Brief · 5 min read
AI agents need authority you can constrain and revoke
A field brief on workload identity, delegated permissions, runtime policy, and the evidence needed when an agent gets something wrong.
Read the briefAI trust in practice
Know what an agent can do, what constrains it, and what can be proved.
AI introduces new actors into existing business systems. The useful controls make authority explicit, keep evidence attached to actions, and give operators a way to contain failure. These guides distinguish identity, authorization, model integrity, and content provenance.
Start with a question
Can you explain an agent’s authority, stop its actions, and reconstruct what happened?
- Give agents bounded, revocable authority.
- Verify artifacts without confusing provenance with truth.
- Capture decisions and recovery evidence at runtime.
Guides & field notes
Guide · 7 min read
An operating model for production AI security
Connect model releases, agent authority, data provenance, and runtime evidence so an AI system can be evaluated, constrained, and stopped.
Read the guideWhere the subjects connect
Guide · 7 min read
PKI operations: from renewal alerts to a managed service
Build certificate operations that can handle shorter lifetimes, changing trust policies, and the next algorithm transition.
Read the guidePractical guide · 6 min read
Software assurance: make the product evidence usable
A practical operating model for secure releases, vulnerability response, and EU Cyber Resilience Act readiness.
Read the practical guidePractical guide · 5 min read
Funding digital trust with your own evidence
Build a decision around operating costs, required capabilities, and testable risk reduction. Make every assumption visible.
Read the practical guideRelated writing
- AI Agents Hacked Hugging Face Using Access OpenAI Gave Them
The agents got past OpenAI’s firewall by using a software server OpenAI had set up for them, and the tests kept running through two months of warning signs. A reconstruction from the incident reports, and what it means for any company deploying AI agents.
- The Script Kiddie Has a Copilot Now
An exposed résumé request leads to a harder question about how much an attacker needs to know
- When Software Starts Acting for US
Woz, AI agents, and what SELECT26 revealed about the next era of building.