Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

LLM Gateway vs API Gateway: Where the Inspection Targets Diverge and Why You Need Both

API gateways inspect HTTP requests against rate limits, authentication tokens, and schema validation. LLM gateways inspect the prompt body, the response body, the identity carrying the request, and the policy bundle bound to the AI route. The inspection targets differ. The two run side by side in a production deployment. This piece walks through the inspection targets each gateway covers, the decisions each commits at request time, the audit record each produces, and the topology where the two compose.

Comparisons & Alternativesllm-gatewayapi-gatewayinline-enforcementaudit-logsai-architectureai-security
Read post →

How to Find Shadow AI Inside Your Organization: A Five-Source Detection Pipeline

Shadow AI lives in the browser tab next to the approved SaaS. The detection stack the security team built for shadow IT does not surface the signal. This piece walks through a five-source detection pipeline (network egress, endpoint telemetry, IdP claims, expense aggregation, approved-route gap analysis), the joining identity that ties the sources together, and the prioritization framework for triaging the patterns the pipeline surfaces.

Problem-Awareshadow-aidiscoverydetectionvisibilitycasbai-discovery
Read post →

Shadow AI vs Shadow IT: Why the Old Detection Stack Misses the AI Request Layer

Shadow IT is the SaaS subscription the security team did not approve. Shadow AI is the LLM the employee opens in the browser tab next to the approved SaaS. The two look similar to the procurement team. They differ at the detection layer the security team built. This piece walks through the four mechanisms shadow IT detection uses, why each one misses the AI request layer, what shadow AI detection has to read instead, and the inspection topology that closes the gap.

Problem-Awareshadow-aishadow-itdiscoverycasbai-discoveryvisibility
Read post →

EU AI Act vs GDPR: How the Two Regimes Diverge on Record-Keeping, Identity, and the Per-Decision Trace

Compliance teams reach for the GDPR record-keeping playbook when the EU AI Act lands on the legal calendar. The two regimes overlap on data subject rights and personal-data scope. They diverge on the cadence of evidence, the identity of the actor the record describes, and the per-decision trace the AI Act requires. This piece walks through the five axes where the regimes diverge, the record formats each regulator reads, and the architectural changes the AI request path needs before August 2, 2026.

Compliance & Regulationeu-ai-actgdprcompliancearticle-12audit-logsgovernance
Read post →

Zero Trust Applied to AI Systems: The Per-Request Identity, Policy, and Audit Boundary

Zero-trust architecture replaces the perimeter assumption with per-request verification of identity, device, and policy. Applied to AI systems, the same principle moves the verification to the AI request boundary: who is making the call, what classification the request carries, what policy version evaluates the call, and what audit record the layer commits. This piece walks through the four zero-trust principles and how each one maps to a concrete decision the AI request path has to commit on every call.

AI Security Solutionszero-trustai-securityidentity-awareaudit-logsinline-enforcementpolicy-enforcement
Read post →

AI Agents vs RPA: How the Security Model Changes When the Bot Reasons Before It Acts

RPA bots execute deterministic scripts under a service account. AI agents read context, plan multi-step actions, and call tools whose return values shape the next step. The security model that worked for RPA (network segmentation, credential vaulting, scheduled execution) breaks when the bot reasons before it acts. This piece walks through the four architectural differences between RPA and AI agents, the new attack surfaces the reasoning step introduces, the identity-aware enforcement the deployment owes, and the audit record format that survives a regulator review.

AI Security Solutionsai-agentsrpaagent-securityidentity-awareaudit-logsagentic-ai
Read post →

Compliance After the Act: The EU AI Act Mindset Shift From Documentation to Per-Decision Evidence

EU AI Act Article 12 takes effect August 2, 2026 and changes what regulators ask of high-risk AI systems. Compliance teams that came from GDPR are familiar with management-level documentation regimes. The Act asks for operational-level per-decision evidence. This piece walks through the four mindset shifts a security and compliance organization has to make: from policy documents to live audit records, from quarterly reviews to per-request decisions, from third-party attestation to first-party evidence, and from boundary controls to per-route enforcement.

Compliance & Regulationeu-ai-actarticle-12complianceaudit-logshigh-risk-aigovernance
Read post →

AI Security for Procurement: The Inspection Layer Between the Diligence Prompt and the Vendor Decision

Procurement teams now use LLM workflows to read vendor questionnaires, summarize SOC 2 reports, draft RFP scoring rationales, and evaluate vendor risk packages. The boundary between the procurement officer identity, the vendor data, the diligence prompt, and the resulting recommendation is where the security and audit obligations sit. This piece walks through the data a procurement LLM workflow reads, the identity-aware policy decisions the deployment commits, the audit record that satisfies EU AI Act Article 12 obligations, and the architectural pattern that closes the post-authentication gap.

Problem-Awareprocurementvendor-diligenceai-securityidentity-awareaudit-logsinline-enforcement
Read post →

AI Security for Marketing Content: The Inspection Layer Between the Drafting Prompt and the Brand-Approved Output

Marketing teams now draft a large share of campaign copy, ad variants, and landing-page hero blocks through LLM workflows. The boundary between the marketer identity, the brief, the brand guideline retrieval, and the generated draft is where the security and audit obligations sit. This piece walks through the data a marketing LLM workflow reads, the identity-aware policy decisions the deployment commits, the audit record that satisfies EU AI Act Article 12 obligations for high-risk marketing claims, and the architectural pattern that closes the gap most content-generation pipelines leave open.

Problem-Awaremarketing-contentcontent-llmai-securityidentity-awareaudit-logsinline-enforcement
Read post →

AI Security for Product Analytics: The Inspection Layer Between the Analyst Prompt and the Customer Data Warehouse

Product analytics teams have moved a significant share of exploration onto LLMs. The analyst asks a natural-language question and the LLM emits SQL that runs against the customer data warehouse. The boundary between the analyst identity, the prompt, the generated SQL, and the warehouse result set is where the security and audit obligations sit. This piece walks through the request-time data an analyst LLM workflow reads, the identity-aware policy decisions the deployment has to commit, the audit record format that satisfies EU AI Act Article 12 and GDPR Article 22, and the architectural pattern that closes the post-authentication gap.

Problem-Awareproduct-analyticsanalyst-llmai-securityidentity-awareaudit-logsinline-enforcement
Read post →

Zero Trust AI: Per-Request Evaluation at the Model Boundary

Zero trust applied to AI means evaluating every model request against verified identity, current policy, and prompt-level classification. The architectural pattern is an enforcement proxy at the HTTP AI request boundary. The post-authentication gap is the most common failure mode in current deployments.

Platform & Architecturezero-trustai-securityidentity-and-authorizationpolicy-enforcementinline-enforcementarchitecture
Read post →

22-Second Breach Windows: Why AI Enforcement Must Be Inline

Mandiant M-Trends 2026 measured median attack handoff at 22 seconds. At that tempo, log-and-alert fails as a control. Inline enforcement at the AI request boundary makes the policy decision before the request reaches the model. Under 50 ms enforcement overhead is invisible against 500 ms to 5 second model inference.

Platform & Architectureai-securityinline-enforcementpolicy-enforcementcybersecurityarchitecturezero-trust
Read post →