, ,

Hammurabi, Four AIs, and the Oldest Security Policy You’ve Never Read

I was driving back from a client site last week, one of those engagements where you spend three days explaining to a room full of executives why their compliance program exists on paper but not in practice, when the BBC dropped an episode of In Our Time about the Code of Hammurabi into my podcast queue. I…

I was driving back from a client site last week, one of those engagements where you spend three days explaining to a room full of executives why their compliance program exists on paper but not in practice, when the BBC dropped an episode of In Our Time about the Code of Hammurabi into my podcast queue.

I almost skipped it. Ancient Babylonian law? I had threat models to review.

But something made me hit play, and by the time Martin Worthington described Hammurabi as “a thug, a conqueror, and one of these people who hoovered up smaller kingdoms,” I was hooked. Because I’ve met that guy. He was my CISO two jobs ago.

The World’s First Compliance Monument

Here’s the setup: around 1750 BC, a Babylonian king conquers half of Mesopotamia, then commissions a two-and-a-quarter-meter slab of black basalt carved with nearly 300 laws and parks it in a temple courtyard where judges hold court. The text is written in archaic script, rotated 90 degrees, eight feet off the ground. Almost nobody can read it.

That’s not a bug. That’s the feature.

Selina Wisnam, one of the scholars on the podcast, nails it: “The fact that there is so much text on this monument still makes a point… justice is something that is really valued and emphasized here.” The stela wasn’t a reference manual. It was a monument to the idea of authority, massive, permanent, divine.

I sat with that for a minute. Because I’ve seen its descendants in every organization I’ve ever assessed. The “Acceptable Use Policy” that nobody reads but everybody signs. The “This System is Subject to Monitoring” banner on the VPN login. The SOC 2 report that lives in a drawer until an auditor asks for it. Hammurabi didn’t invent law. He invented compliance theater. And he was magnificent at it.

The kicker? On the stela’s relief carving, Hammurabi stands face-to-face with Shamash, the sun god of justice, and they’re nearly the same height. His gaze is slightly above the god’s. No altar between them. No intermediaries. Just a mortal king staring down a deity like, “We’re peers here.”

That’s not prayer. That’s a power move.

Eye for an Eye (Terms and Conditions Apply)

Everyone remembers “an eye for an eye” from Hammurabi’s Code. What nobody remembers is the footnotes.

Blind a nobleman? You lose your eye. Blind a commoner? You pay a fine. Blind a slave? You pay half the slave’s market value to the owner. Steal an ox from your neighbor? Pay ten times its value. Steal from the palace? Thirty times. Steal from the gods? Death.

This isn’t primitive cruelty. It is graduated response scaled to impact. It’s a risk matrix carved in stone, literally. And the podcast’s experts make a fascinating case that the financial penalties for lower-status victims might have served them better than symbolic retribution. Losing an eye doesn’t feed your family. Silver does.

I’ve spent twenty years arguing with boards about risk-based enforcement, trying to explain why not every policy violation deserves the same penalty. Hammurabi figured this out while my ancestors were painting themselves blue and arguing about rocks.

Then there’s Law Number One. Not murder. Not theft. If you accuse someone of a crime and can’t prove it, you die. Think about that. The very first rule in the very first famous legal code isn’t about protecting people from criminals. It’s about protecting the system from false reports. Hammurabi understood signal-to-noise ratio in his alert pipeline four millennia before anyone coined the phrase.

The River Ordeal (or: When You Can’t Prove It, Escalate to God)

My favorite part of the podcast is the River Ordeal. When someone gets accused of witchcraft, and you can’t exactly subpoena a witness for that, the accused gets thrown into the river. Possibly while carrying a millstone. If you survive, you’re innocent. If you drown, the river has rendered its verdict.

Before you laugh, consider what this represents: a predetermined escalation path for unprovable edge cases. When the evidence is ambiguous, when the judges can’t adjudicate, when the system hits the limits of what human investigation can resolve, there’s a process. It has witnesses. It has procedures. It has defined outcomes. It’s awful by modern standards, but it’s not arbitrary. It’s a system.

Compare that to what happens in most organizations when an incident falls outside the playbook. I’ve watched SOC teams stare at an alert that doesn’t match any known pattern, escalate it to a manager who doesn’t understand it, who escalates it to a director who’s in a meeting, who tables it until the weekly review where it gets lost in a spreadsheet. Hammurabi’s process was brutal, but at least it had a defined SLA.

