Mapping the Agent Before Anyone Attacks It
45 minutes
A reference operations agent on Google Cloud, threat-modelled against OWASP and MITRE ATLAS, with a first control: a deny-by-default policy …
Andrew Stevens
Andrew Stevens is an executive leader, investor, and technology strategist focused on the intersection of cloud, data, AI, and security. He has helped scale technology ventures from early traction to acquisition, working across fintech, media, gaming, and AI-driven businesses in both European and U.S. markets.
Known for bringing clarity to complex technology shifts, Andrew helps founders, operators, and executive teams turn emerging capabilities into practical advantage. His work focuses on AI strategy, resilient infrastructure, governance, and the operating models required to scale modern technology businesses with confidence.
Written by Andrew Stevens
Sakura Sky and UpCloud: A European Cloud Partnership
7 minutes
Sakura Sky is now an UpCloud partner. Here is what European sovereign cloud on UpCloud brings our customers, and the services we are …
A 150B MoE on a Developer Laptop: An Upper Bound on What Faster Storage Buys You
18 minutes
A 150-billion-parameter mixture-of-experts model streamed from NVMe on an ordinary developer laptop with no usable GPU. Across a 200-token …
Tollgate v0.2.3: What Long-Context Pricing Does to a Spend Cap
11 minutes
Some models bill the whole request at a higher rate above a size threshold. What that does to a spend cap, and what changed in Tollgate …
Evidence That Looks Like Closure: Fuzzing, Fault Injection, and the GATE PARTIAL Checks
16 minutes
gate-fuzz v1.0.0 emits an artefact filed under Check15 that does not close Check15. Working out why is a useful way into which conformance …
Tollgate: Open-Source Hard Limits for LLM Spend
7 minutes
Tollgate is an open-source AI gateway and spend-control proxy. It prices every LLM request by token, reserves budget before the call, and …
GATE v1.5 Roadmap
10 minutes
A preview of the next GATE release: a per-control ISO/IEC 42001 mapping with the asymmetry written down, streaming-aware output validation, …
Your System Prompt Is Not a Trust Boundary
16 minutes
A text-to-SQL agent's system prompt cannot enforce a data rule. sql-guard v0.2.0 puts the rule in a parser instead, and closes eight …
GATE v1.4: Output Validation, a Rust Companion, and the Conceptual Layer as OKF
10 minutes
GATE v1.4 adds C20 output validation at the delivery boundary, formalises break-glass as a signed contract, adds informative mappings to …
Your Managed Providers Are About to Be Regulated. Here Is What to Ask Them.
11 minutes
The UK Cyber Security and Resilience Bill and NIS2 both regulate managed service providers directly, wherever they are established. Seven …
Arkhe: An Ontology Language for AI Systems
7 minutes
Two weeks ago I argued that your ontology is the asset and you should own it in a neutral, versioned form. Arguing is cheap. Arkhe v0.2 is …
Your Ontology Is the Asset. Stop Renting It Back.
10 minutes
Agentic AI post-mortems keep naming the same trio: determinism failures, hallucinations, and compliance gaps. An ontology retires all three, …
HTTP QUERY Finally Settles the Argument. Your Infrastructure Gets the Next One.
