Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Agent-to-Agent Authorization: Deciding What a Delegated Agent May Do Before It Calls the Next Model

When one AI agent hands work to another, or calls a tool or a model on a user behalf, authentication proves which agent is calling and authorization decides whether that agent may take this action with this data right now. Many agent stacks solve the first and skip the second, so a delegated agent inherits the full permissions of whatever credential it holds. This piece walks the authorization decision on agent-to-agent traffic, the delegated-authority and action-lineage requirements behind it, and how to enforce and record it on the HTTP calls the agents actually make.

Problem-Awareagentic-aiidentity-and-authorizationai-securityai-agentspolicy-enforcementnist-ai-rmfinline-enforcement
Read post →

HITRUST LLM Requirements for Identity, Data, and Evidence

HITRUST LLM requirements are an application of scoped security and privacy controls to a real model workflow, rather than a universal checklist for every deployment. This guide translates the request path into requirements for identity, prompt data, approved destinations, configuration, incident handling, and evidence.

Compliance & Regulationai-compliancehitrustllmauditidentity-and-authorizationpolicy-enforcement
Read post →

HITRUST AI Incident Reporting for Model Traffic

HITRUST AI incident reporting needs request-level facts before an incident team can classify impact or meet an external notice duty. This guide defines the AI incident record, explains how to preserve model-route evidence, and separates internal response from legal reporting decisions.

Compliance & Regulationai-compliancehitrustincident-responseauditllm-securitypolicy-enforcement
Read post →

HITRUST AI Risk Assessment at the LLM Request Boundary

A HITRUST AI risk assessment should connect the system inventory and risk analysis to the exact HTTP requests that reach model providers. This guide defines the assessment unit, maps risks to identity and data controls, and specifies evidence that an assessor can sample without claiming that a gateway covers the whole HITRUST scope.

Compliance & Regulationai-complianceai-governancehitrustrisk-assessmentauditpolicy-enforcement
Read post →

Gong AI Compliance Requires an Operating Control File

Gong publishes a substantial compliance posture, including SOC 2 Type II and ISO/IEC 42001:2023, plus customer controls for retention, redaction, access, and deletion. A Gong AI compliance program still needs a customer-owned operating file that records lawful purpose, recording rules, enabled features, data scope, control owners, change approvals, and recurring evidence tests. This article separates vendor assurance from the controls the deploying enterprise must operate.

Compliance & Regulationai-complianceai-governancecomplianceauditidentity-and-authorizationpolicy-enforcement
Read post →

FedRAMP AI Risk Assessment: Test the LLM Route Inside the Boundary

A FedRAMP AI risk assessment should treat the LLM workflow as part of a defined cloud-service boundary and test threats, vulnerabilities, likelihood, impact and response against real model routes. NIST SP 800-53 RA-3 supplies the core risk-assessment structure, while current FedRAMP controls and ongoing certification rules keep the result attached to authorization evidence and production change.

Compliance & Regulationai-complianceai-governancenistauditai-securityarchitecture
Read post →

FedRAMP AI Incident Reporting Starts with the Model Request Record

FedRAMP AI incident reporting should connect the affected federal customer data, model route, request identity and policy decision to the current FedRAMP Incident Evaluation and Communication process. The 2026 rules use FedRAMP Reportable Incident criteria, Potential Agency Impact ratings and class-specific reporting timeframes. This guide shows how to build the incident record and preserve the HTTP AI evidence behind each report.

Compliance & Regulationai-complianceai-governanceregulationauditai-securitynist
Read post →

Glean Compliance: Join Connector, Identity, AI, and Audit Evidence

Glean compliance requires a joined evidence package across SSO, connector credentials, source permissions, query processing, AI use cases, administration changes, and retention. Glean documents a shared-responsibility model, tenant-specific query endpoints, and separate administrative and customer-event logs. This guide turns those provider facts into a customer control file while keeping native Glean activity separate from enterprise-routed HTTP model traffic.

Compliance & Regulationai-complianceai-governancecomplianceauditpolicy-enforcementidentity-and-authorization
Read post →

FedRAMP LLM Requirements Follow the Authorized Cloud Service Boundary

FedRAMP LLM requirements come from the authorized cloud service boundary, applicable NIST SP 800-53 controls, agency authorization and current ongoing-certification rules. FedRAMP creates no separate model checklist. Teams should document the model route, propagate identity, control data flow, generate decision records, manage provider changes and prepare incident evidence for every in-scope LLM workflow.

Compliance & Regulationai-complianceai-governancenistllmauditarchitecture
Read post →

EU Data Governance Act LLM Requirements Follow the Data-Sharing Role

EU Data Governance Act LLM requirements arise when a model workflow participates in protected public-sector data re-use, data intermediation or recognised data altruism. The regulation creates no separate LLM category. Teams should translate the applicable role, purpose, holder rights, security, activity logging and international-access safeguards into controls on each model request.

Compliance & Regulationai-complianceai-governanceregulationllmauditpolicy-enforcement
Read post →

EU Data Governance Act AI Risk Assessment: Scope the Data Route

An EU Data Governance Act AI risk assessment should start with the organization's statutory role, the data holder, the permitted purpose and the route used for each model request. The DGA supplies role-specific duties for protected public-sector data re-use, data intermediation and data altruism rather than a generic AI assessment form. This guide turns those duties into testable AI traffic scenarios and evidence requirements.

Compliance & Regulationai-complianceai-governanceregulationauditai-securitypolicy-enforcement
Read post →

Harmonic Security Alternatives: 4 Control Categories

Compare Harmonic Security alternatives by control layer: workforce AI governance, web and SaaS policy, LLM gateways, and identity-bound API enforcement. Use the traffic path and authenticated identity to select a control that fits employee use, application integrations, or both.

Comparisons & Alternativesai-securityshadow-aidata-loss-preventionzero-trustinline-enforcementidentity-and-authorization
Read post →