Blog
Notes on agent governance
What action-layer policy enforcement actually stops, what it doesn't, and how to build it. Written for the engineers and security people who have to make agents safe to run in production — not for the people selling them.
Agent lifecycle attacks: what prompt-injection firewalls can't see
Four AI agent attack classes that live in the action layer — delegation, plans, budgets, and memory — and why input/output guardrails structurally miss them.
Read
Your model can be jailbroken. What happens next is the part you control.
A jailbroken agent controls what it asks for, not what executes. Where that boundary actually falls — and the four things a successful jailbreak still buys an attacker.
Read
The OWASP Agentic Top 10, scored against a policy engine
Which of the ten 2026 agentic risks a deterministic policy layer actually enforces: three fully, six partially, and one it arguably makes worse.
Read
188 incidents, no attacker
The most expensive AI agent failures on record had no adversary — the agent did what it was told. What that means for a security model built on keeping attackers out.
Read
MCP tool poisoning: why an allowlist beats a scanner
A peer-reviewed benchmark found more capable models are more vulnerable to tool poisoning, not less. You cannot train your way out of this one.
Read
The AI Act delay doesn't delay your evidence problem
High-risk obligations moved to December 2027. The event logging Article 12 requires still takes longer to retrofit than the extension buys you.
Read
Your first agent policy, in YAML
Write an agent policy in a constrained YAML DSL, compile it to Rego, unit-test it, and dry-run a single event — without learning Rego first.
Read
Where to put the gate: decorator, toolbox, or adapter
Three ways to wire policy enforcement into a Python agent — and the failure-mode difference that actually decides which one you want.
Read
Budgets are a security control, not a billing feature
A ceiling that fires on magnitude halts a runaway agent without diagnosing it — and the counter feeding it is part of your trust boundary.
Read
Multi-agent handoffs are an unguarded trust boundary
Most frameworks treat an agent-to-agent handoff as a function call. It is a privilege transfer, and almost nothing checks it before it happens.
Read