AI Strategy
Enterprise AI Agent Governance: The Operating Model
An operating model for enterprise AI agent governance: who owns identity, roles, delegated admin, central policy and audit as agents spread across teams.
Blog
Insights & updates — page 7
AI agent security, identity, governance, cost, and the engineering behind the control plane.
Identity & Access
Break-Glass Access for AI Operations
Standing production access for agent operators is a permanent risk for an occasional need. How to build a break-glass path fast enough to use and safe to trust.
AI FinOps
Denial of Wallet: The Cost Attack Against LLM Applications
Denial of wallet attacks run up the bill until you take your service down yourself. How the attack works against agentic systems and which controls stop it.
AI Agent Security
AI Agent Security for Startups
A pragmatic guide to AI agent security for startups: the controls that matter most when you are moving fast and have limited security resources.
AI Agent Security
The Confused Deputy Problem in AI Agents
AI agents are deputies acting for principals. Confuse which principal an agent serves and its permissions become the attacker's. How to structure authority.
AI Agent Security
Multi-Turn Jailbreaks: Why Per-Message Filtering Fails
Crescendo and other multi-turn jailbreaks spread the payload so no single message looks malicious. Why stateless filtering misses them and what catches them.
AI Strategy
AI Agent Governance for SaaS Companies
How SaaS teams embedding AI agents keep multi-tenant data isolated, costs attributed per customer, and agent behavior governed at scale across tenants.
AI Agent Security
Excessive Agency: Controls for OWASP LLM06
Excessive agency turns a model mistake into an incident. Its three components (excessive functionality, permissions, and autonomy) and the controls for each.
AI Agent Security
Red Teaming AI Agents: A Practical Playbook
Red teaming AI agents is not prompt-hacking a chatbot: the objective is unauthorized action. A scope, a technique set, and a scoring model for useful findings.
AI Governance & Compliance
HIPAA and the EU AI Act for Healthcare AI Agents
What HIPAA and the EU AI Act ask of AI agents that touch PHI: minimum-necessary access, audit controls, risk classification and the evidence to keep.
Platform & Operations
High Availability for an AI Control Plane
A control plane in the request path is a dependency for every agent call. Which parts must fail closed, which can degrade, and how to plan each failure mode.
AI Agent Security
RAG Pipeline Security: Vector Store Poisoning
A RAG pipeline pulls attacker-influenced content into a model's context. How vector stores get poisoned, how retrieval leaks across tenants, and what holds.
AI Governance & Compliance
EU AI Act Article 50: Transparency Obligations for Engineers
Article 50 transparency obligations apply from 2 Aug 2026 — AI disclosure, synthetic-content marking, and what engineering teams must ship now.
AI Governance & Compliance
Financial Services AI Agents: EU AI Act and GDPR Rules
What regulators expect of AI agents in banking and finance: EU AI Act high-risk uses such as credit scoring, GDPR duties, attributable actions and evidence.
Platform & Operations
Post-Incident Forensics for AI Agents
Reconstructing what an AI agent did, why, and what it touched needs evidence most deployments never record. The minimum record set and how to investigate.
Identity & Access
Agent Identity Spoofing and DID Verification
A claimed agent identity is worthless without verification. How decentralized identifiers and verifiable credentials establish it across trust boundaries.
AI Governance & Compliance
The Colorado AI Act: A Compliance Guide for Engineers
Colorado SB 189 delayed the Colorado AI Act to January 1, 2027 and narrowed it to developer disclosure, consumer notice, and human-review duties.
AI Governance & Compliance
EU AI Act Digital Omnibus 2026: What Actually Changed
The EU AI Act Digital Omnibus, in force since 27 July 2026, defers Annex III high-risk rules to Dec 2027 and Annex I to Aug 2028. Art. 50 applies from Aug 2026.
AI Agent Security
Runtime vs Design-Time Security for AI Agents
Why design-time controls are not enough for AI agents: the five runtime control classes that must sit outside the agent, and how they map to OWASP.
AI FinOps
Budgets vs Rate Limits: Controlling Agent Consumption
Spend caps and request throttling are different levers for controlling runaway AI agents. Learn when each applies, how they compose, and why you need both.
AI Agent Security
Continuous Adversarial Testing for AI Agents
How opted-in target context selects synthetic probes that check organization-wide guardrails and intent rules, without calling production endpoints.
AI Agent Security
Goal Hijacking in AI Agents (OWASP ASI01)
Goal hijacking redirects an AI agent's objective while it runs normally. How ASI01 attacks work and the controls that contain a hijacked goal.
Identity & Access
Key Rotation for Agent Credentials
Rotation that has never been exercised is not rotation. The overlap-window pattern, why agent fleets break it differently, and how to make it routine.
Identity & Access
Agent Privilege Abuse and Continuous Authorization (ASI03)
Why point-in-time authorization fails for long-running AI agents, and how continuous authorization contains privilege abuse — OWASP ASI03.