Technical Guides
All articles in the Technical category
What evidence shows that an AI agent has stopped?
Withdrawing an agent’s authority leaves queued, delegated and pending work to account for. The evidence an incident owner needs, with a stop-evidence worksheet.
When an AI agent remembers a policy that no longer applies
A newer policy record can concern another customer, lack approval or take effect next year. Seven checks on a published memory guard, and a worksheet.
Agent control standards: check the contract at the host
OWASP Agent Control Standard 0.1.4 and Microsoft AGT’s Agent Control Specification, compared by version, approval, failure and trace evidence.
Deterministic replay for AI agent decisions
Which parts of an AI agent decision can be replayed, what to record so replay works, and why a replayed decision does not prove an external action.
How to prove what an AI agent read before it acted
Record each retrieval and tool read, bind it to the decision it fed, and show an auditor where an AI agent got its information about a customer.
Engineering deep dive: tamper-evident evidence at scale
How KLA seals evidence bundles: canonical hashing, dual ES256 signatures, Merkle inclusion, paginated ledger collection, and offline verification.
Engineering deep dive: detecting dangerous tool chains and run-level agent misuse
How KLA evaluates accumulated run facts at workflow checkpoints to catch dangerous tool-call combinations that per-call policy cannot see.
What a bank-grade AI vendor supply chain looks like (DORA angle)
How banks assess AI vendors under DORA ICT third-party risk rules: reproducible builds, signed images verified at admission, provenance, SBOMs, and a buyer question checklist.
AI Agent Access Control: Least Privilege, Entitlements, and Human Approval
Design AI agent access control across identity, entitlements, runtime policy, human approval, revocation, and evidence with a reusable review checklist.
AI Agent IAM Reference Architecture: Identity and Access
Design AI agent identity, delegation, least privilege, approvals, entitlement review, revocation, and evidence with reusable diagrams and controls.
How to Build an AI Agent Kill Switch: Interception Architecture
An AI agent kill switch needs runtime cancellation, pre-execution denial, credential revocation, workload isolation, and evidence. This architecture shows how the controls work together.
OWASP Top 10 for Agentic Applications 2026: Runtime Controls, Audit Evidence, and Tests
Map every OWASP Top 10 for Agentic Applications 2026 risk to a runtime control, evidence artifact, and reproducible audit test.
MCP Audit: Secure and Govern Every Tool Call
A technical guide to MCP security and governance: inventory tools, gate calls with policy and approval, record outcomes, and export verifiable evidence.
How to Implement SAFR: Architecture, Patterns, and Build vs Buy
Implementing MAS's SAFR framework: reference architecture, native vs gateway deployment, control calibration, escalation operations, and build vs buy.
AI Agent Permissions: Audit Access Rights and Entitlements
Audit AI agent access rights across identity, delegation, tools, MCP servers, data boundaries, approvals, revocation, and least-privilege evidence.