Blog

The 14 Governance Surfaces of an AI Agent

Every surface where an agent touches the world, what goes wrong on each, and the verdict that fits it. Start here.

The AI Agent Security Stack

The control layers, what each can and cannot do, and the downloadable control matrix.

What Is Action Governance?

The canonical definition — how it differs from prompt scanning, and why agents can't govern themselves.

Four Approaches to Governing an AI Agent

Credential scoping, rule engines, design-time allowlists, and action-time adjudication: what each decides, and where each one stops.

The 17 Agentic Attack Techniques

The published threat taxonomy mapped to inline controls — with the gaps printed.

What Is MCP Security?

Tool poisoning, rug pulls, and shadowing — and the controls that govern them.

Self-Hosted LLM Security: The Two Halves

Harden the serving engine, then govern the agent behind it. A local model ships with no guardrails at all.

Agent Scope Declaration

Declare what an agent is for — purpose, allowed tools, expiry — and enforce it.

OWASP Agentic Top 10

Every ASI risk mapped to where enforcement happens at the action layer.

The Sandbox Answers Where. Nobody Answers Whether.

For platform engineers and security leads · 7 min read

NVIDIA's OpenShell is broadly available and settles where an agent can reach: which files, hosts and credentials. That is the right layer doing the right job. It leaves open the question a sandbox cannot see: whether this action, with this content, under this authority, should happen now. What each layer decides, what to concede to the sandbox, and the one rule the open question needs.

The Shell Command Is the Action

For platform engineers and security leads · 6 min read

Of all the tools you can hand an agent, the shell is the one where saying and doing are the same act. Why it is the highest-blast-radius tool, the command classes that matter, the normalisation trap that hides a payload, and why the verdict has to arrive before the command runs.

An Agent-to-Agent Message Is Still Untrusted Input

For platform engineers and security leads · 6 min read

As soon as one agent can message another, a new untrusted input channel exists, and the sender being an agent is a reason for more caution, not less. The failure modes, why trust does not compose across a chain, and what governing the channel actually means.

The Agent Was Authenticated. Nobody Asked If It Should.

For platform engineers and security leads · 6 min read

A coding agent deleted a production database and its backups in nine seconds. No breach, no jailbreak, no cracked credential: authentication succeeded, authorization succeeded, and the data died anyway. What that leaves for the rest of us, and the two fixes that cost an afternoon.

The Stack You Run When You Go Local

For platform engineers and security leads · 6 min read

Read together, the guides for running an open-weight model in production are a bill of materials: nine rows, five of them covered well by open source, four that no local stack ships. The table, the honest accounting of where the work went, and the two ways to fill the bottom rows.

After Bleeding Llama, the Agent Still Has No Boundary

For platform engineers and security leads · 4 min read

CVE-2026-7482 let an unauthenticated caller read prompts, system prompts, and credentials out of exposed Ollama servers. The patch is out. Two things stay true after it: every component that keeps the prompt is the next leak, and the agent behind the engine is exactly as unguarded as before.

Your Local Model Shipped Without Guardrails

For platform engineers · 6 min read

Moving an agent to a local model for data residency or cost is a sound decision. It also removes every provider-side control at once: no content safety, no approval step, no record of what the agent did. What a local model needs instead, the one change that supplies it, and why the controls should belong to the deployer rather than the provider.

The 14 Surfaces Where Your Agent Touches the World

For platform engineers and security leads · 7 min read

Your agent read forty files, ran a dozen commands, wrote three, queried a database, and called a tool another agent published. Each is a distinct surface where words become acts. A visual map of all fourteen, why the observe plane and the act plane need different treatment, and where each deep dive lives.

The Minimum Protection Every AI Agent Should Have Is Free

For platform engineers · 5 min read

Most agents in production today execute actions with no screen at all. The L1-L5 pattern layers are the floor we give away: milliseconds of deterministic screening that undresses encoded and invisible payloads and stops the commodity attack before your agent ever reads it. What that floor catches, and where the paid layers take over.

The MCP Tool That Vets Your Other MCP Tools

For platform engineers · 6 min read

MCP tool descriptions are text your agent reads as possible instructions, which makes every server you install a supply-chain surface. A use-case walkthrough of scan_mcp_schema: screening tools/list on first connect, and schema pinning that catches the rug pull a one-time audit cannot.

OpenAI's Incident Report Has a Section Addressed to You

For security leads and cisos · 7 min read

OpenAI's technical report on the Hugging Face incident warns enterprises to expect offensive agent collectives, then describes the defenses OpenAI built for itself. The enterprises the warning is addressed to mostly cannot build them. What they can own instead: the action boundary.

Red-Teaming NemoClaw Agents Finds the Holes. Governance Holds the Line.

For security leads and red teams · 6 min read

Red-teaming NVIDIA NemoClaw agents gives you a dated snapshot of what breaks. Runtime governance is the standing half: turning findings into declared scopes and per-action enforcement. How the two compose, and the recipe that cleared NVIDIA maintainer security review.

The Enforcement Boundary Is a Deployment Choice

For platform engineers and security architects · 7 min read

Where AI governance runs decides what it can guarantee. The three placements of an enforcement boundary, why the policy contract must not change between them, why provider guardrails cannot carry your posture across vendors, and where Shrike deploys today, honestly tagged.

Two Rows Moved on Our Coverage Map

For security leads and red teams · 5 min read

We publish a map of 17 agentic attack techniques and what our coverage honestly is for each. This week two rows moved from partial to enforced: tool rug pulls and agent resource exhaustion. What shipped, and what the map still says is roadmap.

Declared Scope Cuts Benign-Session False Positives from 17.6% to 1.1%

For platform engineers and security leads · 6 min read

We measured our false-positive rate on 9,103 benign agent messages against production — then measured it again with each agent declaring its scope in one API call. Both numbers, and why the difference is a context problem, not a tuning problem.

Five Attacks, Five Verdicts: Inside the NemoClaw Action-Governance Recipe

For platform engineers · 7 min read

A case study of the Shrike recipe that cleared NVIDIA maintainer security review — the architecture, the five live validation cases it ships, and what the review demanded before it could merge.

When Google's Agent Calls Your Agent

For product and security leads · 6 min read

Google's agentic booking now calls businesses — and what answers is increasingly the business's own AI, with authority to commit it. The phone line just became an agent-governance surface.

Does DLP Stop Shadow AI? What It Catches — and What Agents Slip Past

For security leads and cisos · 6 min read

Partially. DLP stops the patterns it recognizes on the channels it monitors — but shadow AI fails both conditions, and AI agents add a question DLP was never designed to answer.

How Do You Prove AI-Agent Governance to an Auditor?

For compliance and grc teams, security leads · 6 min read

Auditors don't accept "we have a policy" — they accept evidence. The gap between claiming AI-agent governance and proving it, and what an assessor actually wants to see.

Securing NemoClaw Agents with Shrike

For platform engineers · 5 min read

A drop-in recipe that adds runtime governance to NemoClaw agents — checking tool calls, MCP calls, and responses against policy before they run.

Why AI Agents Need Independent Governance

For cisos and security leads · 5 min read

The model vendor can't audit itself. Why independent governance is a structural requirement for AI agent security.

Shadow AI: The Security Gap Your DLP Can't See

For security leads and cisos · 4 min read

A majority of developers use AI tools daily. Traditional DLP doesn't scan AI prompts. Here's how to close the gap.

What Happens When AI Agents Spawn Sub-Agents

For platform engineers · 6 min read

Delegation chains, blast-radius containment, and scope inheritance — governing the agent tree.