Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Gaming AI Audit Trails Must Reconstruct the Player Decision

UK Gambling Commission rules require remote licensees to act on strong indicators of harm through automated processes, review each affected customer case and allow contested automated decisions. The useful AI audit trail connects the indicator, model-assisted decision, action and later evaluation without claiming coverage beyond routed HTTP model traffic.

Industry Verticalsai-governanceai-complianceauditpolicy-enforcementidentity-and-authorizationforensic-audit
Read post →

Dental AI Audit Trails Have to Follow the Patient Record

HIPAA audit controls apply to information systems that contain or use electronic protected health information. For a dental practice, that can include an approved LLM route used for chart notes, claim narratives or patient messages. A useful audit trail connects the individual user and workflow to PHI classification, model destination, policy outcome and qualified review without turning the log into another exposed clinical record.

Industry Verticalsai-governanceai-compliancehipaaauditdata-loss-prevention
Read post →

Credit Union AI Audit Trails Turn Oversight into Evidence

NCUA says existing technology-neutral rules apply to credit union AI and examiners look at internal controls, ongoing monitoring and third-party due diligence. A request-level audit trail gives those activities evidence. This article defines the fields, reviews and limits of an AI trail for member-service, lending and operations traffic.

Industry Verticalsai-governanceai-complianceauditcomplianceidentity-and-authorization
Read post →

Construction AI Audit Trails Need to Follow the Project Data

Construction teams put drawings, submittals and federal contract data into AI assistants. NIST SP 800-171 Revision 3 defines audit-record content for systems that handle Controlled Unclassified Information, while the AI RMF calls for documented roles and ongoing monitoring. This article turns those controls into a request-level record for construction AI traffic.

Industry Verticalsai-governanceai-complianceauditcybersecuritypolicy-enforcement
Read post →

Clinical Research AI Audit Trails Must Reconstruct the Trial Record

FDA guidance says inspectors may request the records needed to reconstruct a clinical investigation, including metadata and audit trails. ICH E6(R3) adds traceability, attributable access and review of relevant metadata. This article maps those duties to AI request records while keeping the clinical record and the AI gateway record separate.

Industry Verticalsai-governanceai-complianceauditcompliancepolicy-enforcement
Read post →

Capital Markets AI Audit Trails Must Join Supervision to Books and Records

Broker-dealers already make current transaction records, preserve business communications and evidence principal review under SEC and FINRA rules. An LLM used to draft research, summarize customer correspondence or assist an order workflow can sit between those records. This article defines the request-level evidence needed to connect AI use to the supervised activity without claiming that an AI gateway log is itself a complete books-and-records system.

Industry Verticalsai-governanceai-complianceauditcompliancepolicy-enforcement
Read post →

Accounting Firm AI Audit Trails Must Preserve the Work Behind the Workpaper

An accounting firm that uses an LLM to analyze a ledger, summarize a contract or draft an audit memo creates an evidence problem alongside the productivity gain. The engagement file may show the final workpaper while omitting the model, source data, policy and reviewer action that produced it. This article maps request-level AI records to PCAOB evidence expectations and the NIST AI Risk Management Framework without treating an AI log as audit evidence by itself.

Industry Verticalsai-governanceai-complianceauditforensic-auditpolicy-enforcement
Read post →

Behavioral Health AI Audit Trails Must Separate Access, Disclosure and Model Use

Behavioral health AI can place HIPAA-protected data and 42 CFR Part 2 records into the same model request, but the legal questions remain distinct. HIPAA requires mechanisms that record and examine activity in systems containing or using electronic protected health information. Part 2 adds restrictions and patient rights for substance use disorder records. This article maps those duties to identity-bound request records without treating a gateway log as a complete disclosure accounting.

Industry Verticalsai-governanceai-compliancehipaaauditdata-loss-prevention
Read post →

Autonomous AI Agent Governance: What Production Requires

Autonomous AI agents plan and execute multi-step actions against enterprise systems with no human approving each step. The governance controls that survive a production incident are identity-bound authorization, per-decision audit records, and inline policy enforcement, not a policy document and a quarterly review. This covers what to build, and how to audit an autonomous remediation agent after it acts.

Problem-Awareagentic-aiai-governanceidentity-and-authorizationinline-enforcementauditcompliance
Read post →

Ghostjacking: Tenet Turned Blocked Requests Into Agent Instructions at DEF CON 34

Tenet Security presented Ghostjacking at DEF CON 34 on August 9, 2026. An attacker sends a request designed to be blocked, the firewall logs the payload verbatim, and an AI agent asked to review that log follows the attacker''s text as instruction. In the demonstrated chain the agent rewrote DNS records to point at attacker infrastructure. This piece walks the mechanism step by step and separates the observability fixes from the two controls that live on the AI request path.

Platform & Architecturellm-securityagentic-aiprompt-injectionai-securitypolicy-enforcementidentity-and-authorization
Read post →

Pharmaceutical AI Audit Trails Follow the Predicate Rule, Not the Tool

FDA guidance states that the agency intends to interpret the scope of 21 CFR Part 11 narrowly, applying it to records maintained electronically in place of paper and relied on to perform regulated activities. That scoping test decides whether an AI interaction needs a Part 11 audit trail. This article works through the test, the enforcement discretion positions FDA has stated and the request-level evidence a sponsor needs regardless of how Part 11 lands.

Industry Verticalsai-governanceai-compliancepharmaceuticalsauditdata-protection
Read post →