AI Security Review
What InfoSec, Privacy, Risk and Procurement ask before an AI feature ships, and the control and evidence that gets you through each gate.
23 min read Read → Topics
Security & Governance
Getting an AI feature past InfoSec and procurement is where most mid-market and enterprise projects actually stall, not in the model. Privacy and risk review are the other two gates. This is our work on the threat models and evidence that get a review past 'no.'
Start with AI Security Review if you're taking an AI feature through InfoSec. It's for engineers and product leads who need to pass procurement, privacy and risk review.
Guides#
The AI Governance Layer
The standing regime that has to hold a year after the security review passes. Who is accountable, and how to prove the system behaves.
30 min read Read →MCP in Production
MCPMCP is an open standard for connecting LLM applications to tools and data sources. standardizes the wire format. Identity, the catalog and the trust boundary are still yours to build, plus a ten-question gate for a new server.
42 min read Read →Insights#
What Actually Moved in the EU AI Act's 2026 Deadline Change
Regulation (EU) 2026/1744 pushed the AI Act's high-risk deadline to December 2027. What moved, what didn't, and why the old schedule still pays off.
9 min read Read →Prompt Injection Is a Data Problem: A Threat Model You Can Ship Against
Prompt injectionPrompt injection is untrusted input crafted to override a model's system prompt or task. can't be filtered away: the model can't reliably tell instructions from data. Here's the actual threat model and the controls that hold up.
10 min read Read →Patterns#
Typed tool contract
Every tool argument is defined by a strict JSON schema: enums for known value sets, validated patterns for IDs, required fields where genuinely needed. There is no free-text catch-all surface. A call that fails validation is rejected with a structured, actionable error the model can act on, never silently coerced or passed through to execution.
Read →Human checkpoint before irreversible actions
Every tool the agent can call is scoped to the narrowest permission the task genuinely needs. Any action that can't be cleanly undone, such as a refund, a delete, or an external message, requires an explicit human confirmation before it executes, beyond a plausible-looking model decision. The two controls compound: least privilege bounds the blast radius of anything that slips through, and the checkpoint stops the worst actions from executing at all.
Read →Failure modes#
Injection via retrieved content
Yes. Retrieved content arrives on the same channel as instructions, so a document, ticket, or webpage crafted (or compromised) to contain commands can have the model execute them with its real tool permissions. The system has no built-in way to tell 'instruction from us' apart from 'text we retrieved.'
Read →