Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

AI Output Provenance Means Two Different Records, and Only One Is Yours

AI output provenance gets treated as one problem when it is two. Model-layer watermarking answers whether a system produced a piece of content. It says nothing about which identity inside an enterprise generated a specific output, under which policy, at what time. NIST catalogs the technical approaches to the first question. Almost nobody has built the second record, and it is the one an auditor actually asks for.

Problem-Awareai-securityai-governancellm-securityauditforensic-auditai-compliance
Read post →

Non-Human Identity for AI Agents: Why Service Credentials Are the Wrong Primitive

Non-human identity covers the API keys, OAuth tokens, and workload identities that authenticate services and agents to APIs. AI agents have outgrown the static-service-credential model. A single agent can act on behalf of many users, hold delegated authority that varies by task, and produce decisions that need per-action attribution. This piece walks through the four properties an NHI for AI agents must have, why static API keys fail each of them, and how identity-bound policy at the AI request boundary closes the gap.

Platform & Architecturenon-human-identityai-agentsidentityengineeringnist-ai-rmf
Read post →

Shadow AI for the CISO: The Three Boards a Detection Program Has to Cover

Cloud Radix data shows 90% of CISOs rank shadow AI as their top security concern for the year. The detection program has to cover three boards a typical detection stack does not look at: browser extensions, IDE plug-ins, and chat-platform apps. This piece walks through the three populations, the detection signal for each, the regulatory exposure under EU AI Act Article 26 and HIPAA, and the policy enforcement layer that closes the loop after detection.

Industry Verticalsshadow-aicisodetectionenforcementai-security
Read post →

AI Agent Tool Permissions: The Authorization Layer Between Reasoning and Action

An AI agent that holds the union of every tool permission its operating role might ever need is over-privileged on every call where the actual task uses only one tool. Tool permissions need a per-task authorization layer: identity of the requesting user, scoped delegation for the task, and a gateway decision per tool call. This piece walks through the four properties a tool-permission policy needs and where the policy decision lands at the AI request boundary.

Problem-Awareai-agentstool-permissionsauthorizationengineeringidentity
Read post →

Agent-to-Agent Authentication: How One Agent Verifies Another at the API Boundary

Multi-agent systems route work between agents that authenticate to one another. The pattern that worked for service-to-service traffic (mTLS plus a shared service account) under-attributes the action. Agent-to-agent authentication needs the workload identity of the calling agent plus the delegation chain back to the natural person, plus per-call records that capture the chain. This piece walks through the three properties an agent-to-agent auth model must support, the token-exchange pattern that satisfies them, and where the policy decision lands.

Problem-Awareai-agentsauthenticationidentityengineeringmulti-agent
Read post →

AI Gateway Deployment Patterns: Four Topologies and When Each One Fits

Where an AI gateway sits in the network topology determines what it can enforce and what it can record. Four deployment patterns dominate production: inline reverse proxy in front of the model, sidecar to the agent runtime, in-region replicas for low-latency multi-region, and dedicated tenant gateway per customer in a multi-tenant SaaS. This piece walks through the four, what each enforces, what each records, and the operational trade-offs.

Platform & Architectureai-gatewayengineeringarchitecturedeployment-patternssre
Read post →

OWASP LLM02: Insecure Output Handling and the Trust Boundary Most Apps Get Wrong

OWASP LLM02 covers insecure output handling: the application trusts the model output and passes it to a downstream sink (database, browser, shell) without classification or filtering. The result is SSRF, XSS, SQL injection, and command injection where the LLM is the unintended source. This article walks through the LLM02 categories, the trust-boundary error most applications make, and the gateway-layer controls that contain the blast radius.

Problem-Awareai-securityowaspllm-securityoutput-handlingarchitecturetrust-boundary
Read post →

OWASP LLM07: System Prompt Leakage and Why Secrets in System Prompts Are Always Wrong

OWASP LLM07 covers system prompt leakage: the application embeds secrets, internal policy, or sensitive instructions in the system prompt, and an attacker extracts them through prompt manipulation. The category gets misread as a prompt-injection variant. The actual lesson is architectural: anything the application would not publish should not sit in the system prompt at all. This article walks through the LLM07 mechanism, the leakage techniques that work in practice, and the architectural fix.

Problem-Awareai-securityowaspllm-securityprompt-injectionarchitecturesecrets-management
Read post →

AI Audit Log Formats for SIEM Ingestion: Field Mapping for Splunk, Sentinel, and Chronicle

AI audit logs from a policy gateway carry fields that no traditional SIEM schema was designed for: prompt classification, response classification, agent-on-behalf-of identity, policy ID, decision outcome. The fields have to land in Splunk, Microsoft Sentinel, or Google Chronicle in a normalized form so the SOC can query across AI and non-AI signals. This article walks through the canonical AI audit field set, the mapping decisions for each major SIEM, and the pitfalls when AI evidence has to survive a regulatory inquiry months after the fact.

Platform & Architectureai-securityaudit-logssiemsplunkcompliancearchitecture
Read post →

AI Security for Prior Authorization: HIPAA, State Laws, and the Identity-Bound Decision Record

Prior authorization is the highest-volume AI use case inside payer organizations and a growing one inside health systems. The compliance stack covers HIPAA, the new state utilization-review laws (California SB-1120, Texas SB-815, Colorado SB 26-189), and the ongoing CMS scrutiny of AI denial patterns. This article walks through the identity, classification, and audit requirements specific to prior authorization, the failure modes documented in recent enforcement actions, and the gateway-layer controls that produce decision records the regulators have started asking for.

Industry Verticalsai-securityhealthcareprior-authorizationhipaacomplianceaudit
Read post →

MCP Server Authentication for Enterprise Deployments: Identity, Authorization, and the Boundary Question

Model Context Protocol (MCP) servers have moved from developer-tool integrations to production agent backends inside enterprises. The authentication and authorization model for MCP traffic differs from REST-API authentication in two specific ways that matter at enterprise scale: the principal acting on the MCP server can be an agent on behalf of a human, and the tool invocations have to carry the propagation chain. This article walks through the MCP authentication model, the transport-boundary distinction, and the gateway-layer controls that produce a usable audit trail.

Platform & Architectureai-securitymcpauthenticationagent-securityarchitecturepolicy-enforcement
Read post →

AI Security for KYC Onboarding: BSA, FINRA, and the Per-Decision Record Regulators Inspect

KYC onboarding is one of the highest-volume AI use cases inside banks, broker-dealers, payments firms, and crypto exchanges. The regulatory stack covers the Bank Secrecy Act customer-identification rules, FINRA know-your-customer obligations, FinCEN beneficial-ownership reporting, and (in EU operations) the EBA AML package. This article walks through the AI integration points inside a KYC pipeline, the per-decision audit fields the relevant regulators inspect, and the gateway-layer controls that produce records sufficient for an enforcement inquiry.

Industry Verticalsai-securityfinancial-serviceskycamlcomplianceaudit
Read post →