Insights topic
AI governance & risk
Autonomy moves the control point. These pieces cover where the boundaries belong, what breaks when they're implicit, and how regulation lands on operations.
Governance is a delegation decision, not a policy document
Most AI governance programs start with a policy PDF and end there, because the actual decision — how much authority an agent gets, and over what — was never written down as a control. AI governance in practice means specifying, per workflow, what an agent can read, what it can write, what it can spend, and what requires a human before it executes. Every connector you grant an agent is a delegation of judgment, not just data access, and treating it as a plumbing question is how shadow AI gets built one integration at a time. The teams that get this right treat delegation boundaries the way they treat access control for employees: reviewed, logged, and revocable, not assumed from the vendor's default settings.
The attack surface is the instructions, not the model
Prompt injection is not a bug in a specific vendor's model; it is the capability an agent gains the moment it can read untrusted content and act on it. A browser agent that holds your session cookie, an email assistant that ingests inbound messages, an agent with a wallet or a purchasing API — each of these turns ordinary content into a potential instruction set. Security review of agentic systems has to ask what the agent could be tricked into doing with the access it already has, not just whether the model is safe in isolation. This is a design constraint on architecture — sandboxing, scoped credentials, and human confirmation on irreversible actions — not a patch you apply after deployment.
Regulatory timelines don't wait for your operating model
The EU AI Act's obligations are arriving in stages, and the deadline that moved is not the one that matters — the classification of your systems as high-risk or not is the decision with teeth. AI governance under the Act means documentation, risk assessment, and human oversight that has to exist before the audit, not be reconstructed for it. Enterprises that treat this as a compliance checkbox usually discover the gap is operational: nobody can produce a clean account of what an agent decided and why. The double-edged part of the arms race is that the same autonomy competitors are shipping to move faster is the exposure regulators are now scoping. Building the control layer early is cheaper than retrofitting it under a deadline.
Shadow AI is a requirements document
The security teams raising the alarm about unapproved AI tools are right about the exposure, and the instinct to inventory, block and police is the same instinct that handled shadow IT correctly. But shadow IT was a procurement problem, and this is not. What employees are routing around now is not a purchasing process — it is a judgment your sanctioned system makes badly, and the standard response erases the only record you had of where.
Read
The deadline moved — your exposure didn't
Compliance teams spent eighteen months building toward a hard date under the EU AI Act, and when the timeline moved, relief was the honest reaction — the work was real and the cost of it was real. But the deadline was never the exposure. It was a schedule for confronting an exposure that sits in production right now, on the old calendar or the new one.
Read
AI browser agents inherit everything
The browser agent is the most immediately useful agentic AI anyone has shipped, and the productivity case for it is the most honest one in the category. But the security conversation around it is aimed one level too low. An agent working inside an authenticated session is not software you deployed — it is a credential you issued, to a colleague nobody onboarded.
Read
Prompt injection is not a bug
The security community is right about prompt injection, and the defensive work around it is serious engineering that reduces real risk. But it is being treated as a vulnerability, and a vulnerability implies a patch. The property that makes an agent exploitable is the same property that makes it worth having.
Read
Integration was the checkpoint
Standardising the way agents connect to internal systems was a genuine advance, and we would not want it undone — integration used to be the whole cost of an agent project. But the cost was doing a second job nobody assigned it. It was the only thing forcing anyone to ask what an agent should be able to reach, and AI agent identity is now the register almost no organisation keeps.
Read
An agent with a wallet
The case for agentic commerce is being made loudly: agents that don’t just recommend but pay, settling on rails engineered to be final. It’s framed as the natural endpoint of autonomy. But a payment is the least reversible thing an agent can do — and “irreversible by design” is a strange property to want in a system you’ve just handed your judgment to.
Read
The double-edged arms race
Everyone frames AI as an arms race, and the framing is only half right. The real danger isn’t that the same capability arms both sides — it’s what the race does to judgment.
Read