Martin Worthington mentions something almost offhand that stopped me cold: there’s a document from the period where someone refuses to swear an oath before the gods. In a society where divine authority was absolute, someone looked at the system and said, “No. I won’t play.” That’s the first recorded invocation of the Fifth Amendment, give or take three thousand years.

Building the Machine That Argues with Itself

So, I’m listening to all of this on the drive home, and I’m thinking: this podcast is dense. Three Oxford-and-Dublin scholars arguing about cuneiform for 53 minutes, layering insight on top of insight, each one catching things the others missed. One expert sees the legal structure. Another sees political performance. The third sees the literary tradition. And the host keeps pushing them past their comfortable talking points into territory where they must think on their feet.

That’s when it hit me. I’ve been building exactly this dynamic in code.

I have a project called llm_compare that pits language models against each other, independent analysis, adversarial critique, collaborative synthesis. What if I pointed that architecture at podcast transcripts? Not to summarize them (summaries are for people who don’t want to think) but to editorialize them. To have multiple AIs independently analyze the content, then tear each other’s analyses apart, then synthesize the strongest surviving arguments into something worth reading.

I built podcastorum in a single session. Four Python files. One pipeline.

Step one: local transcription. I have an RTX 5090 sitting under my desk doing nothing useful most of the day, so I pointed faster-whisper at the podcast audio with the large-v3 model running on CUDA. The entire 53-minute episode transcribed in a few minutes, no audio leaving the machine. Privacy isn’t a feature, it’s the architecture.

Step two: the fun part. Four LLMs, Claude, GPT-4.1, Grok, and Gemini, each independently analyze the transcript. Then each one critiques every other model’s analysis, looking for blind spots, weak arguments, missed connections, and factual errors. That’s twelve cross-critiques. Then a synthesizer takes everything, all four analyses, all twelve critiques, and produces one final editorial that incorporates the strongest insights and addresses the valid challenges.

Seventeen API calls. Four perspectives. One document that’s been stress-tested through adversarial debate before I ever read it.

What Four AIs Found That One Would Have Missed

The multi-model analysis of the Hammurabi episode turned up something I wouldn’t have caught on my own: the Code might not have been a law code at all.

The podcast’s scholars debate this extensively. Judges didn’t cite Hammurabi’s laws as precedent. There’s no evidence the Code was used as a legal reference in court. But there is evidence that Hammurabi himself followed its principles, one letter shows him ruling that a temple should ransom a kidnapped soldier, exactly matching what the Code prescribes. Fran Reynolds frames it as “the spirit of the law rather than the letter of the law.”

One model latched onto the legal analysis. Another zeroed in on the performance-of-authority angle. A third caught the literary tradition, that the if-then structure of the laws mirrors Mesopotamian omen texts (“if Mars is red, there will be a war”), suggesting the Code was as much about cosmic order as civic governance. The fourth pushed back on romanticizing any of it and pointed out that the system literally drowned people and treated slaves as property with a price tag.

No single model caught all of that. The adversarial critique phase forced each one to defend its strongest points and abandon its weakest. The synthesis wove the survivors into something richer than any individual take.

It’s almost like having three scholars on a BBC panel, arguing and building on each other’s expertise.

The Oldest Lesson in the Book (Literally)

Hammurabi’s empire peaked during his lifetime and collapsed shortly after his death. His son inherited the throne and watched the conquests unravel. The centralized, personality-driven governance model that made the empire possible was exactly what made it fragile. The system couldn’t survive its own succession plan.

I’ve seen this movie before. I’ve watched CISOs build extraordinary security programs around their personal authority and relationships, then leave, and the whole thing collapses within eighteen months because the program was a person, not a system. Hammurabi had divine backing, graduated punishment, spectacular documentation, and a monument visible from across the temple courtyard. It still wasn’t enough.

Personal charisma doesn’t scale. Centralized authority doesn’t survive transitions. Even divine mandates have expiration dates.

The podcast ends with the scholars joking about a “tea ordeal”, how far they’d have to swim to earn their cup. It’s a small, human moment after 53 minutes of wrestling with heavy ideas, and it captures something essential: these questions about justice, authority, and the limits of human systems aren’t abstract. They’re the same questions we ask every day, in every organization, in every security program. We just don’t usually carve the answers in stone.

Maybe we should. At least then someone 4,000 years from now might read them, tilt their head 90 degrees, and think: “They were trying. They got some of it right.”


The Hammurabi analysis was generated by podcastorum, a tool that transcribes podcasts locally and runs multi-LLM editorial analysis. The podcast is BBC In Our Time: The Code of Hammurabi. The opinions, such as they are, are mine.

Leave a comment