Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

LLM Response Redaction Patterns: How to Filter Model Output Without Breaking the Response

The prompt is the input the gateway inspects before the model sees it. The response is the output the gateway inspects before the caller sees it. Response redaction runs against free-form generated text, which is a harder inspection problem than prompt classification. This piece walks through the redaction patterns that hold up on the response side: token-boundary preservation, semantic-preserving substitution, structured-response filtering, and the audit records that prove the filter ran. The patterns apply to the LLM DLP layer of any inline gateway.

AI Security Solutionsllm-dlpresponse-redactionai-securityai-dlpai-gatewaydata-leak-prevention
Read post →

AI Agent OAuth Scopes: Designing Per-Tool Authorization That Survives an Audit

OAuth scopes were designed for human users clicking through consent screens. AI agents call the same OAuth endpoints, but the agent's authorization is not the human's consent. The agent operates under an identity that persists across sessions, negotiates scopes at runtime, and combines multiple tool authorizations into a single execution graph. This piece walks through the OAuth scope design patterns that hold up when the caller is an agent, the audit records that prove the scope was enforced, and the failure modes that appear when scope design treats agents like humans.

Platform & Architectureai-agentoauthauthorizationagentic-aiai-securityaudit-logs
Read post →

AI Gateway Latency Benchmark 2026: How to Measure the p95 Overhead of Every Enforcement Step

AI gateway latency budgets get argued about at architecture review and then never measured under production load. The gateway sits inline. Every millisecond of overhead compounds across every LLM call. This piece walks through a benchmark methodology that separates the connection, identity resolution, classification, policy evaluation, and audit-record steps, so an architecture team can defend a p95 budget against the 500 ms to 5 second baseline of LLM inference. The measurement pattern applies to any inline enforcement layer, not only DeepInspect.

Platform & Architectureai-gatewaylatencybenchmarkperformanceinline-enforcementai-security
Read post →

AI Jailbreak Monitoring: Detecting the Prompts That Bypass Model Guardrails in Production Traffic

Jailbreak attempts against production LLM deployments have moved from novelty to routine traffic. Attackers, curious employees, and automated red-team tools all produce prompts intended to bypass the model's built-in safety layers. Detection at the model provider catches some patterns but not the enterprise-specific patterns tied to the deployer's own system prompt and policy configuration. Detection at the AI gateway catches both categories. This piece walks through the four detection surfaces (input pattern, response deviation, session behavior, follow-through action), the signals each surface produces, and the SIEM integration that lands the detection in the SOC's existing workflow.

Problem-Awarejailbreakai-securityprompt-injectionsiemthreat-detectionmonitoring
Read post →

AI Tenant Isolation: How Multi-Tenant SaaS Enforces Per-Customer Boundaries on LLM Traffic

Multi-tenant SaaS applications that add LLM features carry a new isolation obligation on top of the database and storage isolation the platform already enforces. Prompts flow through the LLM provider carrying tenant-specific data. Retrieval-augmented generation queries the vector store where tenant data lives. Agent tools call downstream systems that hold tenant data. Each of these paths introduces a way for tenant A's data to reach tenant B's context without a database join between them. This piece walks through the four isolation domains (prompt, retrieval, tool call, response), the enforcement patterns at the AI gateway, and the audit records that demonstrate the isolation held across the audit period.

Platform & Architecturemulti-tenantai-securitytenant-isolationsaasragai-gateway
Read post →

Agentic AI News in 2026: The Incidents, Regulatory Actions, and Framework Releases That Changed the Threat Model

Agentic AI shifted from a research topic to a production security concern across the first half of 2026. Microsoft documented prompt-to-shell escalation paths in LangChain, AutoGen, and Semantic Kernel. Marimo CVE-2026-39987 became the first widely-reported incident where attackers operated an LLM as their post-exploitation tool. LiteLLM disclosed seven CVEs in June alone, one authentication bypass in the gateway itself. OWASP published its Top 10 for Agentic Applications and the AISVS 1.0 verification standard. This piece walks through the specific incidents, the regulatory actions in the EU and Colorado, and the framework releases that have changed how security teams evaluate agentic AI deployments in 2026.

