Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Shadow AI Governance Framework: From Discovery to Enforcement

A shadow AI governance framework defines how an enterprise discovers, classifies, controls, audits, and reports on AI usage that runs outside the IT-sanctioned stack. The five layers map onto the EU AI Act Article 26 deployer obligations, the NIST AI RMF Govern function, and the ISO 42001 AI management system. Most organizations have policy and discovery covered. The control and audit layers are where the framework usually stops short of operational coverage. The piece walks through what each layer has to produce.

Problem-Awareshadow-aigovernancecomplianceeu-ai-actnist-ai-rmfenterprise-ai
Read post →

Shadow AI Monitoring Tools: What to Measure and Where to Operate

Shadow AI monitoring tools observe employee AI usage that runs outside the IT-sanctioned stack. The category covers browser extensions that intercept ChatGPT and Claude sessions, CASB integrations that surface AI SaaS use, network telemetry that flags AI endpoints, and identity-aware proxies that route AI traffic through a policy point. Most tooling today produces visibility without enforcement. The architectural distinction that matters for compliance is whether the tool can block, redact, or modify AI traffic at the moment of the request, not just record it after the fact.

Problem-Awareshadow-aimonitoringai-securitygovernanceenterprise-aienforcement
Read post →

EU AI Act Article 9: What the Risk Management System Obligation Requires

Article 9 of the EU AI Act requires a risk management system for every high-risk AI system, running as a continuous iterative process across the lifecycle. The obligations include risk identification, risk estimation, risk evaluation, and the adoption of risk management measures. The August 2, 2026 deadline applies. Most enterprise AI deployments treat risk management as a documentation exercise that ends at conformity assessment. The Article 9 reading expects an operating system that produces evidence at every decision point.

Compliance & Regulationeu-ai-actarticle-9risk-managementcompliancehigh-risk-aigovernance
Read post →

Agentic AI Risk: Mapping the New Failure Modes to Enterprise Controls

Agentic AI risk is the set of failure modes that emerge when AI systems take autonomous actions. The risk register has to extend beyond the chatbot risks (data leakage, prompt injection) to cover unauthorized action execution, identity escalation through static credentials, action lineage gaps, and downstream system impact. This piece walks through the failure modes, the existing control frameworks that apply, and the architectural primitive that closes the per-action enforcement gap.

Problem-Awareagentic-aiai-agentsai-riskai-governanceai-securitycompliance
Read post →

PII Detection in LLM Prompts: Classifier Choices and the Per-Request Decision

PII detection on LLM prompts has to operate at request latency, work on free-form text, and produce a deterministic classification that drives a policy decision. The classifier choices fall into three categories: regex and lookup tables, small purpose-trained models, and LLM-based classifiers. Each has a latency and coverage profile. This piece walks through the choices, where each fits, the integration into the AI request boundary, and the audit record the classification produces.

AI Security Solutionspiiai-dlpllm-dlpclassificationgdprdata-protection
Read post →

Copilot DLP: Inspecting What Microsoft Copilot Sends to the Model

Copilot DLP is the practice of detecting and preventing sensitive data movement through Microsoft Copilot, GitHub Copilot, and the broader Copilot product family. The Copilot products operate inside enterprise workflows where confidential data is the default content. Traditional DLP at the email gateway, the endpoint, and the network layer misses the prompt-content movement. This piece walks through where Copilot DLP needs to operate, what classifiers matter for the Copilot data surfaces, and how the per-request audit record satisfies the Article 12 disclosure obligation.

AI Security Solutionscopilotai-dlpllm-dlpmicrosoft-365github-copilotdata-protection
Read post →

AI Gateway Sub-50ms Latency: What the Number Actually Buys You

Sub-50ms latency on an AI gateway sets the per-request overhead below the noise floor of LLM inference (500ms to 5 seconds). The architectural property the number reflects is local policy evaluation, in-memory classification, and stateless horizontal scaling. This piece walks through how the budget is spent, where the latency typically hides, the benchmark methodology that produces production-actionable numbers, and how sub-50ms behavior changes the decision about inline versus out-of-band enforcement.

Platform & Architectureai-gatewaylatencyperformanceinline-enforcementarchitectureengineering
Read post →

AI Agent Control Plane: Identity, Authorization, and Action Lineage

An AI agent control plane is the architectural layer that authorizes agent actions, enforces identity-bound policy on each action, and records action lineage for audit. The pattern emerged because the chatbot architecture (one prompt, one response, one log) does not cover the action surface autonomous agents produce. This piece walks through the control plane primitives, the integration points with the agent framework, and the performance characteristics the layer needs to maintain under production load.

Platform & Architectureai-agentsagentic-aiai-control-planeauthorizationai-securityarchitecture
Read post →

Agentic AI Compliance: Where the Existing Frameworks Apply and Where They Fall Short

Agentic AI compliance is the application of EU AI Act, NIST AI RMF, ISO 42001, and sector regulations to autonomous AI systems that take actions on behalf of users. The frameworks were written before agentic systems were widely deployed. The Article 12 logging obligation applies. The NIST identity and authorization framework applies. The audit and disclosure obligations apply. The gap is that none of them name the action-level evidence requirement explicitly. This piece walks through where existing frameworks apply, where they fall short, and what the per-action evidence layer has to produce.

Problem-Awareagentic-aiai-agentscomplianceeu-ai-actnist-ai-rmfai-governance
Read post →

AI Governance Audit Framework: What Auditors Actually Test

An AI governance audit framework tests three layers: policy artifacts, control operation, and per-request evidence. The auditor reads the policy, samples requests, and traces each sampled request through the control to the evidence record. Programs that pass tend to share six properties. Programs that fail typically fail at the evidence layer because the audit record does not exist or is under the same control as the application generating the request. This piece walks through the framework, the six properties, and the architecture the framework depends on.

Compliance & Regulationai-governanceauditcomplianceeu-ai-actsoc-2iso-42001
Read post →

Shadow AI Breach Examples: Five Patterns That Keep Repeating

Shadow AI breaches now cost an average of $670,000 more than standard breaches and take 247 days to detect, per the IBM 2026 Cost of Data Breach study of 600 organizations. The breach patterns repeat across industries: source code into consumer ChatGPT, PHI into unauthorized models, MNPI in research workflows, customer PII through embedded SaaS AI, and prompt injection on agentic workflows. This piece walks through five patterns, the architectural common cause, and the enforcement layer that removes the surface.

Problem-Awareshadow-aibreachincidentai-securitydata-lossai-governance
Read post →

AI Usage Policy Examples: Six Working Templates by Industry

Working AI usage policy examples have to match the regulatory regime they live under. The healthcare policy turns on PHI and the BAA. The financial services policy turns on MNPI and DORA. The SaaS policy turns on customer data and the EU AI Act deployer obligations. This piece walks through six industry-calibrated policy examples, the specific clauses that distinguish them, and the enforcement layer all six share.

Problem-Awareai-usage-policypolicy-templatecomplianceai-governanceshadow-aiindustry
Read post →