Insights
Writing on agent governance
What we have learned building registers, scoring agents and sitting in the meetings where someone asks how many of these things are running.
Building an Agent Governance Program from Zero: A 90-Day Playbook
A step-by-step 90-day playbook for building an agent governance program from zero. Three phases, tangible outputs, and a defensible program by day 90.
The Regulatory Landscape for AI Agents: What's Coming and How to Prepare
The EU AI Act, US state laws, and industry regulations are expanding to cover AI agents. A practical guide to the regulatory landscape and what it means for your program.
Why "Responsible AI" Frameworks Fail for Agents — And What Replaces Them
Responsible AI frameworks were designed for models, not agents. Why fairness metrics and model cards fail when applied to autonomous systems that take actions.
The Agent Governance Maturity Model: Where Does Your Organization Fall?
A five-level maturity model for agent governance, from ad hoc deployments to optimized programs. Assess where you are and build a roadmap forward.
Agent Observability: What to Log, What to Monitor, and What to Alert On
What to log when AI agents take autonomous actions. Sixteen mandatory fields, correlation patterns, and the observability architecture that makes agents auditable.
Evaluating Agent Vendors: 28 Questions Your Security Team Should Be Asking
Twenty-eight scored criteria for evaluating agent platform vendors, covering security architecture, governance controls, compliance posture, and operational maturity.
Agent Permissions Done Right: Least-Privilege for Non-Human Workers
Least-privilege for AI agents is harder than for humans. A practical framework for permissions, tiered authorization, and runtime access controls.
The 5 Dimensions of Agent Risk: A Scoring Methodology
A weighted scoring framework for assessing agent risk across data access, autonomy, blast radius, reversibility, and regulatory exposure.
The Board Question Every CISO Will Face in 2026: "How Are We Governing Our Agents?"
Boards are asking about AI agent risk. Most CISOs cannot answer. Here is the question coming your way and the governance metrics you need to respond.
What Happens When an Agent Goes Rogue: An Incident Response Framework
When an AI agent causes harm, traditional incident response falls short. A practical framework for detecting, containing, and recovering from agent-related incidents.
Shadow Agents Are the New Shadow IT — And They're Worse
Employees are deploying AI agents without security review, creating a new class of shadow IT that moves faster and has broader access than anything before.
The Agent Governance Gap: Why Your Cybersecurity Framework Doesn't Cover AI Agents
Your cybersecurity framework was built for humans. AI agents break every assumption it relies on. Here are the five governance gaps you need to close.