AI Security Review
What InfoSec, Privacy, Risk and Procurement ask before an AI feature ships. Each answer comes with the control and the evidence that pass the gate.
23 min read Read → Topics
Security & Governance
Getting an AI feature past InfoSec and procurement is where most mid-market and enterprise projects actually stall, not in the model. Privacy and risk review are the other two gates. This is our work on the threat models and evidence that get a review past 'no.'
Start with AI Security Review if you're taking an AI feature through InfoSec. It's for engineers and product leads who need to pass procurement, privacy and risk review.
Guides#
The AI Governance Layer
The standing regime that has to hold a year after the security review passes. Who is accountable, and how to prove the system behaves.
29 min read Read →MCP in Production
MCPMCP is an open standard for connecting LLM applications to tools and data sources. standardizes the wire format. Identity, the catalog and the trust boundary are still yours to build, plus a ten-question gate for a new server.
42 min read Read →Insights#
What Moved in the EU AI Act's 2026 Deadline Change
Regulation (EU) 2026/1744 pushed the AI Act's high-risk deadline to December 2027. What moved, what didn't, and why the old schedule still pays off.
9 min read Read →Prompt Injection Is a Data Problem: A Threat Model You Can Ship Against
Prompt injectionPrompt injection is untrusted input crafted to override a model's system prompt or task. can't be filtered away: the model can't reliably tell instructions from data. This is the threat model and the controls that hold up.
10 min read Read →Patterns#
Typed tool contract
A strict JSON schema defines every tool argument. A call that fails validation gets a structured, actionable error. The schema uses enums for known value sets and validated patterns for IDs. It marks fields required where needed and offers no free-text catch-all. The system never coerces a failed call or passes it to execution.
Read →Human checkpoint before irreversible actions
Each tool gets the narrowest permission its task needs. A human confirms any action that cannot be undone before it runs. Examples are a refund or an external message. A plausible-looking model decision is never enough on its own. The two controls work together. Least privilege limits the blast radius of anything that slips through. The checkpoint stops the worst actions from running at all.
Read →Failure modes#
Injection via retrieved content
Yes. Retrieved content arrives on the same channel as instructions. A document, ticket, or webpage crafted or compromised to contain commands can make the model execute them with its real tool permissions. The system has no built-in way to tell 'instruction from us' apart from 'text we retrieved.'
Read →