AI Governance & Compliance
The Colorado AI Act: A Compliance Guide for Engineers
Colorado SB 189 delayed the Colorado AI Act to January 1, 2027 and narrowed it to developer disclosure, consumer notice, and human-review duties.
Blog
Insights & updates — page 6
AI agent security, identity, governance, cost, and the engineering behind the control plane.
AI Governance & Compliance
EU AI Act Digital Omnibus 2026: What Actually Changed
The EU AI Act Digital Omnibus, in force since 27 July 2026, defers Annex III high-risk rules to Dec 2027 and Annex I to Aug 2028. Art. 50 applies from Aug 2026.
AI Agent Security
Runtime vs Design-Time Security for AI Agents
Why design-time controls are not enough for AI agents: the five runtime control classes that must sit outside the agent, and how they map to OWASP.
AI FinOps
Budgets vs Rate Limits: Controlling Agent Consumption
Spend caps and request throttling are different levers for controlling runaway AI agents. Learn when each applies, how they compose, and why you need both.
AI Agent Security
Continuous Adversarial Testing for AI Agents
How Praesidia continuously red-teams its own registered agents and MCP servers: opt-in, scope-guarded, synthetic payloads, no external egress.
AI Agent Security
Goal Hijacking in AI Agents (OWASP ASI01)
Goal hijacking redirects an AI agent's objective while it runs normally. How ASI01 attacks work and the controls that contain a hijacked goal.
Identity & Access
Key Rotation for Agent Credentials
Rotation that has never been exercised is not rotation. The overlap-window pattern, why agent fleets break it differently, and how to make it routine.
Identity & Access
Agent Privilege Abuse and Continuous Authorization (ASI03)
Why point-in-time authorization fails for long-running AI agents, and how continuous authorization contains privilege abuse — OWASP ASI03.
AI Agent Security
AI Agent Memory Poisoning: Attacks and Defenses (ASI06)
Memory poisoning implants malicious content in an AI agent's persistent state. How ASI06 attacks persist across sessions and the defenses that work.
Platform & Operations
MCP Server Registries: Publishing, Discovery, and Ratings
An MCP server registry is a supply-chain control point. What a registry entry should carry, how ratings get gamed, and why internal catalogues beat public ones.
AI Agent Security
AI Agent Supply Chain Security (OWASP ASI04)
The AI agent supply chain — models, MCP servers, tools, prompts, frameworks — and the vetting, pinning, and attestation controls against ASI04.
Identity & Access
Secure Agent Offboarding and Deprovisioning
Retired agents keep credentials, connections, and scheduled triggers. The agent offboarding and deprovisioning sequence that actually closes them.
AI Agent Security
Securing Inter-Agent Communication and A2A (ASI07)
Agent-to-agent channels are an attack surface: spoofed peers, injected payloads, unbounded delegation. Securing A2A against OWASP ASI07.
AI Agent Security
Trust Scores vs Allow-Lists for Agent Authorization
Static allow-lists gate identity; dynamic trust scores gate scope. Learn how each works, where each falls short, and why mature programs combine both.
AI Agent Security
Cascading Failures in Multi-Agent Systems (ASI08)
How one agent's error propagates through orchestrated systems — amplification, feedback loops, resource storms — and the ASI08 containment controls.
AI Agent Security
Rogue AI Agents and Kill Switches (OWASP ASI10)
Rogue agents run with valid credentials outside governance. The kill-switch architecture — containment tiers, revocation, drills — for OWASP ASI10.
Platform & Operations
Detecting Shadow MCP Servers
Developers add MCP servers to agents in minutes, without review. How to detect shadow MCP servers already running and make the governed path the easier one.
AI Governance & Compliance
Guardrails vs Evals vs Monitoring: Which Control When
Guardrails, evals and monitoring each close a different AI safety gap at a different lifecycle stage. Which one to use when, and why you need all three.
Identity & Access
Machine vs Workload vs Agent Identity: The Differences
Machine identity, workload identity, and agent identity are not synonyms. What each term means, where they overlap, and what agents add.
Identity & Access
NHI Credential Lifecycle Management: A Practical Guide
Non-human identity credentials from issuance to revocation: provisioning, scoping, rotation, monitoring, and decommissioning without sprawl.
Platform & Operations
Publishing Agents to a Marketplace: The Review Gate
A marketplace where publishers approve their own listings has no review at all. The listing lifecycle, why self-certification must be impossible, what to check.
Platform & Operations
MCP OAuth 2.1 and PKCE, Explained Step by Step
The MCP 2026 authorization flow: discover metadata, choose CIMD or registered clients, use PKCE, validate the issuer, and request resource-bound tokens.
Platform & Operations
MCP Server Vetting: Registry Risk and How to Manage It
Third-party MCP servers are supply-chain risk: registry provenance, tool-description audits, version pinning, and an approval workflow that scales.
AI FinOps
Model Routing: Cost and Quality Trade-offs
Sending every request to your best model is the costliest way to run an agent. Model routing strategies that hold quality, ones that cost more, and governance.