Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.
The ICO guidance on AI and data protection connects accountability, DPIAs, transparency, lawfulness, fairness, security, minimisation and individual rights. This mapping assigns each objective to an owner, implementation point, test and evidence artifact. It also records the ICO warning that the guidance is under review after the Data (Use and Access) Act and limits gateway coverage to routed HTTP model traffic.
Read post →Utah SB 226 replaced the original SB 149 consumer-facing AI provision with Chapter 13-75 in 2025. This mapping connects current scope, reactive disclosure, high-risk regulated-service notice, safe harbor, consumer-protection liability and enforcement response to accountable owners, implementation points, tests and evidence. Coverage is graded at the authenticated HTTP model boundary, with presentation and legal classification kept outside it.
Read post →This Washington My Health My Data AI compliance checklist turns Chapter 19.373 RCW into ten production tests for AI services handling consumer health data. Each item names an owner, retained artifact and completion condition across scope, policy, consent, sharing, rights, processors, security, sale authorization and geofencing.
Read post →Washington’s My Health My Data Act covers identifiable health data outside familiar HIPAA assumptions, including some inferences produced with algorithms or machine learning. This guide builds an audit package for scope, privacy notices, consent, sharing, consumer requests, processors and security, then separates statutory proof from HTTP model-traffic evidence.
Read post →Two research teams published two separate routes into Atlassian Rovo within 48 hours in August 2026. Varonis Threat Labs found that a URL parameter pre-fills the assistant''s chat inside the signed-in user''s session. PromptArmor found instructions hidden in content Rovo reads, exfiltrating Jira and Confluence data with web search turned off. This piece separates the two disclosures, keeps their remediation statuses apart, and names the connected-assistant blast radius problem underneath both.
Read post →AutoGen agents pass messages to each other, and a shared conversation history means one sensitive document read once is re-sent to the model on every subsequent turn by every participating agent. This piece walks the message-passing mechanism that multiplies disclosure, separates the local code-execution surface from the model-client surface an enforcement layer can reach, shows where a base URL points a deployment at a policy boundary, and sets out what the per-decision record needs to carry.
Read post →Claude Connectors are built on the Model Context Protocol, and the transport a connector uses determines whether data loss prevention has anywhere to stand. Remote connectors speak HTTP to a server the organization can put a proxy in front of. Local connectors speak STDIO between two processes on the same machine, where no network control exists. This piece separates the two transports, walks the tool-result path that carries the real exfiltration risk, and sets out what a per-decision record needs to contain.
Read post →IAM decides which principal may invoke which Bedrock model, and says nothing about what is inside the prompt. Bedrock Guardrails evaluate content inside the AWS inference path and cover AWS-hosted endpoints. This piece walks the bedrock-runtime request path, explains why model invocation logging being off by default is the most consequential setting in the service, separates the AWS-native controls from the multi-provider case, and sets out what a per-decision record has to carry.
Read post →Azure AI Foundry content filters evaluate harm categories and jailbreak attempts. Data loss prevention asks whether the prompt contains customer records that should never have left the tenant. Those are different questions with different classifiers, and conflating them is the most common gap in a Foundry security review. This piece walks the per-deployment endpoint surface, the diagnostic-settings problem across a multi-model project, and where prompt classification and per-request authorization belong.
Read post →Amazon Q Business builds an index over enterprise data sources and answers with the acting user''s permissions applied. Two data-protection problems survive that design: the index is a second copy of the content under different controls, and permission changes at the source only reach the index at the next sync. This piece separates the managed surfaces an enforcement layer cannot intercept from the Q Developer and custom-plugin paths it can, and sets out what to test.
Read post →A Cohere deployment usually moves far more content through Embed and Rerank than through Chat, and most AI DLP programmes instrument only the conversational path. An indexing job embedding a 40,000-document corpus sends every one of those documents to the provider in a batch that no chat dashboard records. This piece walks the three endpoint families, explains why deployment-mode variation makes hostname allowlisting fragile, and sets out where classification and per-decision records belong.
Read post →At DEF CON 34 Cloud Village on August 8, 2026, Marios Gyftos and Chrysostomos Manousis presented credential relay findings across six Azure services, including Azure AI Foundry, Azure AI Speech, Azure MCP Servers, AKS MCP and API Management. The root cause is one sentence long: the credential attached to an outbound request and the destination of that request are resolved independently, and nothing checks that they belong together. This piece walks the mechanism, separates the part Microsoft owns from the part a policy gateway owns, and sets out the record an incident reviewer needs.
Read post →