8 minutes
RFC 10008 gives HTTP a method that is safe, idempotent, and carries a request body. It ends a design argument I have been having in API …
Compliance You Can Prove
11 minutes
Why the next era of GDPR, AI Act, and MiCA readiness is engineered, not documented. Praxis wires controls into live systems and produces …
AI Safety Assurance Is Still Goodwill, Not Evidence
6 minutes
The UN's first scientific assessment of AI says safety assurance still runs on developer goodwill, not verification. Here is what …
Multi-Tenant Agentic AI on Google Cloud: A Production Walkthrough
25 minutes
A review of Google's multi-tenant agentic AI reference architecture stage by stage, naming trade-offs at each decision point and filling the …
GATE v1.4 Roadmap
6 minutes
A preview of the next GATE release: output validation, break-glass formalisation, OWASP AISVS and MITRE ATLAS alignment, a Rust library, and …
The Regulatory Stack, Part 6: Building Under the CRA - A Reference Architecture
11 minutes
A production-grade reference architecture translating the GATE specification into a live runtime, using Apigee, Envoy Proxy, and …
The GATE Conformance Runner: What You Can Automate and What You Cannot
8 minutes
The gate-conformance v1.2.0 runner automates 9 of GATE's 19 checks against a live evidence store. The other 10 return PARTIAL: not failure, …
GATE v1.3: New Controls for Shadow Agents, Data Quality, and Model Drift
4 minutes
GATE v1.3 adds three new controls and a CLI conformance runner to the Governed Agent Trust Environment, closing three assumptions that …
The Regulatory Stack, Part 5: The Cyber Resilience Act Closes the Last Loophole
10 minutes
Think your AI agent escaped the EU AI Act's high-risk classification? The Cyber Resilience Act lands more than a year earlier, and it …
The Regulatory Stack, Part 4: Engineering Under the AI Act - Article 15 Cybersecurity in Practice
10 minutes
How to turn the EU AI Act's stringent cybersecurity requirements into a clean, automated side effect of your existing platform engineering …
The Regulatory Stack, Part 3: How the EU AI Act Made Verification a Legal Question, Not a Best-Practice One
13 minutes
The EU AI Act binds providers and deployers to a continuous, evidenced verification posture by December 2027. Here is the operational …
The Regulatory Stack, Part 2: Why the Boardroom Should Be Funding the Verification Layer in 2026
10 minutes
The capital deployment decisions boards make this year will determine whether their autonomous AI systems are governable assets or …
The Regulatory Stack, Part 1: AISVS Has 14 Categories. GATE Has 16 Controls. Here Is the Map.
11 minutes
AISVS tells you what to verify. The AI Act tells you that you must. Neither tells you how to enforce. This is the engineering map between …
OWASP Just Drew a New Map, Read It Before Your Auditors Do
9 minutes
The Foundation's new strategic plan is not a community update. It commits OWASP to setting the technical floor for AI security, …
The Mythos Ledger, Part 5: The Resilient Cloud Manifesto
11 minutes
The series finale. Across four posts, we identified three machine-speed problems - discovery, intelligence, identity - that share the same …
The Mythos Ledger, Part 4: Identity in the Autonomous Enterprise and Why the Agent Is the New Perimeter
13 minutes
Non-human identities now outnumber humans by 40:1, 100:1, and in hyper-automated environments by 500:1. When AI agents do 80–90% of an …
The Mythos Ledger, Part 3: The Glasswing Strategy (From Defensive Coalitions to Cloud Immunity)
11 minutes
Anthropic's $100M Project Glasswing is the first attempt to flip the economics of AI-driven vulnerability research before offensive …
The Mythos Ledger, Part 2: The Verification Crisis
19 minutes
AI-driven discovery has lowered the cost of finding bugs by an order of magnitude. The cost of proving which ones are actually exploitable …
The Mythos Ledger, Part 1: The Firefox Watershed and the New Baseline of Vulnerability
7 minutes
Claude Mythos surfaced 271 vulnerabilities in a single Firefox evaluation pass. The number isn't the story - the collapse in the cost of …
The Autonomous Horizon, Part 6: The Architecture of Trust
10 minutes
The four pillars of the autonomous enterprise describe the operating model. GATE names the framework that makes it engineerable.
GATE: The Missing Infrastructure Layer for Agentic AI
6 minutes
Prompt guardrails are not governance. When AI agents can take real-world actions at machine speed, you need deterministic enforcement at the …
The Autonomous Horizon, Part 5: Adaptive Workflows and the Shift from Fixed Process to Responsive Execution
11 minutes
Intelligence, data, and control only create advantage when the process layer can keep up. Adaptive workflows are where autonomy becomes …
The Autonomous Horizon, Part 4: Governed Execution and Control at Machine Speed
12 minutes
As enterprises move to machine-speed execution, governance has to move with them. That means embedding control into the operating fabric …
The Autonomous Horizon, Part 3: Why Autonomy Runs on a Clean Data Core
10 minutes
Autonomy depends on data the enterprise can act on. The clean data core is what turns trusted context into operational execution.
