AI Governance & Compliance
BYO KMS and Per-Tenant Signing Keys
Per-tenant signing keys in a customer-controlled KMS change what a platform compromise can do and what a tenant can prove. The options, trade-offs, and cost.
Blog
Insights & updates — page 4
AI agent security, identity, governance, cost, and the engineering behind the control plane.
Identity & Access
Entro Security Alternatives: Secrets-Centric NHI Governance
Evaluating alternatives to Entro Security for secrets-centric non-human identity governance and how it compares to broader NHI platforms.
AI Agent Security
The Lethal Trifecta: A Framework for Agent Data Exfiltration
The lethal trifecta names the three properties that make prompt injection dangerous: private data, untrusted content, and external communication.
Identity & Access
Token Exchange for Agent-to-Tool Authorization
OAuth 2.0 Token Exchange (RFC 8693) is the standard for on-behalf-of agent authorization: the flow, the claims that matter, and the limits that stop escalation.
AI Agent Security
ForcedLeak and PipeLeak: Agentforce Breaches Explained
Two 2025-2026 prompt-injection disclosures in Salesforce Agentforce, ForcedLeak and PipeLeak, show how form data becomes a data-exfiltration path.
AI Governance & Compliance
Public Agent Reputation and k-Anonymity
A public agent reputation lookup leaks information unless designed carefully. The anti-enumeration contract, k-anonymity thresholds, and reputation vs. trust.
AI Governance & Compliance
How to Audit AI Agent Activity: A Step-by-Step Process
A step-by-step process for auditing AI agent activity: what to log at each layer, how to reconstruct one agent action, and how to export evidence.
Platform & Operations
LLM Observability Tools for Security and Compliance Teams
Langfuse, LangSmith, Arize Phoenix, and Braintrust evaluated for audit-trail and compliance readiness — not eval quality.
AI FinOps
AP2 Explained: How Google's Agent Payments Protocol Works
AP2 authorizes AI agent purchases through signed Mandates, not a single API call. Version, governance, and mechanism as of April 2026.
Identity & Access
mTLS, SPIFFE, and Workload Identity for Agents
Workload identity gives an agent's runtime a cryptographic identity with no secret to steal. Where SPIFFE and mTLS fit, what they miss, and agent identity.
Identity & Access
Oasis Security Alternatives: NHI Lifecycle Management
Evaluating Oasis Security alternatives for non-human identity lifecycle management, including how it compares to Astrix and platform-native options.
AI Agent Security
Agent Sandbox Escape: Containing Code Execution
A code interpreter runs attacker-influenceable code in your infrastructure. The agent sandbox escape paths that matter and how to build one that fails safe.
AI Governance & Compliance
What FINRA and the SEC Expect From AI Agents in Finance
FINRA's 2026 oversight report and existing SEC rules set concrete expectations for AI agents at broker-dealers and RIAs — here is what they actually require.
AI Agent Security
Insecure Output Handling: Agent Output as Injection Vector
Model output is untrusted input to whatever consumes it. How agent output causes XSS, SQL injection, command execution, and log poisoning, and how to bound it.
Platform & Operations
MCP STDIO RCE Vulnerability Wave (2026) Explained
OX Security's April 2026 disclosure found a design-level flaw in Anthropic's MCP SDKs enabling remote code execution via STDIO transport.
AI Agent Security
Are Agent Skills Safe? A SKILL.md Security Checklist
Review Agent Skills before installation: inspect scripts, pin versions, test runtime permissions, and record evidence with an editable review worksheet.
Identity & Access
How to Give an AI Agent Its Own Identity
Why AI agents need first-class identity and how to model it so every action is attributable, governed, and revocable without disrupting other systems.
Platform & Operations
LiteLLM Enterprise Alternatives: Beyond Self-Hosting
When LiteLLM's self-hosted model stops scaling and what teams evaluate instead — Portkey, Kong AI Gateway, Cloudflare AI Gateway, and TrueFoundry.
Identity & Access
Sub-Agent Delegation with Scoped Tokens
An orchestrator that shares its credentials with sub-agents has no delegation model. How to pass narrowed authority down a chain, bound depth, keep attribution.
AI Agent Security
Securing AI Agents in CI/CD Pipelines
An agent in your CI/CD pipeline holds deploy credentials and reads attacker-submittable content. Why pull-request-triggered agents are the sharpest case.
AI Agent Security
WitnessAI Alternatives for Runtime AI Access Control
Evaluating alternatives to WitnessAI for runtime AI access control and compliance — what the category covers and how peers compare.
AI Governance & Compliance
US State AI Laws Compared: SB 53, RAISE, TRAIGA, Colorado
California SB 53, New York's RAISE Act, Texas TRAIGA, and Colorado's amended AI Act target different companies — here is who actually has to comply.
AI Agent Security
Voice Agent Security Risks
Voice agents add a biometric channel that can be synthesized, an audio channel that carries injection, and a real-time path with no room for review.
Platform & Operations
Agent Evaluations: Catching Quality Regressions Early
Agents regress silently when prompts, models, tools, or data change. How to build an eval harness: scoring methods, what to measure, where evals belong.