Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Singapore MAS Wrote Down Three Runtime Questions for AI Agents in Finance

On 5 August 2026 the Monetary Authority of Singapore answered a parliamentary question on agentic AI in financial services, confirming that its proposed Guidelines on AI Risk Management cover all AI use cases at financial institutions including AI agents. The companion paper published on 3 July 2026, Safeguards for Agentic Finance at Runtime, sets out three questions: what the system is authorised to do, how proposed actions are assessed before execution, and what records are retained. Those three describe a policy decision point.

Industry Verticalsai-governanceai-complianceregulationagentic-aipolicy-enforcementaudit
Read post →

Australia Privacy LLM Requirements: Inputs, Outputs and Evidence

Australia privacy requirements for LLM deployments follow the existing Privacy Act and Australian Privacy Principles. Organisations need a defined purpose, lawful collection, notice, permitted use or disclosure, cross-border analysis, accurate outputs, security controls, access and correction paths, deletion handling, and evidence for each request route.

Compliance & Regulationai-complianceai-governancecomplianceregulationllmpolicy-enforcement
Read post →

AI Governance for Security Architects: Put Policy on the Model-Call Path

A security architect turns AI governance requirements into trust boundaries, identity flows, policy decision points, and evidence paths. This article maps the role to the HTTP model-call boundary, where authenticated users and agents can be evaluated against data classification, model authorization, and policy before a request leaves the enterprise.

Industry Verticalsai-governanceai-securityarchitecturezero-trustidentity-and-authorizationpolicy-enforcement
Read post →

Australia Privacy AI Risk Assessment: An OAIC-Aligned PIA Workflow

An Australia privacy AI risk assessment should begin before product selection and follow the OAIC privacy impact assessment process through data-flow mapping, APP analysis, mitigation, approval, and review. The assessment becomes operational when each privacy risk maps to an owner, runtime control, test, and retained artifact.

Compliance & Regulationai-complianceai-governancecomplianceregulationauditpolicy-enforcement
Read post →

AI Governance for ML Engineers: Put the Control Contract Into the Deployment Path

ML engineers make AI governance executable by binding model releases to owners, approved purposes, data classes, evaluation evidence, routes, and rollback conditions. Runtime model calls then need identity-aware policy and a decision record so production use can be traced to the control contract approved for that release.

Industry Verticalsai-governancedevsecopsarchitecturepolicy-enforcementauditnist-ai-rmf
Read post →

Atlassian AI Compliance: Turn Rovo Settings into Reviewable Evidence

Atlassian AI compliance starts with the published Rovo data path, then moves into customer-owned evidence. Review model routing, app-level activation, connector permissions, data contribution settings, residency choices, audit logs, and the policy decision on personal or regulated data before it reaches an LLM.

Compliance & Regulationai-complianceai-governancecomplianceauditpolicy-enforcementidentity-and-authorization
Read post →

AI Governance for SOC Analysts: Turn Policy Decisions Into Investigable Events

A SOC analyst needs AI governance to produce events that can be triaged, correlated, and escalated. This article defines the event fields, detection logic, evidence chain, and response handoffs for governed HTTP model traffic, while keeping endpoint activity, local MCP processes, and destination-system actions inside their proper control boundaries.

Industry Verticalsai-governanceai-securitycybersecurityforensic-auditauditpolicy-enforcement
Read post →

SR 11-7 AI Audit Evidence After SR 26-2

SR 11-7 AI audit evidence needs a current-source correction before fieldwork begins. SR 26-2 superseded the 2011 letter on April 17, 2026 and excludes generative and agentic AI from direct scope. Banks that apply its model-risk disciplines to LLMs through internal policy should freeze complete populations, let reviewers select samples, trace each request to approval and change records, and preserve gaps through retest.

Industry Verticalsai-complianceai-governanceauditforensic-auditregulationpolicy-enforcement
Read post →

SR 11-7 AI Controls Mapping After SR 26-2

This SR 11-7 AI controls mapping uses the current SR 26-2 source and assigns bank-defined LLM controls to real owners. It maps governance, inventory, review, monitoring, change, third-party, and routed HTTP objectives to implementation points, repeatable tests, evidence, coverage verdicts, and open gaps while preserving the direct-scope exclusion for generative and agentic AI.

Industry Verticalsai-complianceai-governanceauditregulationpolicy-enforcementforensic-audit
Read post →

AI Governance for Risk Managers: Turn Risk Appetite Into Runtime Decisions

A risk manager can approve an AI risk appetite and maintain the risk register. The role can assign control owners yet still lack evidence that production requests stayed inside those limits. This article gives the role an operating model for translating risk statements into request-level rules and monitoring exceptions, with escalation decisions supported by a traceable record.

Industry Verticalsai-governanceai-compliancenist-ai-rmfauditpolicy-enforcementcompliance
Read post →

RCW 19.373 AI Controls: Consent, Owners and Evidence

RCW 19.373 requires separate sharing consent before consumer health data reaches an external AI provider. This Washington My Health My Data Act control map assigns each duty to an accountable owner, a runtime or process test, and evidence that can show a regulator what happened.

Compliance & Regulationcomplianceregulationai-complianceai-governancepolicy-enforcementaudit
Read post →

Glean Security Review: Trust Center, Access and AI Egress

Use Glean’s Trust Center as the starting point, then test connector access, source permissions, identity propagation, and the model egress decision. A controlled answer request should leave a record that ties the originating user, source reference, model route, policy version and outcome together.

Platform & Architectureai-securityllm-securityzero-trustpolicy-enforcementidentity-and-authorizationarchitecture
Read post →