The Autonomous Horizon, Part 2: Agentic AI and the Shift from Automation to Execution
10 minutes
Agentic AI marks the shift from assistive tools to execution systems, but only when supported by trusted data, governance, and secure …
The Autonomous Horizon, Part 1: Beyond Digital Transformation
8 minutes
Digital transformation made the enterprise modern. The next step is building one that can sense, decide, and act with speed, precision, and …
Trustworthy AI Agents: The Trustworthy AI Blueprint
5 minutes
Bringing together all 16 primitives into a single, coherent architecture. The capstone: Operational Risk Modeling.
Trustworthy AI Agents: Human-in-the-Loop Governance
8 minutes
The ultimate safety primitive: defining when humans intervene, approve, constrain, or override autonomous decisions.
Trustworthy AI Agents: Agent-Native Observability
5 minutes
Traditional telemetry cannot explain LLM reasoning. Agent systems need semantic-level visibility: reasoning graphs, tool-call chains, …
Trustworthy AI Agents: Secure Memory Governance
6 minutes
Agents increasingly rely on long-term memory, embeddings, caches, and shared state. We need strong security and governance primitives around …
Trustworthy AI Agents: Distributed Agent Orchestration
12 minutes
Agents need a control plane. Routing, scheduling, failover, cost-aware prioritization, and cross-agent coordination must be first-class …
Trustworthy AI Agents: Resource Governance
10 minutes
Infinite task loops and runaway agents are already common failure modes. We need quota systems, throttling, and prioritization baked in.
Trustworthy AI Agents: Agent Lifecycle Management
8 minutes
Like microservices, agents need versioning, deployment pipelines, and safe deprecation paths.
Trustworthy AI Agents: Secure Multi-Agent Protocols
6 minutes
Agents need a standardized, authenticated, encrypted, and versioned protocol for inter-agent communication. Right now it is wild-west JSON …
Trustworthy AI Agents: Formal Verification of Constraints
7 minutes
Agents that act autonomously must obey provable invariants. Formal verification provides the missing guardrails for constraints like 'never …
Trustworthy AI Agents: Deterministic Replay
26 minutes
Debugging agents is nearly impossible today. We need the ability to record and replay runs deterministically to diagnose errors and …
Trustworthy AI Agents: Adversarial Robustness
8 minutes
Models need to withstand data poisoning, prompt injection, and inversion attacks. A cleverly crafted input can collapse your system. This …
Trustworthy AI Agents: Kill Switches and Circuit Breakers
10 minutes
Why autonomous agents need hard limits, circuit breakers, and emergency stop mechanisms to prevent runaway execution and cascading failures.
Trustworthy AI Agents: Verifiable Audit Logs
9 minutes
How to make every agent action tamper proof and cryptographically verifiable for compliance and forensic analysis.
Trustworthy AI Agents: Policy-as-Code Enforcement
6 minutes
Guardrails must be enforced at runtime, not left as developer best practices. Just like infrastructure-as-code, compliance must be baked …
Trustworthy AI Agents: Agent Identity & Attestation
8 minutes
Go beyond API keys. Learn to engineer trustworthy AI agents with verifiable identity and attestation using the SPIFFE framework and a Python …
Trustworthy AI Agents: Prompt Injection Protection
5 minutes
Why prompt injection is a critical vulnerability for AI agents. This guide covers detection techniques, architectural patterns, and a Python …
Trustworthy AI Agents: End-to-End Encryption
8 minutes
The next instalment in our series on trustworthy AI agents, an overview of 12 missing engineering primitives (encryption, identity, …
The Missing Primitives for Trustworthy AI Agents
4 minutes
An overview of missing engineering primitives (encryption, identity, governance, orchestration, observability) required for AI Agents to be …
Your Most Powerful User Is Your Growing Security Blind Spot
4 minutes
AI agents are a powerful new tool, but they also represent a growing security blind spot. Traditional security models are failing and a Zero …
Streaming CrowdStrike Falcon Events into GCS for Google Chronicle
6 minutes
A technical guide to creating a cost-effective, serverless pipeline for streaming CrowdStrike Falcon events directly into GCS, bypassing the …
Hot or Hype Ep 6: AI, Marketing, and the Evolution of Customer Experience with David Ovens
3 minutes
In our latest podcast, we speak with Andreea, Head of Data at Xapo Bank, about how AI is reshaping finance. Discover how Xapo’s data …
