Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.
Data residency for AI breaks the moment a prompt leaves your region for a model endpoint in another one, and application code rarely records where the call went. This piece shows how an AI gateway turns residency from a hopeful configuration into an enforced, logged control: identity and data class decide which regional endpoint a call may reach, and every decision is recorded with its destination.
Read post →Indirect prompt injection hides instructions inside content an AI agent reads, a web page, a document, a tool result, and the model acts on them as if they came from you. No request filter reliably stops a model from being fooled. This piece is honest about that limit and shows where the defensible control sits: identity-scoped authorization on what the agent may then do, plus a per-decision record of what it did.
Read post →An AI agent authenticates once and then makes hundreds of tool and model calls, most systems authorize the session and wave the rest through. That is the post-authentication gap. This piece shows what per-call authorization for agents looks like: each tool call checked against the agent identity, its scope, and the parameters it carries, decided inline, and recorded.
Read post →Logging an LLM request as if it were a generic HTTP call captures a timestamp, a status code, and a shared key, which answers almost none of the questions an incident or an audit asks. This piece defines the fields a model call record actually needs, why application code is the wrong place to write them, and what a per-decision record looks like in practice, with a concrete schema.
Read post →A bearer key in front of an AI gateway proves possession of a secret, not the identity of the service that holds it, and a leaked key is indistinguishable from the real caller. Mutual TLS binds each calling service or agent to a certificate the gateway verifies on every connection. This piece shows what mTLS establishes for AI traffic, what it does not, and how it feeds the authorization decision.
Read post →Lawyers paste privileged client material into AI tools to draft and summarize, and a firm carrying a duty of confidentiality usually has no record of which matter that data belonged to or where it went. This piece shows how an AI gateway puts model traffic under matter-aware policy and produces the per-decision record a firm needs to show client data stayed inside its obligations.
Read post →Public-sector AI use carries obligations most agency deployments cannot yet meet: zero-trust access, a defensible record of automated decisions, and evidence for oversight and public-records requests. This piece shows how an AI gateway extends identity-aware access control and per-decision logging to model traffic, so an agency can govern AI use and produce the record its accountability rules assume.
Read post →Non-human identities, service accounts, API keys, workloads, and now AI agents, outnumber humans by more than 100 to 1 in the average enterprise (Palo Alto Networks, 2026). They carry static long-lived credentials, skip MFA, and share keys, which means the audit trail names a credential rather than an actor. This piece explains what an NHI is, why it resists the controls built for people, the specific attribution problem AI agents add on a shared key, and where identity-bound authorization on each AI call fits.
Read post →A vendor badge that reads "HIPAA compliant" answers one question and stays silent on the two that an OCR review probes. This guide gives healthcare compliance teams the three-part Security Rule test for any AI tool (a signed BAA under 45 CFR 164.502(e), access control under 164.312(a), and audit controls under 164.312(b)), walks the tool categories a covered entity actually assembles, and shows where the residual access-control and audit obligation stays with the covered entity after every BAA is signed.
Automating incident response for AI traffic means being precise about which part of the response can run without a human and which cannot. Google Mandiant M-Trends 2026 puts median attack handoff at 22 seconds, faster than any analyst can triage. This piece separates the containment decision (which belongs inline, at the AI request boundary, where a policy violation can be blocked before it executes) from the investigation and recovery work that automation can accelerate but not replace, and shows how a structured audit record turns an AI incident into something an automated pipeline can act on.
When an AI agent is part of a security incident, the responding team needs to answer three questions per action: which identity authorized the call, what policy applied, and what the agent asked the model. Google Mandiant M-Trends 2026 puts the median handoff from initial access to a secondary threat group at 22 seconds, a tempo that turns after-the-fact log review into forensic archaeology. This piece defines the evidence an incident response team needs from AI traffic, where most teams are blind, and how EU AI Act Article 12 raises the bar on the record.
Azure OpenAI ships real security controls: Microsoft Entra ID authentication, managed identities, private endpoints, content filters, and diagnostic logging into Azure Monitor. Those controls secure the connection and the platform. They stop at the question of whether a specific authenticated caller is permitted to send a specific prompt to a specific deployment. This piece walks the controls Azure provides, shows where they stop, and gives the identity-aware authorization pattern that closes the post-authentication gap on Azure OpenAI traffic, with the request-level detail an engineer needs.