Problem-Awareagentic-aiai-security-newsowaspaisvslitellmcve
Read post →

NIST GenAI Profile (NIST AI 600-1): The Government's Baseline for Generative AI Risk

NIST published the Generative AI Profile (NIST AI 600-1) in July 2024 as a companion to the AI Risk Management Framework 1.0. The Profile catalogs 12 GenAI-specific risks and maps mitigation actions to the AI RMF's GOVERN, MAP, MEASURE, and MANAGE functions. Federal agencies operating under OMB M-24-10 use the Profile as the reference for their generative AI risk assessments. Enterprises subject to executive orders, government contract clauses, or sector-specific guidance also rely on the Profile. This piece walks through the 12 risk categories, the mapping to the four RMF functions, the specific mitigation actions the Profile lists at the deployment layer, and the audit records a deployer produces to demonstrate the mitigations.

Compliance & Regulationnist-ai-rmfgenai-profilenist-ai-600-1omb-m-24-10compliancefederal
Read post →

LLM Egress Monitoring: Inspecting the Prompt at the Boundary Before It Reaches the Model Provider

Traditional egress monitoring inspects outbound network traffic against a network-DLP catalog. The catalog was designed for file transfers, email attachments, and web form submissions. LLM prompts leave the enterprise as HTTPS request bodies to api.openai.com, api.anthropic.com, and the Bedrock and Vertex endpoints. The network DLP inspects the header but cannot inspect the body when the body is TLS-encrypted. Even where a proxy terminates TLS, the DLP pattern set does not recognize prompt content the way it recognizes credit card numbers or file signatures. This piece walks through the failure modes, the inspection-layer architecture, and the enforcement decisions the layer supports.

AI Security Solutionsai-dlpllm-dlpegress-monitoringnetwork-securityshadow-ai
Read post →

ISO 42001 Annex A Controls: The 38 AI Management Controls and Where Each One Lands in the Deployment

ISO 42001 Annex A lists 38 controls across nine areas (A.2 through A.10) that an organization implementing an AI Management System (AIMS) has to consider. The auditor's Statement of Applicability records which controls the organization has implemented, which controls it has excluded (with justification), and which controls are partially implemented with a target date for completion. This piece walks through each of the nine areas, the controls each area contains, the deployment layer where each control operates (policy, application, gateway, model provider), and the evidence artifacts a certification body's auditor accepts as satisfaction of the control.

Compliance & Regulationiso-42001annex-aaimsai-management-systemai-compliancecertification
Read post →

SOC 2 Common Criteria for AI: Mapping CC5, CC6, CC7, and CC8 to LLM Deployment Controls

SOC 2 reports use the AICPA Trust Services Criteria. The 2017 Common Criteria (CC1 through CC9) apply to every service organization's security engagement. When the service organization deploys an LLM as part of the service, the auditor tests the AI-related controls against the same criteria. CC5 (control activities), CC6 (logical access controls), CC7 (system operations), and CC8 (change management) get the most attention because the AI request path introduces new control gaps in each area. This piece walks through each criterion's AI-specific test, the control activities auditors accept as evidence, and the inspection-layer records that carry the evidence in a single audit pass.

Compliance & Regulationsoc-2trust-services-criteriaai-complianceauditcommon-criteriacc5cc6
Read post →

AI Incident Response Runbook: The Steps a SOC Actually Runs When an LLM Interaction Goes Wrong

AI incidents share their reporting timelines with the SEC 8-K 4-business-day rule, the EU AI Act Article 26.4 immediate reporting for serious incidents, and the HIPAA 60-day breach notification. The technical response has to run in parallel with the reporting clock. A working runbook covers the six-phase incident lifecycle: detect, triage, contain, investigate, report, and remediate. Each phase depends on the audit records the AI gateway produces. This piece walks through the runbook, the specific queries the SOC runs against the audit log at each phase, the roles that own each step, and the artifact pack the CISO hands to regulators when the reporting timers expire.

Platform & Architectureincident-responsesocai-securityrunbookir-playbookaudit-logs
Read post →

LLM Audit Log Retention: What Each Regulation Actually Demands and How Long the Records Have to Survive

The retention period for LLM audit logs depends on which regulation the deployment falls under. EU AI Act Article 12 sets a floor at the lifetime of the AI system. HIPAA sets 6 years on required records. SOX sets 7 years on records material to financial statements. GDPR requires retention only as long as necessary for the processing purpose, then erasure. FINRA sets 6 years on communications records. The gap between the shortest and longest applicable retention is often the value the organization sets. This piece walks through each regulation's actual retention rule for AI decision records, the maximum-of-applicable-floors rule most compliance teams end up applying, and the tamper-evident storage properties the records need to survive the retention period.

Problem-Awareai-audit-logslog-retentioncomplianceeu-ai-acthipaasox
Read post →