Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.
AI agent authorization is the per-request decision about whether a specific caller, against a specific resource, under a specific policy, is allowed to act. NIST calls it delegated authority. Most enterprise AI deployments solve authentication and skip authorization.
Read post →CISOs are accountable for AI risk in front of boards that ask for specific numbers, specific incidents, and specific evidence. The post-authentication gap, the self-attestation problem, and the inline enforcement requirement are the three architectural facts that shape the answer.
AI compliance officers are accountable for evidence that survives a regulatory review. EU AI Act Article 12, Fannie Mae LL-2026-04, NIST AI RMF, and HIPAA each require per-decision records of AI activity, independent of the application that made the decision.
Read post →AI platform engineers operate the gateway, the model routing, the identity plumbing, and the eval pipeline that production AI runs on. Adding inline enforcement and per-decision audit at the request boundary determines whether the platform can absorb the security and compliance asks.
Heads of Security own the production controls that prevent damage at machine speed. AI traffic is the data channel where the controls have to operate. The Mandiant 22-second handoff window and the IBM shadow AI numbers determine what counts as a working control today.
AI platform leads operate the gateway, the model registry, the eval pipeline, and the identity plumbing that production AI runs on. The choice of an enforcement layer at the AI request boundary determines whether security and compliance are absorbed by the platform or pushed onto feature teams.
The AI Prompt Risk Scanner is a free tool that inspects a sample of your organization prompts against the same detection rules a production inspection layer would apply. Paste a prompt or upload a batch, and the scanner returns the data classes detected, the regulatory exposures triggered, and the policy outcomes that would fire under standard rules. This piece walks through what the scanner inspects, how the rules work, and what to do with the results.
Read post →ABA Formal Opinion 512, issued July 29, 2024, sets the duty of competence, confidentiality, and supervision standards for lawyers using generative AI tools. Model Rule 1.6 confidentiality, Rule 1.1 competence, and Rule 5.3 supervision of nonlawyer assistance all attach to AI workflows that touch client information. State bar opinions from California, Florida, New York, and Pennsylvania add jurisdiction-specific overlays. The architecture that supports a defensible position under examination is per-decision audit records that show what client data the AI received and what the firm did with the output.
Read post →OMB Memorandum M-24-10, issued March 28, 2024, set the AI governance baseline for federal civilian agencies including risk management for rights-impacting and safety-impacting AI, a Chief AI Officer designation, and public inventories of AI use cases. The Office of Personnel Management AI guidance, the Department of Homeland Security AI framework, and DOD Responsible AI Strategy add agency-specific obligations. The NIST AI Risk Management Framework provides the technical baseline. State-level laws including Colorado SB 24-205, Connecticut SB 2, and California AB 2930 add overlays on state-agency and state-contractor AI. The architecture that supports the OMB-required risk management has the same shape as private-sector high-risk AI compliance.
Read post →Clinicians using generative AI to draft SOAP notes from ambient recordings of patient encounters trigger the HIPAA Security Rule the moment PHI enters the prompt. The audit controls expectation under 45 CFR 164.312(b), the access control expectation under 164.312(a), and the transmission security expectation under 164.312(e) all attach. Vendor BAAs cover the vendor side; the covered entity has to produce its own evidence on its own side of the API. This piece walks through the architecture that satisfies the Security Rule for ambient-AI scribe workflows.
Read post →B2B SaaS vendors that added AI features in the last twelve months are now meeting an enterprise security review process that did not exist when the product was scoped. Buyers ask about identity context at the model API call, per-decision audit records, prompt-level data classification, and the deployment regime under the EU AI Act. Sales cycles stall on questions the engineering team did not anticipate. This piece walks through what enterprise security reviews now ask of SaaS-with-AI vendors, where most product architectures are exposed, and the inspection layer that closes the gap before procurement does.
Read post →Annex III point 5(b) of the EU AI Act classifies AI used to evaluate the creditworthiness of natural persons or establish a credit score as high-risk. From August 2, 2026 the deployer obligations under Article 26 and the provider obligations under Articles 8 through 17 apply. The text exempts AI used only for the detection of financial fraud. Most bank credit deployments today combine scoring, fraud detection, and bureau enrichment in a single pipeline that triggers high-risk classification end-to-end. This piece walks through what the classification means, where bank pipelines blur the fraud-vs-scoring line, and the architecture that produces audit records the supervisor will accept.
Read post →