Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

AI Agent Tool Scoping: The Blast Radius Control That Agent Frameworks Do Not Enforce

AI agent frameworks let the model choose from the tool set the developer registered. What the frameworks do not enforce is which tool the calling identity is authorized to use in which context. When a prompt injection attack succeeds, the blast radius is the intersection of the tool set the framework registered and the authorization the calling application forwarded. Tool scoping is the control that shrinks the intersection.

Problem-Awareai-agent-securityagentic-aiprompt-injectionblast-radiusagent-toolsauthorization
Read post →

AI Request Authorization Model: The Four Predicates Every Production AI Call Has to Answer

Every production AI request has four authorization predicates the enforcement layer has to evaluate: which identity, which model, which data classification, and which organizational policy. Missing any one produces an audit gap the regulator, the SIEM, or the incident-response team surfaces later. This walks through the four predicates, the input attributes each requires, and the policy engine pattern that composes them.

Platform & Architectureai-authorizationai-policy-enforcementai-securityauthorization-modelai-gatewayzero-trust-ai
Read post →

LLM Response Content Filter: The Transform Patterns That Convert an Unsafe Answer Into a Safe One Without Blocking the Request

Blocking every unsafe response is the wrong default for many production deployments. A well-scoped response filter transforms the unsafe portion (redacts PII, rewrites competitor mentions, strips prompt-injection payloads intended for downstream systems) and passes the safe remainder through. This covers the transform patterns, where they sit in the streaming response path, and how the audit record differentiates a transform from a block.

AI Security Solutionsllm-response-filterai-securitycontent-filterllm-dlpai-gatewayoutput-filtering
Read post →

AI Bug-Hunting Drove ~1,500 High-Severity CVEs in June 2026: Prioritizing the Patch Window

AI models are now finding software flaws at scale. Epoch AI counted roughly 1,500 high-severity and critical CVEs reported in June 2026, about 3.5x the previous monthly record, while real exploitation still arrives within hours of disclosure. This walks through why patch prioritization by exploitability, plus identity-bound inline policy at the AI request boundary, is the control that holds between disclosure and patch.

Platform & Architectureai-securityllm-securitycybersecurityinline-enforcementarchitecture
Read post →

MCP Security Best Practices: Authorizing and Auditing Model Context Protocol Traffic

The Model Context Protocol gives an LLM a standard way to call tools, and over HTTP transport those calls are AI traffic you can authorize and audit. This covers the practices that matter at the request boundary: verify identity on every call, scope tools per role, treat tool descriptions as untrusted, fail closed, and log per decision. It also marks the line where local stdio servers fall outside a gateway.

Problem-Awareai-securityagentic-aillm-securitypolicy-enforcementidentity-and-authorization
Read post →

AI Governance Platform: The Runtime Enforcement Layer a Documentation Tool Cannot Provide

Most tools sold as AI governance platforms manage policies, risk registers, and model documentation. None of that touches a live AI request. A governance platform that changes outcomes needs a runtime enforcement point, a policy decision point, and an independent audit system of record at the AI request boundary. This walks through those three functions and the evidence they produce for the EU AI Act.

Compliance & Regulationai-governanceai-complianceeu-ai-actpolicy-enforcementaudit
Read post →

MCP Server Security: Hardening a Model Context Protocol Server You Operate

Running your own MCP server puts you in charge of who can reach its tools and what those tools can do. This guide covers server-side hardening: authenticating callers, authorizing each tool invocation, containing the confused-deputy risk, restricting tool egress, and deciding what belongs on the HTTP transport versus a locked-down local process. It closes with the enforcement layer that governs MCP traffic crossing the network.

Problem-Awareai-securityagentic-aillm-securityidentity-and-authorizationpolicy-enforcement
Read post →

Prompt Injection Protection: The Control Layers That Actually Contain It

No single control stops prompt injection, because the attack rides inside content the model is meant to read. Protection comes from layers that cap what a successful injection can reach: input handling, output filtering, least-privilege authorization on the model and its tools, and egress control. This walks through each layer, why model guardrails alone fall short, and where the enforceable controls have to run.

Problem-Awareprompt-injectionllm-securityai-securityinline-enforcementpolicy-enforcement
Read post →

Securing MCP Servers in Production: An Implementation Guide

A hands-on guide to running Model Context Protocol servers securely on the HTTP transport: stand up the server as an OAuth 2.1 resource server, validate token audience per request, authorize each tools/call against role and arguments, propagate caller identity downstream, constrain egress, and log every decision. Includes policy and validation snippets and a production checklist, plus the line where stdio servers leave the gateway.

Platform & Architectureai-securityagentic-aillm-securityidentity-and-authorizationarchitecture
Read post →

Prompt Injection Techniques: How the Attacks Actually Work

Prompt injection is a family of techniques, not one trick. Direct instructions, payloads hidden in retrieved content, splitting and obfuscation, multi-turn setups, and system-prompt extraction each work differently and need different containment. This walks through the main techniques with concrete examples, then maps them to the request-boundary controls that cap what a successful attack can reach.

Problem-Awareprompt-injectionllm-securityai-securityagentic-aipolicy-enforcement
Read post →

MCP Gateway Security: Enforcing Policy on Remote Tool Traffic

A remote MCP server turns tool calls into HTTP traffic between an agent and an endpoint. That traffic is where an MCP gateway enforces identity-bound policy and records each tool invocation. This covers what an MCP gateway checks, why remote Streamable HTTP transport is the enforcement surface, and where local STDIO servers sit outside it.

Platform & Architecturemcpai-securityagentic-aipolicy-enforcementinline-enforcementarchitecture
Read post →

MCP OAuth 2.1 Security: Authorization Enforcement for Remote Servers

MCP''s authorization spec builds on OAuth 2.1, which sets the token rules but leaves the per-call decision to you. This walks through the MCP OAuth flow for remote servers, the confused-deputy risk it introduces, and why an enforcement point that evaluates every tool call against the acting identity is the control that OAuth alone does not provide.

Platform & Architecturemcpidentity-and-authorizationai-securityagentic-aipolicy-enforcementarchitecture
Read post →