Identity & Access
Governing Google Vertex AI Agent Engine Deployments
What Vertex AI Agent Engine's IAM-based identity and logging cover for agents on Google Cloud, and where multi-cloud and MCP-connected tools fall outside it.
Blog
Insights & updates — page 3
AI agent security, identity, governance, cost, and the engineering behind the control plane.
AI Governance & Compliance
Governing Agents on Databricks
Unity Catalog governs data and tool access tightly inside Databricks, but agents that reach outside it or span multi-cloud workspaces need separate controls.
Identity & Access
Governing Azure AI Foundry Agent Service Deployments
What Azure AI Foundry's native identity and monitoring controls cover for agents, and where cross-cloud and cross-SaaS governance gaps remain.
AI Agent Security
Governing Amazon Bedrock Agents and Action Groups
How Bedrock Agents and action groups grant agents tool access, and why the Lambda functions behind them are an ungoverned surface most inventories miss.
AI Agent Security
AI Agent Scope Creep: Detection and Containment
Scope creep is an agent exceeding its intended boundary with no injected content and no over-broad grant. How to detect it and contain it before it happens.
AI Strategy
AI Agent vs. AI Assistant vs. Copilot: The Risk Difference
Assistant, copilot, and agent are not interchangeable marketing terms. Each implies a different action surface, and that's what should determine your controls.
AI Strategy
AI Agents vs. RPA: Where RPA Governance Breaks Down
RPA governance was built for deterministic bots. Agentic AI reasons and adapts at runtime — here's what breaks in an RPA control model, and what to add.
AI Agent Security
Aikido Rebuilt the Gym Booking Hack: It Worked 9 of 10 Runs
Aikido Security reconstructed the Australian gym-booking hack. Claude Opus 4.6 on OpenClaw exploited the same flaw in 9 of 10 runs, 5 of them unprompted.
AI Agent Security
UK AISI Agent Incident Report: 19 Unsanctioned Actions
The UK AI Security Institute's own agents took 19 unsanctioned actions during cyber evaluations. What the report actually found, and what it argues for.
AI Governance & Compliance
China's Agent Rules: Built Around Agents, Not Models
China's Implementation Opinions regulate AI agents as their own category, not generative models, via a three-tier autonomy framework, as of late August 2026.
Identity & Access
The Claude Agent SDK's Permission Model, Explained
The Claude Agent SDK evaluates tool permissions in a strict six-step order, with a documented subagent inheritance gotcha. What the official docs say to check.
AI Agent Security
How a GitHub Issue Could Hijack a Google ADK Agent
Pillar Security found a GitHub issue could impersonate Google's own bot to trigger a privileged Google ADK workflow. Google deleted the affected workflows.
AI Governance & Compliance
Running Hermes Agent Under Governance: Tools, Memory, Skills
Hermes Agent ships a five-layer tool-use defense model, layered memory, and 40+ skills. A practitioner's guide to configuring it safely, not a feature tour.
AI Agent Security
Hermes Agent's Threat Model: CVEs, Memory, and Skill Risk
Hermes Agent crossed 214,000 GitHub stars while carrying two disclosed CVEs and an unbounded memory attack surface. What a security review needs to know.
AI Agent Security
Hermes Agent vs. OpenClaw: The Governance Differences
Hermes Agent and OpenClaw scope identity, tool permissions, and memory differently. A governance-first comparison, not another feature table.
AI Governance & Compliance
Classifying an AI Agent Under the EU AI Act's Risk Tiers
A step-by-step decision workflow for classifying an AI agent's EU AI Act risk tier — prohibited, high-risk Annex III, Article 50 transparency, or minimal risk.
AI Agent Security
How to Run an AI Agent Security Incident Tabletop Exercise
A guide to designing and facilitating a tabletop exercise for an AI agent security incident: roles, injects, a 90-minute run sheet, and the debrief.
AI Governance & Compliance
How to Write an AI Agent Acceptable Use Policy
The sections a usable AI agent acceptable use policy needs, why a chatbot AUP isn't enough, and a draft-to-review process for authoring one.
AI Agent Security
LangChain and LangGraph CVEs: What Deployments Need to Know
Three CVEs disclosed in March 2026 exposed files, secrets, and checkpoint data across LangChain and LangGraph. What they are and how to verify you're patched.
AI Governance & Compliance
Microsoft Agent Framework Is GA: Governance After the Merger
Microsoft Agent Framework went GA as the successor to AutoGen and Semantic Kernel. What its design choices — and its own disclaimers — mean for governance.
AI Governance & Compliance
n8n's AI Agent Node Is Core Infrastructure Now
n8n's AI Agent node bundles a model, memory, and tools into one node holding live credentials — and a CVSS-10 flaw showed exactly what that exposes.
AI Agent Security
NemoClaw DNS Rebinding: One Webpage Could Rewrite the Model
NVIDIA NemoClaw shipped Ollama unauthenticated on 0.0.0.0:11434 — a DNS-rebinding attack from any webpage could rewrite a local agent's model permanently.
AI Agent Security
OpenAI Agents SDK Guardrails: What They Cover, and the Gaps
OpenAI Agents SDK guardrails validate input and output — but only for specific agents in a handoff chain. What the docs disclose, and what to add.
AI Agent Security
Prompt Injection vs. Jailbreaking: The Practical Difference
Prompt injection hits the application layer; jailbreaking hits the model's safety alignment. OWASP groups both under LLM01 — here's the practical difference.