Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

HIPAA-Compliant AI Agent Platforms: BAAs, Access Control, and Audit Evidence

HIPAA compliance for an AI agent platform starts with a signed Business Associate Agreement, but the Security Rule also demands access control under 45 CFR 164.312(a) and audit controls under 164.312(b). This guide names the model platforms and healthcare tools that sign BAAs in 2026, then explains why a vendor BAA alone does not produce the identity-bound access-control and audit evidence a covered entity needs across its own clinicians and agents.

Industry Verticalshipaahealthcareai-complianceai-securityidentity-and-authorizationauditpolicy-enforcement
Read post →

NIST SP 800-53 AI Controls Mapping: The Control IDs an AI Gateway Actually Answers

SP 800-53 Revision 5 organises its catalogue into 20 control families, and the COSAiS overlay work that will tailor it for AI is still in draft. An AI system inside an authorisation boundary is assessed today against control identifiers that already exist. This maps the specific controls an identity-aware gateway on AI traffic satisfies, at the AC-3, AC-4, AU-3, AU-9, IA-2, SC-7, SI-4 and SR-3 level, and names the ones it contributes nothing to.

Compliance & Regulationnistcomplianceai-governancearchitectureauditpolicy-enforcement
Read post →

Connecticut LLM Requirements: Scope the Use Before You Build the Control

Connecticut regulates LLM deployments through use-specific rules rather than one universal model standard. Public Act 26-15 covers AI subscriptions, companions, employment technology, certain state-agency systems, frontier developers, and audiovisual provenance. The CTDPA separately governs consumer personal data, profiling, sensitive data, and rights. This guide maps common LLM uses to the correct requirement and the HTTP control evidence available.

Compliance & Regulationcomplianceai-governanceregulationllmai-security
Read post →

Connecticut AI Risk Assessment: Separate the State, Consumer, and Employment Tests

Connecticut AI risk assessment duties depend on role and use. Public Act 26-15 requires state agencies to assess authorized AI procurement and post the assessment before deployment. The CTDPA requires controllers to assess personal-data processing that presents heightened risk. Employment technology adds a separate disclosure and discrimination analysis. This guide turns those branches into a scoped assessment backed by runtime evidence.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

Vector Database Security Checklist: What to Verify Before the Index Goes to Production

A vector index inherits the sensitivity of every document that went into it, and most access-control models were designed for rows, not for nearest-neighbour search. This checklist covers tenant isolation, permission-aware retrieval, ingestion validation, embedding inversion, deletion, and retrieval logging, mapped to OWASP LLM08:2025 and to what an auditor asks for.

Problem-Awareragvector-databaseai-securitydata-classificationowaspaccess-control
Read post →

Connecticut AI Incident Reporting: Three Triggers, Three Different Records

Connecticut has no single, general AI incident report. Public Act 26-15 creates an internal catastrophic-risk reporting process for large frontier developers, the state breach statute governs compromised personal information, and the Connecticut Data Privacy Act gives the Attorney General authority over consumer-data violations. This guide separates the triggers, recipients, clocks, and evidence each path requires.

Compliance & Regulationcomplianceai-governanceregulationauditai-security
Read post →

SOX AI Compliance Checklist for Authenticated LLM Traffic

A SOX AI compliance checklist should test the real route between an authenticated user or agent and an LLM. This checklist assigns scope, authorization, data-flow policy, logging, retrieval, exception handling, ownership, and explicit boundaries so the resulting evidence supports the governing programme without claiming that one gateway delivers full compliance.

Compliance & Regulationai-complianceai-governancesoxfinancial-reportingauditinternal-controls
Read post →

Shadow AI in Mortgage Lending: Borrower Files and Unapproved Model Routes

Shadow AI in mortgage lending can move borrower tax returns, bank statements, credit findings, appraisal notes, and servicing records into model services outside the lender''s approved controls. This article isolates the unauthorized HTTP request path, connects it to Regulation B and the FTC Safeguards Rule, and sets out the identity, content, destination, and evidence controls needed before borrower data reaches an LLM.

Industry Verticalsshadow-aiai-securityai-governancecompliancedata-loss-preventionaudit
Read post →

CVE-2026-90898: An AI Gateway That Runs Your Command Before the MCP Handshake

JFrog Security Research reported CVE-2026-90898 in Bifrost, an open-source AI gateway. One unauthenticated POST to the management API registers an MCP stdio client, and the gateway launches the command inside that definition before any MCP handshake runs. The fix is in transports v2.1.0. This walks the registration path, the configuration condition that exposes it, and the control-plane separation the incident argues for.

Platform & Architectureai-gatewaymcpvulnerabilitycveai-securityplatform-engineering
Read post →

CCPA LLM Requirements: Current Duties and the 2027 ADMT Deadline

CCPA duties attach to LLM deployments through ordinary collection, purpose, retention, contracting, consumer-rights, sensitive-information, and security rules. The CPPA risk-assessment regulations add current pre-launch work for specified processing, while the narrower ADMT consumer-rights rules reach significant decisions by January 1, 2027. This guide separates those obligations and their deadlines.

Compliance & Regulationai-complianceai-governancecomplianceregulationllmpolicy-enforcement
Read post →

Canada AIDA LLM Requirements: The Current Baseline for AI Traffic

Canada has no AIDA requirements for LLMs because Bill C-27 died before passage. The current baseline comes from privacy and public-sector rules already in force: PIPEDA accountability, appropriate purposes, consent, limiting use and disclosure, safeguards and breach records; Quebec Law 25 duties where applicable; and federal guidance and automated-decision rules for government institutions. This guide attaches those duties to the outbound prompt and inbound response.

Compliance & Regulationai-complianceai-governancecomplianceregulationllmpolicy-enforcement
Read post →

Canada AIDA AI Risk Assessment: The Privacy Tests That Apply Today

AIDA died with Bill C-27 before becoming law. A Canadian AI risk assessment now starts with the duties already in force: PIPEDA accountability, appropriate purposes, meaningful consent and safeguards; Quebec Law 25 privacy impact assessments and automated-decision rights where applicable; and the federal Directive on Automated Decision-Making for covered government systems. The unit of analysis is the real data flow, including each LLM request.

Compliance & Regulationai-complianceai-governancecomplianceregulationauditpolicy-enforcement
Read post →