Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Mapping the OWASP Top 10 for Agentic Applications 2026 to Control Points a Policy Gateway Enforces

OWASP GenAI published the Top 10 for Agentic Applications 2026 as a separate framework from the LLM Top 10. The framework adds the "agentic skills" intermediate behavior layer as a new vulnerable component and reorders the threat list around tool invocation, plan corruption, and identity propagation. This article maps each of the 10 categories to specific control points that a policy gateway at the AI request boundary actually enforces, with example policy rules and the audit fields each control writes.

Platform & Architectureai-securityagentic-aillm-securitypolicy-enforcementarchitectureaudit
Read post →

DeepInspect vs Credal: gateway architecture versus internal-AI portal

DeepInspect is a stateless policy gateway in front of any LLM. Credal is an internal AI assistant portal with controls bolted in around the portal product. The two get categorized together, but the enforcement boundary and the audit artifact are structurally different. This comparison walks through where each tool fits, what the per-decision log looks like, and which deployer profile each one serves.

Comparisons & Alternativescomparisoncredalai-gatewayai-securityenforcementaudit
Read post →

DeepInspect vs Protect AI Guardian: per-decision audit versus model-scanning

Protect AI Guardian (now under Palo Alto Networks after the August 2025 acquisition) focuses on model artifact scanning and ML supply chain risks. DeepInspect operates as a stateless policy gateway in the HTTP path between authenticated users or agents and any LLM. The two product categories often get evaluated together, but the enforcement boundary, the audit artifact, and the regulatory fit are different. This piece walks through where each sits.

Comparisons & Alternativescomparisonprotect-aipalo-altoai-gatewayenforcementml-supply-chain
Read post →

AWS Bedrock Guardrails alternatives: where the model-bound control falls short

AWS Bedrock Guardrails covers content filtering, denied topics, and PII redaction for traffic that lands on Bedrock. The control is bound to Bedrock-mediated requests. Enterprises running multi-model AI need a gateway that covers OpenAI, Anthropic direct, Azure AI, and self-hosted models with a single policy plane. This is the alternatives comparison: what the gap is, who fills it, and what to look for when evaluating.

Comparisons & Alternativesalternativesbedrock-guardrailsawsai-gatewaymulti-model
Read post →

Credal alternatives: where the portal pattern stops working

Credal gives employees a sanctioned internal AI portal. The pattern works when employee AI usage is the entire scope. The pattern stops working when machine-to-machine, agent-driven, or vendor-embedded AI traffic must be covered by the same policy and the same audit trail. This piece walks through where the portal stops and what fills the gap.

Comparisons & Alternativesalternativescredalai-portalai-gatewayenforcement
Read post →

NIST AI agent identity Pillars 2 and 3: authorization and audit at the request layer

NIST has framed AI agent identity and authorization around three pillars. Pillar 1 is identification at the request boundary. Pillar 2 is authorization tied to the resolved identity. Pillar 3 is audit and accountability across the request lifecycle. The public comment window on the NIST draft closed April 2, 2026. This piece walks through what Pillars 2 and 3 actually require at the architecture layer and where most enterprise AI deployments fall short.

Platform & Architecturenistai-agent-identityauthorizationauditzero-trust-ai
Read post →

DORA and AI: what EU financial entities have to map by January 2027

The EU Digital Operational Resilience Act took effect January 17, 2025 and treats LLM vendors as critical ICT third parties at scale. By January 2027, EU financial entities have to maintain a Register of Information covering ICT third-party arrangements, run exit-strategy testing for material providers, manage concentration risk, and produce per-decision audit trails for AI-influenced decisions. This piece walks through what DORA actually requires from an AI program and the architecture that satisfies it.

Compliance & Regulationdorafinancial-servicesai-governanceeu-regulationauditbanking
Read post →

HIPAA-compliant LLMs: what the deployer has to produce when OCR shows up

HIPAA does not approve LLMs. HIPAA places obligations on covered entities and business associates around how PHI gets used, accessed, and audited. When OCR opens a complaint review of a clinical AI deployment, the questions are specific: who accessed PHI in what context, with what authorization, with what evidence. This piece walks through what HIPAA actually requires from an AI deployment, what a Business Associate Agreement does and does not cover, and the architecture that produces the audit artifact OCR will ask for.

Compliance & Regulationhipaahealthcarephicomplianceauditclinical-ai
Read post →

Shadow AI in the Enterprise: Definition, Mechanism, and the Architecture That Closes the Gap

Shadow AI is the unauthorized use of AI tools by employees, agents, and embedded vendor features inside an enterprise. IBM Cost of Data Breach finds one in five breached organizations had shadow AI exposure, with $670,000 in incremental cost per incident. Cloud Radix puts unauthorized AI usage at 78% of employees. This pillar walks through what shadow AI is, why traditional DLP cannot see it, and the architecture that contains the blast radius.

Problem-Awareshadow-aiai-securitydlpai-governancecisoenterprise
Read post →

AI Compliance Jobs: What the Roles Actually Do and the Evidence Auditors Expect

AI compliance roles emerged in 2024 and turned into named job families in 2025. The four common roles are AI Compliance Officer, AI Risk Manager, AI Audit Lead, and AI Governance Engineer. Each operates against a different evidence surface: regulatory mapping, risk register entries, audit trail review, and control implementation. Hiring against the wrong evidence surface is the most expensive mistake compliance leaders make.

Compliance & Regulationai-governancecompliancecareersauditriskeu-ai-act
Read post →