Model Context Protocol on Google Cloud
17 minutes
The Model Context Protocol (MCP) is an emerging AI standard that enables secure, real-time context and tool integration for LLMs. Learn how …
A Simple Approach to AI Agents and Content Access with RBAC on Vertex AI
4 minutes
Learn how to secure AI agents and protect sensitive data with Role-Based Access Control (RBAC) on Google Cloud's Vertex AI. Implement robust …
Hot or Hype: Episode 3 - Future of AI in Baseball
4 minutes
How is AI transforming baseball? In this episode of Hot or Hype, we explore how the San Francisco Giants are using AI for player scouting, …
Hot or Hype: Episode 2 - AI Agents
2 minutes
Dive into our second Hot Or Hype podcast episode as we explore the buzz around AI Agents. Are they just super-powered Siri or a …
Hot or Hype Deep Dive: Episode 1 AI-Driven Predictive Analytics
2 minutes
Join our deep dive into AI-driven predictive analytics, explore real-world applications, potential pitfalls, and expert tips for success. Is …
Hot or Hype: Episode 1 - AI-Driven Predictive Analytics
2 minutes
Is AI-driven predictive analytics the future of business intelligence or just another overhyped trend? In this episode of Hot or Hype, we …
GCP Cost Reviews: A Framework To Work With Your FinOps Tooling
5 minutes
How I optimize GCP costs with a FinOps-driven framework. Track actionable strategies, tools, and templates to reduce spend, improve …
Ray and Vertex AI, Let’s Get Hands On
11 minutes
Discover how combining Ray and Vertex AI creates a complete solution for scalable AI. Our team takes a look at training, deployment, and …
Best Practices for Scaling AI Models in the Enterprise
5 minutes
Thoughts on best practices for scaling AI models with cloud computing, including MLOps, cost optimization, and industry-specific use cases …
My reflections on the 2024 DORA Report
5 minutes
My key insights from the 2024 DORA Report, focusing on the evolution of AI integration, platform engineering, and developer experience.
Unlocking AI Potential by Accelerating Adoption with Cloud Services
7 minutes
How cloud platforms close the gap between AI experiments and production capability, with elastic compute, managed data services, and …
Modern Data Architectures, An Opinion on Best Practices for Scalability and Security
5 minutes
What are the core principles and best practices for building a modern data architecture? Our opinion on scalable design patterns, security …
Transforming Data into Insights: Building an AI-First Cloud Strategy
6 minutes
How to build an AI-first cloud strategy, integrating scalable architectures, data governance, and machine learning for actionable insights.
AI Compliance: Challenges, Opportunities, and Solutions for the EU AI Act
5 minutes
How is the EU AI Act is shaping global AI development? Here are some compliance strategies and industry-specific solutions for banking, …
EU AI Act: Implications for Data and Cloud in Banking, Ecommerce, and Gaming
5 minutes
What are the implications of the EU AI Act for global businesses in banking, ecommerce, and gaming. How can data governance, cloud-native …
Data Driven Advertising Optimization: Integrating AI
4 minutes
How Sakura's advanced analytics and machine learning optimizes advertising campaigns. We deliver robust data pipelines, scalable cloud …
Navigating GDPR, CCPA, and APP Compliance: Technical Insights for Ethical Data Tagging and Collection
4 minutes
This guide explores key considerations for marketers to ensure compliance while maintaining ethical, effective practices.
Ethical Considerations in AI Development for Data Scientists and Data Engineers
8 minutes
The Sakura team looks at ethical AI issues for data scientists and engineers, focusing on transparency, accountability, fairness, privacy, …
Handling Missing Data in Financial Models with Multiple Imputation
5 minutes
Multiple Imputation strategies and key considerations tailored for data engineers and data scientists in the financial industry, designed to …
Demystifying Data Mesh
10 minutes
Understand Data Mesh principles, tools, and best practices for implementing a decentralized data architecture. Learn when and how to apply …
A Modern Data Strategy: Medallion Architectures on DigitalOcean
5 minutes
A modern, scalable, and efficient data analytics pipeline that transforms raw data into actionable insights, utilizing DigitalOcean's …
Uncovering Hidden Biases in AI Datasets
4 minutes
Strategies for detecting and mitigating bias to ensure fairness and equity in artificial intelligence.
