Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Healthcare AI Agents and HIPAA: Attribution and Minimum Necessary for Autonomous Actions

A healthcare AI agent chains several PHI accesses to complete one task, and HIPAA still asks who accessed what and whether the access was the minimum necessary. This article walks the two obligations agents strain hardest, attribution under the audit-control standard and minimum necessary applied per action rather than per session, and shows why a shared agent credential and session-level logging leave both unmet at the request layer.

Industry Verticalshealthcarehipaaai-agentsphiaudit-trailidentity-and-authorization
Read post →

AI Policy Enforcement at the HTTP Layer: Why the Request Boundary Is the Control Point

AI policy can be enforced at four layers: the model, the application, the network, and the HTTP request boundary. This piece walks each layer, shows why the model layer is probabilistic, the application layer self-attesting, and the network layer blind under TLS, and argues that the HTTP request boundary is the only point that sees decrypted prompt content plus identity and can make a deterministic, recordable decision.

Platform & Architecturepolicy-enforcementarchitectureai-securityinline-enforcementzero-trust
Read post →

Shadow AI Detection Tools: The Signals That Actually Surface Unsanctioned AI Use

Shadow AI detection draws on five signal families: network and DNS logs, CASB and OAuth consent grants, endpoint and browser telemetry, identity and SSO logs, and the AI gateway itself. This guide describes what each signal catches, where each goes blind, and why detection surfaces the problem while inline enforcement at the request boundary is what closes it.

Problem-Awareshadow-aiai-securitydata-loss-preventioncybersecurityinline-enforcement
Read post →

The Einstein Trust Layer Audit Gap: What Its Log Covers and What Routes Around It

Salesforce''s Einstein Trust Layer writes a detailed audit record for AI interactions that flow through its LLM Gateway, prompt, masked prompt, completion, toxicity score, grounding source, user, and timestamp. That record is scoped to Salesforce-mediated traffic. This piece explains what the Trust Layer captures, why AI traffic that routes around Salesforce never appears in it, and what enterprise-wide per-decision audit requires.

Problem-Awareforensic-auditai-securityai-governanceshadow-aicompliance
Read post →

Check Point's AI Security Report 2026: The AI Infrastructure You Cannot See Is Already Being Probed

Check Point Research published its AI Security Report 2026 on July 15, 2026. Most coverage focused on autonomous exploitation and deepfakes. The under-read section is the AI-infrastructure attack surface: exposed model servers, agent control panels, and inference endpoints that attackers probe while most organizations have no inventory of them. This is the visibility gap an identity-aware policy gateway closes on the request path.

Problem-Awareai-securitythreat-reportai-infrastructureinline-enforcementai-visibility
Read post →

The AI Agent Security Guide: Where the Controls Actually Live

AI agents plan, call tools, and make requests to models without a human in the loop for each step. Securing them spans host isolation, tool scoping, identity, and the model-call channel. This guide maps the full control surface, marks which layers sit outside an HTTP policy gateway, and shows where identity-aware authorization and per-decision logging on agent-to-LLM traffic do the work.

Problem-Awareai-agent-securityagentic-aiai-agent-identityai-audit-trailai-egress
Read post →

The Security Layer in Agentic AI Architecture Sits at the Model-Call Boundary

Most agentic AI architectures diagram the planner, memory, tools, and model, then add security as a wrapper around the application. That places enforcement above the layer where agent decisions become actions. The load-bearing security layer is the model-call boundary itself, where identity, policy, and audit apply to every request an agent makes to a model.

Problem-Awareagentic-aiai-architectureai-control-planeinline-enforcementai-audit-trail
Read post →

AI Medical Scribes and HIPAA: The PHI Leaves With the Prompt

An AI medical scribe listens to a patient encounter and drafts the clinical note, which means protected health information flows into an LLM on every visit. HIPAA compliance for that workflow turns on three things a policy gateway can enforce on the AI request path: a Business Associate Agreement covering the model endpoint, minimum-necessary control over what PHI is sent, and an audit record of every call.

Industry Verticalshealthcare-aihipaaphiai-audit-trailai-egress
Read post →

Illinois AI Employment Law: The Notice and Non-Discrimination Duties Need a Record

Illinois House Bill 3773 amended the Illinois Human Rights Act, effective January 1, 2026, to make it a civil-rights violation for an employer to use AI that discriminates in employment decisions, and to require notice when AI is used. Both duties turn on evidence: proving what the AI was asked and what it returned. This article shows where that record gets written.

Industry Verticalsillinois-ai-lawai-employmentai-audit-trailcompliancestate-ai-law
Read post →

HR Hiring AI Under the EU AI Act: The Bias Question Becomes a Logging Question

The EU AI Act classifies AI used to screen and evaluate job candidates as high-risk under Annex III, which brings record-keeping, logging, and human-oversight duties. Bias mitigation is model and data work, but proving a hiring decision was accountable is a logging problem. This article separates the two and shows which obligations a policy gateway produces evidence for on the AI request path.

Industry Verticalseu-ai-acthr-aihigh-risk-aiai-audit-trailcompliance
Read post →

Protecting Attorney-Client Privilege When Lawyers Use AI: Control the Disclosure, Keep the Record

When a lawyer pastes privileged material into an external AI tool, the concern is disclosure to a third party and the risk that raises to attorney-client privilege and work-product protection. Privilege determinations belong to courts and counsel. What a firm controls is which privileged content reaches which model endpoint, and whether there is a record of it. Both are decisions on the AI request path.

Industry Verticalslegal-aiattorney-client-privilegeai-egressai-audit-traildata-protection
Read post →

AI Underwriting Under the EU AI Act: Life and Health Pricing Is High-Risk

The EU AI Act names AI used for risk assessment and pricing in life and health insurance as high-risk under Annex III. That brings automatic logging, human oversight, and traceability duties to underwriting models. This article walks the obligations, separates the actuarial fairness work from the record-keeping work, and shows which duties a policy gateway produces evidence for on the AI request path.

Industry Verticalseu-ai-actinsurance-aiunderwritinghigh-risk-aiai-audit-trail
Read post →