Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

AI Agent Lateral Movement: How an LLM Turns a Single Compromised Credential into a Multi-System Incident

An AI agent operating with credentialed access to multiple SaaS systems collapses the traditional lateral-movement kill chain. What used to take a human attacker hours of enumeration and pivoting takes an LLM-orchestrated agent seconds. The Marimo CVE-2026-39987 incident is the first widely reported case. This piece walks through the mechanism, why endpoint detection is blind to it, and the inspection-layer controls that block the pattern at the HTTP AI request boundary.

Problem-Awareai-agent-securitylateral-movementagentic-aiincident-responseai-security
Read post →

A JSON Schema for AI Audit Logs: The Fields a Regulator, an Auditor, and a SIEM All Need in the Same Record

AI audit logs need one schema that satisfies a regulator during an Article 12 audit, an internal auditor during an ISO 42001 certification, and a SIEM during an active incident. Most deployments produce three log formats and reconcile them after the fact. This piece walks through a single JSON schema with the required and optional fields, the identity representation, the policy-state representation, and the storage-layer contract that makes the schema durable.

Platform & Architectureai-audit-logsjson-schemasiemeu-ai-actiso-42001ai-engineering
Read post →

AI Audit Log Retention Under the EU AI Act: What Six Months Actually Means at the Storage Layer

Article 19 of the EU AI Act sets a minimum log retention floor of six months for high-risk AI systems, and existing sectoral rules extend it far beyond that. This piece walks through what the six-month floor means at the storage layer, how the retention interacts with GDPR, HIPAA, and financial-services record rules, and the inspection-layer architecture that produces logs suitable for both the retention window and the reconstruction test a regulator applies during an audit.

Compliance & Regulationeu-ai-actai-audit-logscompliancelog-retentionai-governancearticle-19
Read post →

AI Cost Attribution Per Team: The Record Design That Turns AI Spend Into a Chargeback Line Item

Finance teams asking for AI cost attribution per team run into the same problem every time: the model provider's invoice shows the aggregate account spend, not the per-team consumption. Attribution has to happen at the gateway, where the enterprise can tag each request with the team, application, and user identity. This piece walks through the record design that produces attributable AI spend, the tagging pattern that survives multi-model deployments, and the reports the finance team accepts as chargeback evidence.

Platform & Architectureai-costchargebackai-gatewayfinanceattributionai-governance
Read post →

OpenAI Usage Tier Controls: How an Enterprise Enforces Per-Team Budgets on the Same API Key

OpenAI's account usage tiers describe the account-level rate ceiling. The tier is a single number the account holds, and the tier does not describe the enterprise's per-team, per-application, or per-user budgets. An enterprise that runs OpenAI at scale has to enforce a set of budget controls that sit above the account tier. This piece walks through the pattern set: per-team token budgets, per-application spend caps, per-user rate ceilings, and the audit records that tie every request back to the team accountable for it.

Platform & Architectureopenaiusage-tierai-costai-gatewaybudget-controlai-security
Read post →

AI Audit Log Hashing Patterns: The Cryptographic Choices That Make an Audit Trail Tamper-Evident

An AI audit log that a regulator or an auditor will accept has to prove two properties: the records were written at the times they claim, and the records have not been altered after the fact. Hashing is the mechanism that produces the second property. This piece walks through the hashing patterns that fit an inline AI gateway's audit stream: hash-chained append, Merkle-tree batching, external witness anchoring, and the trade-offs each pattern makes against write latency and audit verification cost.

Problem-Awareaudit-logsai-securitycompliancecryptographytamper-evidentai-gateway
Read post →

LLM Vector Store Access Control: The Filters That Have to Run on Every RAG Query

The vector store holds embeddings the enterprise's users, tenants, and documents contributed. Every retrieval-augmented generation query has to run access-control filters against the store before the retrieval reaches the LLM context. This piece walks through the filter design that survives multi-tenant SaaS, cross-department access, and time-bounded document lifecycle: per-vector metadata, query-time filter injection, retrieval-response inspection, and the audit records that prove the filter held on every query.

Platform & Architectureragvector-storeaccess-controlai-securityai-gatewayllm-dlp
Read post →

Anthropic MCP Server Security: The Enterprise Controls That Sit Around Claude's Tool Layer

Anthropic's Model Context Protocol implementation lets Claude call tool servers with a standard schema. The enterprise question is what security controls have to sit around the MCP server when the LLM behind the protocol is Claude. This piece walks through the controls: transport authentication to the MCP server, token exchange between Claude's session and the tool call, response inspection before the tool result reaches the model, and audit records tied to the human user who authorized the session.

Platform & Architectureanthropicmcpclaudeai-securityai-agentai-gateway
Read post →

AI Gateway Per-Tenant Rate Limiting: The Buckets That Actually Contain a Runaway Workload

A rate limit on the AI gateway is not a single ceiling. Enterprise deployments run several rate-limit buckets in parallel: per model, per tenant, per user, per tool, per purpose. The buckets interact, and the interaction is where runaway workloads hurt most. This piece walks through the bucket design that contains a runaway agent loop, protects the model provider's shared quota, and produces the audit records the operator needs to explain a rate-limit event.

Platform & Architectureai-gatewayrate-limitingmulti-tenantai-securityquota-managementai-cost
Read post →

AI Agent Privilege Scoping: Six Patterns That Contain an Agent's Blast Radius

An agent is a program that acts on behalf of a human, and the acting has authorization consequences the traditional privilege model does not cover. The agent's identity, the human's session, the tool's permission, and the enterprise policy all compose into the authorization decision on each call. Privilege scoping is the design pattern set that keeps the composed authorization tight. This piece walks through six patterns that appear in production agent deployments and the audit records each pattern produces.

Problem-Awareai-agentprivilege-scopingagentic-aiai-securityauthorizationblast-radius
Read post →

MCP Server Authorization Patterns: Enforcing Who Can Call Which Tool Through the Model Context Protocol

The Model Context Protocol gave agents a common way to talk to tool servers. It did not give the enterprise a common way to authorize which agent can call which tool with which arguments. Authorization at the MCP server sits at three layers: the transport layer, the server layer, and the tool-invocation layer. Each layer answers a different question and produces a different audit record. This piece walks through the authorization patterns that survive an enterprise deployment across multiple MCP servers and multiple agent identities.

Platform & Architecturemcpmodel-context-protocolauthorizationai-agentai-securityai-gateway
Read post →

PCI DSS 4.0 AI Controls: Where an LLM Deployment Touches the Cardholder Data Environment

PCI DSS 4.0 does not name AI systems in its 12 requirements. It does describe the cardholder data environment and the controls that apply to systems that store, process, or transmit cardholder data. An LLM deployment that touches cardholder data joins the CDE. This piece walks through the PCI DSS 4.0 requirements that apply to LLM deployments, the cardholder-data flow patterns that pull the LLM into scope, and the audit evidence a QSA accepts for the AI-specific controls at the gateway boundary.

Compliance & Regulationpci-dsscompliancecardholder-dataai-securityllm-dlpai-gateway
Read post →