Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

AI Agent Privilege Scoping: Six Patterns That Contain an Agent's Blast Radius

An agent is a program that acts on behalf of a human, and the acting has authorization consequences the traditional privilege model does not cover. The agent's identity, the human's session, the tool's permission, and the enterprise policy all compose into the authorization decision on each call. Privilege scoping is the design pattern set that keeps the composed authorization tight. This piece walks through six patterns that appear in production agent deployments and the audit records each pattern produces.

Problem-Awareai-agentprivilege-scopingagentic-aiai-securityauthorizationblast-radius
Read post →

AI Gateway Per-Tenant Rate Limiting: The Buckets That Actually Contain a Runaway Workload

A rate limit on the AI gateway is not a single ceiling. Enterprise deployments run several rate-limit buckets in parallel: per model, per tenant, per user, per tool, per purpose. The buckets interact, and the interaction is where runaway workloads hurt most. This piece walks through the bucket design that contains a runaway agent loop, protects the model provider's shared quota, and produces the audit records the operator needs to explain a rate-limit event.

Platform & Architectureai-gatewayrate-limitingmulti-tenantai-securityquota-managementai-cost
Read post →

Anthropic MCP Server Security: The Enterprise Controls That Sit Around Claude's Tool Layer

Anthropic's Model Context Protocol implementation lets Claude call tool servers with a standard schema. The enterprise question is what security controls have to sit around the MCP server when the LLM behind the protocol is Claude. This piece walks through the controls: transport authentication to the MCP server, token exchange between Claude's session and the tool call, response inspection before the tool result reaches the model, and audit records tied to the human user who authorized the session.

Platform & Architectureanthropicmcpclaudeai-securityai-agentai-gateway
Read post →

LLM Vector Store Access Control: The Filters That Have to Run on Every RAG Query

The vector store holds embeddings the enterprise's users, tenants, and documents contributed. Every retrieval-augmented generation query has to run access-control filters against the store before the retrieval reaches the LLM context. This piece walks through the filter design that survives multi-tenant SaaS, cross-department access, and time-bounded document lifecycle: per-vector metadata, query-time filter injection, retrieval-response inspection, and the audit records that prove the filter held on every query.

Platform & Architectureragvector-storeaccess-controlai-securityai-gatewayllm-dlp
Read post →

AI Audit Log Hashing Patterns: The Cryptographic Choices That Make an Audit Trail Tamper-Evident

An AI audit log that a regulator or an auditor will accept has to prove two properties: the records were written at the times they claim, and the records have not been altered after the fact. Hashing is the mechanism that produces the second property. This piece walks through the hashing patterns that fit an inline AI gateway's audit stream: hash-chained append, Merkle-tree batching, external witness anchoring, and the trade-offs each pattern makes against write latency and audit verification cost.

Problem-Awareaudit-logsai-securitycompliancecryptographytamper-evidentai-gateway
Read post →

AI Cost Attribution Per Team: The Record Design That Turns AI Spend Into a Chargeback Line Item

Finance teams asking for AI cost attribution per team run into the same problem every time: the model provider's invoice shows the aggregate account spend, not the per-team consumption. Attribution has to happen at the gateway, where the enterprise can tag each request with the team, application, and user identity. This piece walks through the record design that produces attributable AI spend, the tagging pattern that survives multi-model deployments, and the reports the finance team accepts as chargeback evidence.

Platform & Architectureai-costchargebackai-gatewayfinanceattributionai-governance
Read post →

A JSON Schema for AI Audit Logs: The Fields a Regulator, an Auditor, and a SIEM All Need in the Same Record

AI audit logs need one schema that satisfies a regulator during an Article 12 audit, an internal auditor during an ISO 42001 certification, and a SIEM during an active incident. Most deployments produce three log formats and reconcile them after the fact. This piece walks through a single JSON schema with the required and optional fields, the identity representation, the policy-state representation, and the storage-layer contract that makes the schema durable.

Platform & Architectureai-audit-logsjson-schemasiemeu-ai-actiso-42001ai-engineering
Read post →

AI Agent Lateral Movement: How an LLM Turns a Single Compromised Credential into a Multi-System Incident

An AI agent operating with credentialed access to multiple SaaS systems collapses the traditional lateral-movement kill chain. What used to take a human attacker hours of enumeration and pivoting takes an LLM-orchestrated agent seconds. The Marimo CVE-2026-39987 incident is the first widely reported case. This piece walks through the mechanism, why endpoint detection is blind to it, and the inspection-layer controls that block the pattern at the HTTP AI request boundary.

Problem-Awareai-agent-securitylateral-movementagentic-aiincident-responseai-security
Read post →

MCP Server Authentication: Identity Binding at the Model Context Protocol Boundary

The Model Context Protocol lets an LLM client discover and call tools exposed by an MCP server. Authentication at the MCP boundary determines which identity issues the tool calls, which policy applies, and which record ends up in the audit log. This piece walks through the OAuth 2.1 authorization flow the MCP spec adopted, the pitfalls in shared-secret patterns, and the inspection-layer architecture that binds every MCP tool call to a verified identity.

Platform & Architecturemcpauthenticationoauthai-agent-securityai-engineering
Read post →

SOC 2 AI Controls Mapping: Which Trust Services Criteria a Policy Gateway Actually Evidences

SOC 2 auditors are asking about AI systems this year. The Trust Services Criteria did not change, but the scope of the audit expanded to cover AI request handling, model access controls, and AI-produced data. This piece maps CC6, CC7, and PI trust services categories to the inspection-layer controls that produce SOC 2 evidence for AI systems on a per-decision basis.

Compliance & Regulationsoc2ai-compliancetrust-services-criteriaauditai-governance
Read post →

AI Gateway Cache Invalidation: When a Cached Prompt Response Becomes a Data Leak

AI gateways cache prompt responses to cut cost and latency. The cache lookup uses a hash of the prompt as the key, which means two callers with different authorization scopes can hit the same cache entry. This piece walks through the failure mode, the identity-scoped cache-key patterns that avoid it, and the inspection-layer architecture that makes cache lookup safe.

Platform & Architectureai-gatewaycachingai-engineeringdata-leakai-security
Read post →

AI Agent OAuth Consent: The Permission Screen Users Never Read and the Blast Radius It Grants

An AI agent that authenticates to a SaaS application via OAuth requests a consent scope from the user. The scope grants the agent standing authorization to call APIs on the user behalf. Users grant scopes they do not read, and the standing authorization outlasts the interaction that produced it. This piece walks through the OAuth consent mechanism, the blast radius it creates, and the inspection-layer controls that constrain the scope after grant.

Platform & Architectureoauthai-agent-securityconsentnon-human-identityai-engineering
Read post →