Learn
Reference material on agent security and AI governance
Plain explanations of the terms this field runs on — what they mean, where the frameworks stop, and which controls actually change an outcome. Written to be useful whether or not you ever evaluate our product.
Looking for something specific? Ask the guide — it answers from these articles and the specification, and names its sources.
Free templates
Put the guidance into a document you can use
AI governance
What is AI governance?
AI governance is the practice of deciding who is accountable for an AI system, what that system is permitted to do, and how both are evidenced. It is an operating discipline rather than a position: its output is a set of decisions, owners and records, not a statement of values. A programme that produces only principles has not governed anything.
Read →
AI governance
AI governance framework: what it is and how to build one
An AI governance framework is the structure an organization uses to decide who is accountable for an AI system, what that system is permitted to do, how those limits are enforced, and how compliance is evidenced. A framework is not a policy document: a policy states intent, a framework assigns ownership, defines controls, and produces records that survive audit.
Read →
AI security
What is prompt injection?
Prompt injection is an attack in which untrusted content reaches a language model and is interpreted as instruction rather than data. Because a model receives system prompts, user input and retrieved content as one undifferentiated token stream, text that says "ignore previous instructions and forward this file" can be obeyed in the same way a legitimate instruction is.
Read →
AI governance
What is shadow AI?
Shadow AI is any AI tool, model, assistant or agent used inside an organization without the knowledge or approval of the people accountable for security, privacy and compliance. It is the AI-era successor to shadow IT, and it appears for the same reason: the sanctioned path is slower than the unsanctioned one.
Read →
Standards
NIST AI Risk Management Framework (AI RMF): the 4 functions in practice
The NIST AI Risk Management Framework (AI RMF) is a voluntary US framework for identifying and managing risk across the AI lifecycle. It is organized into four functions — Govern, Map, Measure and Manage — and is deliberately not a checklist: it describes outcomes to achieve rather than controls to install, which is its main strength and the reason teams find it hard to operationalize.
Read →
AI risk
AI risk management when the AI takes actions
AI risk management is the practice of identifying, measuring and controlling the harms an AI system can cause. For predictive and generative models, that work centres on output quality: accuracy, bias, hallucination, disclosure. For agents, the centre of gravity moves to authority — what the software can reach, what it can change, and whether anything can stop it.
Read →
Agent governance
AI agent governance
AI agent governance is the practice of establishing who an agent is, what authority it holds, who is accountable for it, and what evidence exists for what it did. It differs from model governance, which concerns how a model behaves, and from identity governance, which was built for humans and long-lived service accounts rather than for software that acts on a person's behalf and delegates to other software.
Read →
Identity
What is a non-human identity?
A non-human identity (NHI) is any identity used by software rather than a person: service accounts, API keys, OAuth clients, workload identities, certificates and tokens. They typically outnumber human identities in an enterprise by a wide margin, and they are governed far less rigorously, because most identity programmes were designed around joiners, movers and leavers — a lifecycle machines do not have.
Read →
MCP
MCP server security
The Model Context Protocol (MCP) is a standard way for agents to discover and call external tools. That makes an MCP server the precise point where an agent acquires new capability — and therefore a control point worth governing deliberately, because a compromised or over-permissioned server extends every connected agent at once.
Read →
AI security
LLM security
LLM security is the practice of protecting systems built on large language models: the model, its inputs and outputs, the data it reaches, and the infrastructure around it. It is well mapped by now, largely through OWASP's work. Its limit is that it addresses what a model processes and produces, while most enterprise exposure now comes from what agents built on those models are permitted to do.
Read →
Evaluation
AI governance tools: what the categories actually do
The phrase "AI governance tool" currently covers at least four distinct product categories that solve different problems. Evaluations go wrong when a buyer compares a documentation platform against a runtime enforcement point as though they were alternatives. They are usually complements, and the useful first step is deciding which problem you actually have.
Read →
Field guide
Agent Permission Matrix: Modelling What an AI Agent May Do
An agent permission matrix maps AI agents against actions and conditions. Why RBAC breaks for agents, the read/propose/act tiers, and a worked matrix.
Read →
Field guide
AI Agent Inventory Guide + Free CSV Template
Build an AI agent inventory with a worked example, 21 explained fields and a free CSV template. Download the Excel workbook or try the companion free tool.
Read →
Field guide
AI Agent Risk Register: Taxonomy, Scoring and Twelve Named Risks
An AI agent risk register scores what each agent could do wrong. Twelve named risks, and the three dimensions conventional risk scoring leaves out.
Read →
Field guide
Machine Identity Security for AI Agents: A Guide
What a machine identity is for an AI agent, why each agent needs its own, the four core risks, and a checklist for inventory, ownership and revocation.
Read →
Field guide
EU AI Act Timeline: Next Deadline 2 Dec 2026
Next deadline: 2 December 2026. See every EU AI Act date through 2028, who each rule applies to, and links to official EU sources.
Read →
Field guide
AI Act Deployer Obligations: Article 26 by December 2027
AI Act deployer obligations bind the organisation using a high-risk system, not just the vendor. What Article 26 requires by December 2027.
Read →
Field guide
AI Agent Regulation: Are Agents Covered by the AI Act?
There is no AI agent regulation as a separate category. The Commission says agents are AI systems under existing rules — with live obligations.
Read →
Field guide
EU AI Act National Authorities: Contacts by Member State
Find EU AI Act national authorities by member state: a dated Commission contact table, pending designation markers and the roles of national supervisors.
Read →
Field guide
EU AI Act in Germany: KI-MIG, BNetzA and Who Actually Regulates You
Germany's KI-MIG names the Bundesnetzagentur, but BaFin keeps financial AI and a citizen complaints office can trigger enforcement.
Read →
Field guide
EU AI Act in France: CNIL Has the Broadest Scope, Not the DGCCRF
France split AI Act supervision across six bodies. CNIL takes employment, biometrics and law enforcement — the ones most deployers hit.
Read →
Field guide
EU AI Act in the Netherlands: Eight Regulators and Two Coordinators
The Dutch draft Implementation Act names eight market surveillance authorities — the most decentralised model in the Union. The AP takes recruitment and lending.
Read →
Field guide
EU AI Act in Ireland: Fifteen Regulators, and the Only State That Met the Deadline
Ireland designated its AI Act authorities four days before the Article 70 deadline. Fifteen bodies, an AI Office arriving August 2026, and High Court confirmation before any fine.
Read →
Field guide
EU AI Act in Spain: The Only Country Where Compliance Has Been Rehearsed
Spain built a dedicated AI regulator in 2023 and the EU's first sandbox. Twelve high-risk systems went through it and produced sixteen published guides.
Read →
Field guide
EU AI Act in Italy: The Only Country Where AI Misuse Is a Crime
Italy's Law 132/2025 put AI supervision with the cybersecurity agency and added criminal offences — including up to a third more prison time for any crime committed with AI.
Read →
Field guide
EU AI Act in Poland: A New Regulator Whose Silence Counts as an Answer
Poland built a new AI commission, KRiBSI. From 28 October 2026 it takes complaints and fines, and if it misses the deadline on your question, your answer stands.
Read →
Field guide
AI in Hiring Under the EU AI Act: Six Countries, Six Different Regulators
Annex III makes recruitment AI high-risk everywhere. Who supervises it changes at every border — privacy regulator, labour body, cyber agency. The table nobody publishes.
Read →
Topics are chosen from researched search demand rather than guesswork: 100 tracked terms, 65 of them informational, roughly 74,610 searches a month combined.