AI Governance & Compliance
How to Keep PII Out of Agent Prompts and Logs
Keep PII out of AI agent prompts, responses, and logs using detection-and-redaction controls that satisfy GDPR, HIPAA, and audit requirements.
Blog
Insights & updates — page 10
AI agent security, identity, governance, cost, and the engineering behind the control plane.
AI Agent Security
Secrets Management for AI Agents
Keep API keys and credentials out of agent prompts and source code. The four pillars of secrets management: storage, delivery, access control, and rotation.
AI Agent Security
Governing Agents Built on the Vercel AI SDK
The Vercel AI SDK standardizes model calls and tool invocation for web apps. Identity, authorization and spend controls are the layer around it.
AI Agent Security
Code-Writing Agents: The Risk Profile of smolagents Design
Code agents write and execute Python to act, instead of calling predefined tools. That design choice trades a smaller interface for a larger one.
Identity & Access
RBAC vs ABAC for AI Platforms
RBAC governs who can configure agents; ABAC governs what agents can do per request. Learn which model fits each authorization decision on an AI platform.
AI Agent Security
Governing Pydantic AI Agents: Type Safety Is Not a Guardrail
Pydantic AI validates a model's output shape; authorizing the action it triggers is a separate layer. Where type safety ends and governance begins.
AI Agent Security
Governing Mastra Agents and TypeScript Agent Workflows
Mastra gives TypeScript teams agents, durable workflows and memory. Identity, authorization, and spend controls sit in the layer around it.
Identity & Access
How to Implement Least Privilege for AI Agents
Apply least privilege to AI agents with scoped credentials, per-connection policies, and delegation constraints that shrink your blast radius.
Identity & Access
Governing LlamaIndex Agents: Data Access and Retrieval
LlamaIndex builds and queries indexes over your documents. Authorization for who can query what is the layer around it — here is where that boundary sits.
AI Strategy
Self-Hosted vs Managed AI Governance
Self-hosted AI governance gives full data residency control; managed shifts operational burden to the vendor. How to choose for your team.
Identity & Access
Governing Haystack Agents in Enterprise Search
Haystack pipelines power enterprise search and RAG agents — but a retriever without document-level ACL enforcement will surface what the index holds.
AI Agent Security
Governing Flowise and Langflow Visual Agent Builders
Flowise and Langflow turn LangChain-style chains into drag-and-drop flows. The governance gap is the same as code-first LangChain, plus a review gap.
AI Governance & Compliance
Governing Dify and Low-Code Agent Platforms
Low-code platforms like Dify let anyone assemble an agent with tool access in minutes. That speed is the governance problem, not a side effect of it.
Platform & Operations
How to Monitor MCP Tool Calls
Gain full visibility into every MCP tool call an AI agent makes — with attribution, policy decisions, and cost data needed for security and compliance.
Platform & Operations
Orchestration Patterns for Multi-Agent Systems
Compare pipeline, hub-and-spoke, and blackboard orchestration patterns for multi-agent AI — with security, cost, and auditability trade-offs for each.
AI Agent Security
How to Govern CrewAI Agents: Controls for Crew-Based Systems
CrewAI orchestrates role-based agent crews in-process. Here is what it controls, where the governance gap sits, and what to add externally.
AI Strategy
Choosing an Agent Framework: Governance Criteria That Matter
Agent frameworks are built to orchestrate, not to govern. Evaluate identity, authorization, spend, audit, and sandboxing separately before you commit to one.
AI Agent Security
Agent-to-Agent Protocols and Interoperability
How to design safe A2A interoperability: agent cards, secure discovery, scoped credentials, and cross-org trust — in under 8 minutes.
AI Governance & Compliance
Texas TRAIGA: A Compliance Checklist for AI Operators
Texas's TRAIGA is already in force and applies broadly, with no size threshold — a practical checklist for teams operating AI agents that reach Texas users.
AI Governance & Compliance
PCI DSS and AI Agents Touching Cardholder Data
How PCI DSS's core requirements apply when an AI agent touches cardholder data, and the controls that keep it out of scope where possible.
AI Governance & Compliance
Human-in-the-Loop Approvals for High-Risk Agent Actions
Human-in-the-loop approvals pause AI agents before high-risk actions, preserve throughput with async queues, and build an auditable approval trail.
AI Governance & Compliance
NIS2 Obligations for AI Platform Operators
How the EU's NIS2 Directive's risk management, incident reporting, and supply-chain duties apply to organizations operating AI agent platforms.
AI Governance & Compliance
New York's RAISE Act: Obligations for Frontier AI Developers
New York's RAISE Act targets frontier-model developers with safety-framework and incident-reporting duties — who it reaches and what to build regardless.
AI FinOps
Cost Control for LLM Applications
Where LLM costs hide in agentic applications, how to attribute them per agent and run, and the reservation-based enforcement that stops overspend at dispatch.