SHRIKELearn
Reference guides on governing AI agents. Written to be useful whether or not you ever use Shrike, and to say plainly where each control stops.
The argument in order: what the term means, when it starts applying to you, and how to decide once it does.
What Is Action Governance?
The canonical definition, how it differs from prompt scanning, and why an agent cannot govern itself.
ThresholdWhen Does an AI Agent Need Governance?
The five changes in a codebase that create the need, and why governance is missing by default.
ApproachesFour Approaches to Governing an AI Agent
Credential scoping, rule engines, design-time allowlists, and action-time adjudication: what each decides, and where each one stops.
Reference material you can check your own deployment against, with the gaps printed rather than hidden.
The 14 Governance Surfaces of an AI Agent
Every surface where an agent touches the world, what goes wrong on each, and the verdict that fits it.
Market mapThe AI Agent Security Stack
The control layers, what each one can and cannot do, and the downloadable control matrix.
CoverageThe 17 Agentic Attack Techniques
The published threat taxonomy mapped to inline controls, including the techniques nothing inline can catch.
Where the general picture meets a particular technology you are probably already running.
What Is MCP Security?
Tool poisoning, rug pulls, and shadowing, and the controls that govern them.
ArchitectureWhat Is an MCP Gateway?
What a gateway centralises, what it cannot see, and where policy has to sit instead.
Local modelsSelf-Hosted LLM Security: The Two Halves
Harden the serving engine, then govern the agent behind it. A local model ships with no guardrails at all.
Looking for implementation rather than concepts? The documentation covers setup, the SDKs, and scope declaration. Narrative pieces and incident write-ups live on the blog.