AI Agent Audit Trails: What to Capture Before It Counts as Proof
Last week I asked where your AI policy actually fires LINK: Your AI Policy Isn't a Control Until It Fires. This week I want to ask what happens after it fires. Can you prove it did? Here's the scenario I keep coming back to. An agent in your environment changes...
AI Policy vs. Enforcement: Closing the Gap at the Moment of Action
Last week I asked which way your guardrails fail when they stop working Which Way Does Your Guardrail Fail?. This week I want to back up a step and ask something more basic. Is your AI policy connected to anything at all? That sounds like a rhetorical question. It...
Fail-Closed AI Agent Architecture: Where the Enforcement Point Belongs
Last week I argued that a short-lived, tightly scoped credential is the one gate that doesn't depend on the agent's cooperation [LINK: Your Credential Policy Was Written for Humans]. That argument has an assumption buried in it. It assumes the gate holds. So, this...
AI Agent Credential Lifecycle: Why Machine Identities Break Human IAM Policy
Last week's FuBAC analysis listed credentials as the sixth attribute of the Artificial Identity: short-lived, task-scoped, cryptographically verifiable, issued per function and expired at completion. It is the attribute that sounds most like routine hygiene and gets...
© 2025 All Rights Reserved
Recent Comments