FERPA and AI Tools: School Official Exception
FERPA applies to AI tools that touch education records. Here''s when the school official exception covers your AI vendor, and when it doesn''t.
Read post →Blog
Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.
Dropbox Dash Admin Activity Logs: What They Prove
See what Dropbox Dash admin activity logs prove, which records they miss, and how to trace an AI answer to its user, source, policy, and LLM call.
Platform & Architectureauditforensic-auditai-securityllm-securityidentity-and-authorizationarchitecture
Read post →Claude Enterprise Security: SSO, SCIM, and Audit Logs
Claude Enterprise security: SSO, SCIM, audit logs, no-training defaults, and the authorization gap on every API request.
Platform & Architectureai-securityllm-securityidentity-and-authorizationinline-enforcementarchitecturepolicy-enforcementaudit
Read post →AWS Bedrock Audit Logs Explained
How Amazon Bedrock model invocation logging and CloudTrail record AI calls, and why the identity.arn field is not a natural-person record.
Read post →AI Vendor Security Questionnaire: 38 Questions to Ask
Use 38 AI vendor security questions to assess model coverage, retention, audit records, policy controls, and incident response before signing.
Comparisons & Alternativesvendor-managementprocurementai-governancesecurity-questionnairethird-party-risk
Read post →LLM Agent Incident Response: Containment and Forensics
LLM agent incident response playbook for containment, eradication, recovery and forensics, with request-boundary evidence for the SOC.
Read post →AI Firewall vs AI Gateway vs AI Proxy: Key Differences
Compare AI firewall, AI gateway, and AI proxy roles: content checks, routing, HTTP enforcement, and identity-aware audit evidence.
Read post →AI API Gateway: Architecture, Controls, and Fit
AI API gateway architecture explained: routing, identity-aware policy, prompt logging, and its difference from a traditional API gateway.
Read post →ChatGPT DLP: Prompt Controls and Enterprise Options
ChatGPT DLP inspects prompts before they reach the model, then blocks, redacts, or logs sensitive data with identity-aware policy.
Read post →AI Policy Generator: Free Internal Policy Template
Use this free AI policy generator to create a seven-section internal AI use policy in 15 minutes, ready for legal review and version control.
Read post →AI Vendor Due Diligence Checklist: 30 Questions
An AI vendor due diligence checklist with 30 evidence requests for model use, data handling, identity, audit records, and regulatory review.
Read post →LLM Security Tools: 6 Categories and How to Choose
The best LLM security tools cover six jobs: guardrails, gateways, AI-aware DLP, testing, agent controls, and audit evidence. Choose by control point.
Read post →