. What actually happens is rarely a leak. It is the afternoon when the customer's security team asks for a data map and it has to be reconstructed from memory and a mail archive. The rules that prevent this are unglamorous and belong in writing before the first export, not after the first question.

Reporting includes the bad news. The field version: a weekly readout that lists what got built and leaves out the one metric that moved the wrong way; a status of "80% done" that hides the missing 20% being the part acceptance depends on. Bad news does not disappear when it is omitted. It arrives later, with interest, in the quarter when the sponsor has to defend the budget — and it arrives without you in the room to explain it.

Do not manufacture dependency, and do not sell fear. The field version: the only runbook living in one person's memory, a hand-run script nobody else can execute, a competitor's announcement used as a closing argument. The short-term effect is a renewal that feels safe. The medium-term effect is an account held hostage: when the person who kept it running moves on, the contract goes with them. The sunset clause and handover exist to make the exit legible before anyone needs it.

Treat the people being replaced as people. The field version: a home-improvement company with six thousand staff asking whether AI can take it down to three thousand. The honest answer is that this technology replaces tasks long before it replaces jobs, and that a role becomes replaceable only when something like eighty percent of its core work can be done reliably — for a legal function, contract review is assistable while negotiation, filing and cross-department coordination still need a person. The dishonest move is agreeing to the number and letting a pilot decide who. What happens then is not abstract: the people who must adopt the system are the ones whose jobs are being priced, they will be the last to trust it, and the deployment dies of the thing it was hired to cause. The division of labour is where that boundary gets drawn honestly.

Say no to what the customer asks for and should not have. The field version: scraping a competitor's portal, or wiring the system to send commitments to end customers without review. A refusal costs one contract; compliance costs the firm. The refusal only counts if it carries two things — evidence rather than preference, and a willingness to absorb the consequence — otherwise it is an opinion with a tone. It also works better with a step attached: not "no", but "not this, until the output has a reviewer and a rollback".

You represent the technology itself. The field version: an engineer who quietly fixes the system's outputs by hand every week, so the customer concludes the tool works and never learns that a person is inside the loop. When the engineer leaves, the same customer concludes that AI does not work. Either way the lesson is wrong, and the second wrong lesson is the expensive one, because it is the one that gets repeated at conferences.

How the lines actually get crossed

Three compressions do most of the damage, and all three sound reasonable when spoken aloud: it is just this once; the customer asked for it; we will fix it after go-live.

The countermeasure is not willpower. It is making each line into a written artefact before the pressure arrives: a retention period for copies, a fixed content list for the readout that includes the metric that failed, a named reviewer for outputs that leave the building, a handover date. A line that exists only in your head gets renegotiated in a meeting where you are the only person who still remembers it. The incident path is where the reporting line gets its most expensive test, at two in the morning, with a customer waiting.

The objection worth taking seriously

One reading says a refusal is a luxury: a junior engineer with a visa, a mortgage or a probation period cannot afford to say no, so advice to refuse is advice written by people with savings. That is correct as a description of individual risk, which is why the line has to be structural rather than personal. Put the boundary in the annex and the refusal becomes a clause the customer already agreed to; leave it out and the refusal becomes a career decision made alone, at the worst possible moment.

The test

For each of the six, name one thing you did in the last month that would survive being written into the readout. A line with no evidence in the last month is not a line yet; it is a preference.

Then the exit test: if the project ended tomorrow and the customer described your work to a colleague, would you recognise the description? The gap between that account and your own is where the lines get crossed, and it is usually visible a month before anyone complains.