Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

AI Governance for Credit Unions Starts With Member-Data Routes

AI governance for credit unions should connect each approved use case to member-information sensitivity and a named owner. It should also record an authorized model route and evidence of the decision made on every request. NCUA safeguarding guidance already expects board oversight and risk assessment. It also expects coordinated controls, service-provider supervision, and reporting. An AI program has to extend those practices into prompts, responses, embedded vendor features, and model changes.

Industry Verticalsai-governanceai-compliancepolicy-enforcementidentity-and-authorizationaudit
Read post →

AI Governance for Capital Markets Needs a Use-Case Control Map

AI governance for capital markets should classify each use by business function, information type, customer impact, and regulatory owner. Research summarization, investment banking work, communications review, surveillance, and trading support need different permissions, testing, supervision, and evidence even when they call the same LLM provider.

Industry Verticalsai-governanceai-compliancecomplianceauditpolicy-enforcementidentity-and-authorization
Read post →

AI Governance for Accounting Firms Starts at the Client-Data Boundary

AI governance for accounting firms needs separate rules for research, audit work, attest work, and tax engagements. A defensible program identifies approved LLM routes, limits the client data each route can receive, keeps engagement professionals responsible for outputs, and retains evidence of each policy decision. Request-layer controls can support that program only when authenticated HTTP model traffic passes through the enforcement point.

Industry Verticalsai-governanceai-complianceauditpolicy-enforcementidentity-and-authorization
Read post →

Zoom AI Companion Security: Separate Content, Models, and Controls

Zoom AI Companion security depends on the content source and function in use. The model deployment, administrator setting, and retention configuration also matter. A useful review traces meeting transcripts and chat messages separately from connected-source content and task execution. It also distinguishes Zoom-managed AI processing from any customer-controlled HTTP model route where an independent request-policy decision could operate.

Platform & Architectureai-securityllm-securityidentity-and-authorizationpolicy-enforcementcloud-security
Read post →

Windsurf Security: Six Devin Desktop Boundaries to Review

Windsurf security now needs current Cognition terminology. Devin Desktop provides native controls for SSO, SCIM, RBAC, model availability, terminal execution, MCP access, deployment, and sharing. Cognition separately documents encryption and customer-data practices. These preventive controls need distinct owners, and only configurable AI HTTP traffic can pass through an independent request-policy gateway.

Platform & Architectureai-securityagentic-aiidentity-and-authorizationzero-trustcloud-security
Read post →

Windsurf Audit Logs: Reading the Current Devin API Evidence

Windsurf audit logs now require a terminology check. Cognition's current documentation exposes enterprise audit events through Devin API v3, while legacy Windsurf Enterprise remains an authentication and billing qualifier. The v3 endpoint supports service-user RBAC and time filters. It also supports action filters and cursor pagination, with actor fields in the response. Investigators still need a separate request-policy record for routed AI HTTP calls.

Platform & Architectureai-securityauditforensic-auditidentity-and-authorizationagentic-ai
Read post →

Zapier AI Security: Separate Workflow Controls from Model Routes

Zapier governs AI-enabled automation through publishing controls, app access, managed connections, model restrictions, audit records, AI Guardrails, and scoped MCP tools. Those controls operate inside Zapier. An independent policy gateway covers a narrower path: authenticated LLM inference requests that a supported integration explicitly routes through an external HTTP enforcement point.

Platform & Architectureai-securityagentic-aillm-securitypolicy-enforcementidentity-and-authorization
Read post →

WRITER Security: Map Platform Controls to the Model Route

WRITER combines identity validation, permissions, approval flows, activity traces, model controls, and governed access to connected systems inside its enterprise AI platform. A security review should verify those native controls and then inventory every separate LLM route. Independent request authorization applies only where authenticated HTTP model traffic is explicitly routed through an enforcement gateway.

Platform & Architectureai-securityllm-securityzero-trustpolicy-enforcementidentity-and-authorization
Read post →

Vertex AI Security: Five Native Controls and the Request Gap

Vertex AI security now sits under Google''s Gemini Enterprise Agent Platform name. Google documents separate controls for residency and customer-managed encryption keys, plus service perimeters and provider access visibility. It also documents retention. Their availability varies by model and operation. A routed AI request still needs caller-aware policy before inference when project IAM represents a shared application rather than the originating person or agent.

Platform & Architectureai-securitycloud-securityidentity-and-authorizationzero-trustpolicy-enforcement
Read post →

Snowflake Cortex Security: A Preventive Hardening Review

Snowflake Cortex security requires explicit control over AI function privileges, model RBAC, inference geography, runtime guardrail scope, and Trust Center scanner coverage. A preventive review assigns owners and tests denied paths before production. External policy enforcement applies only to customer-controlled authenticated HTTP LLM traffic routed through a separate proxy.

Platform & Architectureai-securitycloud-securityidentity-and-authorizationzero-trustpolicy-enforcement
Read post →

ServiceNow AI Security: Separate Guardian, Roles, and Request Policy

ServiceNow AI security combines in-platform AI Guardian checks, administrative roles, application configuration, and the Generative AI Controller connection to third-party models. A useful review tests each boundary separately, confirms the guardrail scope for every skill, and adds an external request-policy decision only where customer-controlled authenticated HTTP traffic can be routed through it.

Platform & Architectureai-securityprompt-injectionidentity-and-authorizationpolicy-enforcementcloud-security
Read post →

Snowflake Cortex Audit Logs: Build the Evidence Chain Across Views

Snowflake Cortex audit evidence is distributed across function usage, agent usage, query history, and access history. Investigators need explicit joins, latency notes, historical-coverage qualifications, and a preserved correlation value. A separate policy-decision record adds request authorization only for customer-controlled authenticated HTTP LLM calls routed through an external gateway.

Platform & Architectureforensic-auditauditai-securityai-governancecompliance
Read post →