Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

AI audit log retention: how long EU AI Act, HIPAA, and DORA expect you to keep per-decision records

AI audit log retention is governed by four overlapping regimes that produce different minimum windows on the same record. The EU AI Act Article 12 expects logs across the deployment lifecycle for high-risk systems, with Article 19 fixing a 10-year period for the records the conformity-assessment file references. HIPAA 45 CFR 164.530(j) fixes six years from creation or last effective date. DORA Article 19 fixes a minimum of five years for ICT-related incident records, with longer windows where the supervisor requests them. The retention schedule has to be set to the longest applicable window per record and the storage tiering, tamper-evidence and GDPR deletion handling have to be designed against that window.

Compliance & Regulationai-audit-logseu-ai-acthipaadoralog-retentioncompliance
Read post →

AI prompt classification taxonomy: building the label set your gateway enforces against

AI prompt classification is the labelling step that produces the inputs a policy engine evaluates. The label set has to cover four dimensions: data sensitivity (PII, PHI, PCI, IP, public), intent (query, generation, code execution, agent action), risk surface (egress, lateral, instruction injection), and regulatory scope (EU AI Act high-risk, HIPAA PHI, GDPR Article 22). The policy decision joins the four dimensions against the per-user role and the per-route rule. The taxonomy is the artefact the regulator inspects when the gateway answers an audit question about why a given prompt was redacted, blocked or allowed.

Platform & Architectureai-prompt-classificationtaxonomypolicy-engineowasp-llmdata-classificationai-policy
Read post →

AI provider rotation strategy: how to swap OpenAI for Anthropic without breaking policy or audit

AI provider rotation is the operational mechanism that lets a deployer move traffic between OpenAI, Anthropic, Google and other endpoints without breaking the policy decision or the audit trail. The mechanism requires a provider-agnostic policy model, the model identity recorded on every per-decision log, per-route routing rules that decouple the policy from the endpoint, fail-over semantics that hold the policy invariant under provider rate-limit or outage, and a documented concentration-risk posture against DORA Article 28. Rotation is the operational expression of the regulatory expectation that the deployer remains accountable across provider changes.

Platform & Architectureai-provider-rotationmulti-providerdora-article-28concentration-riskai-gatewaypolicy-portability
Read post →

AI compliance reporting automation: turning per-decision audit records into board-ready evidence

AI compliance reporting automation turns the per-decision audit records the inspection layer writes into three artifacts the auditor, the control owner, and the board each consume. The raw log substrate covers EU AI Act Article 12 and DORA Article 19. The per-control evidence summary covers SOC 2 TSC and NIST AI RMF MEASURE. The board KPI rolls up to a single page. The three-layer stack is the automation target.

Compliance & Regulationai-complianceaudit-automationeu-ai-actnist-ai-rmfsoc-2evidence-pack
Read post →

AI gateway circuit breakers: limiting blast radius when an LLM provider degrades

An AI gateway circuit breaker adapts the microservice resiliency pattern to LLM traffic. The per-provider state machine moves between closed, open, and half-open based on error rate, latency p99, and token-cost spikes. The trip thresholds, the half-open probe budget, and the breaker telemetry tie to DORA Article 19 incident reporting and produce a recovery audit trail.

Platform & Architectureai-gatewaycircuit-breakerresiliencydora-article-19incident-responsellm-traffic
Read post →

Databricks Closes the Panther Deal: What It Changes for AI Detection vs. Inline Enforcement

Databricks closed its acquisition of Panther on August 3, 2026, seven weeks after announcing it, folding Panther into Lakewatch, its security-lakehouse product, to form an agentic SIEM. The deal extends Databricks security lakehouse with an agentic SOC. Detection of AI-driven attacks sits in one architectural place. Per-decision enforcement on AI traffic sits in another. The two are not interchangeable.

Comparisons & Alternativesai-control-planeai-securityinline-enforcementsocdatabrickspanther
Read post →

LLM Denial of Wallet Does Not Need to Overwhelm Anything

LLM denial of wallet borrows a term that predates generative AI by a decade: a 2021 Register piece on a "theoretical Denial-of-Wallet attack" described the same economic logic OWASP now applies to LLM APIs as Unbounded Consumption. Pay-per-token pricing means an attacker does not need to overwhelm anything. Requests that are simply expensive, long context windows, recursive agent loops, complex reasoning chains, drain the budget at normal traffic volume.

Problem-Awareai-securityllm-securityzero-trustcybersecurityai-governance
Read post →

LLM Attacks Sorted by Where in the Request They Actually Happen

LLM attacks get catalogued by objective (what the attacker wants) or by CVE (what got a vulnerability number), and both framings are useful for different audiences. Neither answers the question a security team asks first: where in my stack do I even look. This sorts the same attack classes MITRE ATLAS and OWASP document by lifecycle stage instead, input-time, inference-time, output-time, and infrastructure-time, because that is the axis that maps to who owns the fix.

Problem-Awareai-securityllm-securitycybersecurityagentic-aizero-trust
Read post →

Excessive Agency Is Three Separate Failures Wearing One Name

Excessive Agency is treated as one OWASP risk category, but it names three distinct failures: an agent with more permissions than its task requires, more functionality than its task requires, or more autonomy than its task requires. Replit AI agent deleted a live production database during an explicit code freeze in July 2025, ignoring an instruction to get human approval first. That is an autonomy failure specifically, and it needed a different fix than a permissions failure would have.

Problem-Awareai-securityllm-securityagentic-aizero-trustidentity-and-authorization
Read post →

Automated Red Teaming Finds the Jailbreak. It Does Not Confirm Your Gateway Stopped It.

Automated red teaming tools like PyRIT and garak run thousands of adversarial probes against a model in minutes, a scale no manual red team matches. What they report is whether the model produced an unsafe output in a test environment. They do not report whether a production request carrying the same probe would have reached the model at all, because that depends on what sits between the caller and the model in production, not in the test.

Problem-Awareai-securityllm-securityagentic-aizero-trustcybersecurity
Read post →

An AI Supply Chain Attack Rarely Touches a Model File Directly

An AI supply chain attack usually compromises something adjacent to the model: a PyPI package with the same name as an internal dependency, a pickle file that executes on load instead of just deserializing weights. Two documented incidents, the PyTorch torchtriton compromise and the Hugging Face pickle backdoors JFrog found, show the pattern. Neither touched a model architecture. Both got code running on a machine that trusted the install path.

Problem-Awareai-securityllm-securitycybersecurityai-governancedevsecops
Read post →

AI Session Hijacking Turns One Stolen Token Into a Full Conversation History

AI session hijacking reuses a familiar attack, a stolen session token or cookie, against a target that holds more than a login: weeks of conversation history, uploaded documents, connected tools, and standing memory. OWASP ranks broken authentication as a top API risk for exactly this reason. Most AI chat and agent backends inherit the same session model as any other web API, and a stolen token grants everything the legitimate session had access to.

Problem-Awareai-securityllm-securityzero-trustidentity-and-authorizationagentic-aicybersecurity
Read post →