Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

DeepInspect vs AgentOps: Replaying What an Agent Did and Authorizing What It May Do

AgentOps is purpose-built observability for multi-step autonomous agents, with session replay, time-travel debugging, cost tracking, and native integrations for CrewAI, AutoGen, and LangChain. DeepInspect authorizes each model call an agent makes and records the decision. This walks both architectures, a feature table, the delegated-authority problem agents create, and the buyer each product fits.

Comparisons & Alternativesagentic-aicomparisonpolicy-enforcementidentity-and-authorizationai-securityaudit
Read post →

AIM Security Alternatives: 2026 Buyer Evaluation

AIM Security focuses on shadow AI discovery, generative AI policy management, and DLP for AI prompts at the browser and network layer. Teams evaluating alternatives usually want broader cross-provider HTTP enforcement, identity-bound per-decision audit records, or coverage of vendor SaaS AI traffic. This piece walks through six AIM Security alternatives and explains which fits which regulatory and operational profile under EU AI Act Article 12 and NIST AI RMF obligations.

Comparisons & Alternativesalternativesaim-securityshadow-aiai-dlpcomparison
Read post →

AI Vendor Risk Management: The Diligence Questions That Actually Bind Under Audit

AI vendor risk management sits at the intersection of traditional third-party risk and the new AI-specific obligations. The questionnaire that holds up against EU AI Act Article 26, Fannie Mae LL-2026-04, DORA, and sector-specific regimes asks for evidence the vendor can produce on demand. This article walks through the question set, the runtime evidence behind each answer, and the ongoing supervisory obligation that procurement attestations do not discharge.

Compliance & Regulationai-governanceai-compliancecomplianceeu-ai-actdora
Read post →

AI vendor risk assessment: the questions a Head of Security should ask any LLM provider in 2026

An AI vendor risk assessment in 2026 lives at the intersection of EU AI Act Annex IV documentation, DORA Article 28 third-party register requirements, SOC 2 vendor management, and ISO 42001 AIMS controls. The 30 questions cover training-data lineage, sub-processor disclosure, retention policy, deployer audit-log access, fine-tuning isolation, prompt logging consent, incident notification SLA, and exit-strategy artifacts.

Compliance & Regulationai-vendor-riskthird-party-riskdoraeu-ai-actiso-42001soc-2
Read post →

AI Policy Engine: Where the Decision Point Sits and What It Has to Evaluate

An AI policy engine evaluates every AI request against the deployer policy at the moment the request crosses the AI boundary. The engine reads identity context, prompt classification, model authorization, and policy state, then emits a pass or block verdict with a signed audit record. This article walks through what the engine has to evaluate, where it sits relative to the application and the model, and the architectural properties that make the engine defensible under audit.

AI Security Solutionsai-securitypolicy-enforcementinline-enforcementai-governancearchitecture
Read post →

AI Impact Assessment Template: The Fields a Regulator and an Auditor Both Read

An AI impact assessment template that holds up under EU AI Act Article 27, GDPR Article 35 DPIA, Fannie Mae LL-2026-04, and NIST AI RMF inquiries has to cover the same architectural primitives in the same vocabulary the regulators use. This article walks through the fields the template has to include, the questions each field answers, and the runtime evidence the deployer needs in order to keep the assessment current.

Compliance & Regulationai-complianceai-governanceeu-ai-actcomplianceaudit
Read post →

AI Governance and Risk Management: How the Two Programs Fit Together

AI governance sets the policies, roles, and accountability for AI use. Risk management identifies, measures, and treats the AI-specific risks the governance framework recognizes. The two programs share inputs (data classification, use case inventory, vendor list) and produce different outputs (policies versus risk treatments). Four frameworks draw the line differently: NIST AI RMF splits GOVERN from MAP/MEASURE/MANAGE, ISO 42001 hands the risk process to ISO 23894, the EU AI Act separates Articles 17 and 26 from Article 9, and SR 26-2 (which superseded SR 11-7 on 17 April 2026) separates board oversight from validation while placing generative and agentic AI outside its scope. This piece covers all four, plus the per-request evidence both programs need to demonstrate operation.

Compliance & Regulationai-governanceai-risk-managementnist-ai-rmfiso-42001complianceaudit
Read post →

AI Gateway vs LLM Router: The Architectural Distinction That Matters for Enforcement

An LLM router picks the cheapest or fastest model for a given prompt. An AI gateway evaluates whether the request is permitted before any model receives it. The router optimizes cost and latency. The gateway enforces identity-bound policy and produces a per-decision audit record. This piece walks through the architectural distinction, where the two functions overlap, and why an enterprise running regulated workloads needs the gateway capability regardless of whether routing is in scope.

Platform & Architectureai-gatewayllm-routerengineeringarchitecturepolicy-enforcement
Read post →

AI Gateway vs API Gateway: What Changes When the Payload Is a Prompt

An API gateway enforces auth, rate limits, and routing on REST and gRPC calls. An AI gateway adds prompt classification, identity-bound policy at the request payload level, and per-decision audit records. The two answer different questions about the same network position. This piece walks through the architectural distinction, the auth model differences, what an API gateway cannot enforce at the prompt layer, and where the two should sit together in production.

Platform & Architectureai-gatewayapi-gatewayengineeringarchitecturepolicy-enforcement
Read post →

AI Gateway Performance Benchmark: What to Measure and How

AI gateway performance benchmarks compare proxy products on latency, throughput, and behavior under load. The benchmarks that matter for production deployment are p95 and p99 latency under realistic concurrency, tail-latency behavior when policy evaluation gets expensive, throughput ceiling per node, and behavior under upstream provider degradation. This piece walks through the benchmark methodology that produces production-actionable numbers and the comparison points worth tracking.

Platform & Architectureai-gatewayperformancebenchmarklatencyengineering
Read post →

AI Agent Red Teaming: Attacking the Loop, the Tools, and the Delegated Authority

Red teaming a single-turn chatbot tests whether the model can be talked into saying something. Red teaming an agent tests whether it can be talked into doing something, across a loop with tools, memory, and delegated authority. This covers six agent-specific attack classes, a worked multi-turn escalation, scoping rules, and how to turn findings into enforced controls.

Problem-Awareagentic-aiai-securityprompt-injectionidentity-and-authorizationllm-securitypolicy-enforcement
Read post →