Tools for Financial Data Scientists
4 minutes
TileDB, PrestoDB, TensorFlow, Dask, Zarr, and Apache Arrow can transform data management and analytics in the financial industry, enhancing …
Azure Data Factory, Azure Databricks, and Azure SQL Server: A Focus on Change Data Capture and Medallion Architecture
3 minutes
Azure services like Data Factory, Databricks, and SQL Server offer significant benefits when aligned with the Medallion Architecture.
Data Governance in the Cloud with Terraform
3 minutes
Terraform, a powerful Infrastructure as Code tool, can be leveraged to implement effective data governance in your cloud environment.
Privacy by Design: A Guide for Data Engineering Teams
4 minutes
Privacy by Design and its importance in data engineering.
Zero Trust in Data Lakehouses
4 minutes
An overview of the principles of zero trust security can be applied to a medallion architecture within a data lakehouse
Understanding & Addressing the Critical Concerns of API Security
6 minutes
Delve into the ten most critical concerns for API security.
Navigating Your Data Strategy: Data Warehouse, Data Lake, or Data Lakehouse
3 minutes
Starting with the right pattern is important and you may be considering approaches such as a data warehouse, a data lake, or perhaps the …
An Approach to Generative AI
5 minutes
Implementing Zero Trust for containers can help organizations secure their dynamic containerized environments and minimize the risk of …
Embracing Zero Trust for Container Security
4 minutes
Implementing Zero Trust for containers can help organizations secure their dynamic containerized environments and minimize the risk of …
The Medallion Architecture in a Data Lakehouse
4 minutes
Medallion architecture is a design pattern for data lakehouses that helps organizations effectively manage and analyze data at scale.
Data Lakehouse: Some Pros and Cons
4 minutes
The data lakehouse concept has emerged as a new approach to address the limitations of traditional data lakes and data warehouses.
12 Critical Concerns of Data Governance
4 minutes
In the age of data-driven decision making, effective data governance has become increasingly important for businesses of all sizes.
Data Governance Monitoring & Auditing: Tips for Compliance & Trustworthiness of Your Data Assets
3 minutes
Data literacy is the ability to read, analyze, interpret, and communicate data effectively.
Boosting Data Literacy to Empower Data-Driven Decision-Making
3 minutes
Data literacy is the ability to read, analyze, interpret, and communicate data effectively.
A Getting Started Guide for Data Architecture
4 minutes
Data architecture is the backbone of an organization's data management strategy, providing the structure and guidelines for storing, …
Data Ethics and Responsible AI: Building Trust and Ensuring Fairness in Data-Driven Solutions
3 minutes
As data-driven solutions and artificial intelligence (AI) become increasingly prevalent, organizations must prioritize data ethics and …
Data Access and Sharing Best Practices: Balancing Collaboration and Security
3 minutes
Effective data access and sharing practices are crucial for organizations to facilitate collaboration, drive innovation, and make informed …
Data Lifecycle Management for Data Governance and Optimization
5 minutes
Data Lifecycle Management (DLM) is a critical aspect of data governance, involving the systematic management of data throughout its entire …
Data Integration Strategies: Unifying Your Organization’s Data for Better Decision-Making
6 minutes
Data integration is a critical process for organizations looking to combine data from multiple sources, systems, and formats to enable …
Data Stewardship: The Cornerstone of Effective Data Governance
3 minutes
Data stewardship plays a crucial role in any successful data governance program
Data Quality Best Practices
3 minutes
Data quality is a critical component of any data governance program.
Why IaC with Terraform is best practice
3 minutes
Why an Infrastructure as Code approach with HashiCorp Terraform is best practice.
How to Determine Asset Risk for Cyberattacks
2 minutes
Questions to ask yourself to determine how assets are at risk from a cyberattack.