Mapping the Agent Before Anyone Attacks It
A reference operations agent on Google Cloud, threat-modelled against OWASP and MITRE ATLAS, with a first control: a deny-by-default policy check on its tool calls.
Tag
Agentic
The CTO Playbook for Agentic Systems
6 minutes
A 71-page operating manual for engineering leaders whose software has started to reason, decide, and write the software that carries out …
GATE v1.5 Roadmap
10 minutes
A preview of the next GATE release: a per-control ISO/IEC 42001 mapping with the asymmetry written down, streaming-aware output validation, …
Your System Prompt Is Not a Trust Boundary
16 minutes
A text-to-SQL agent's system prompt cannot enforce a data rule. sql-guard v0.2.0 puts the rule in a parser instead, and closes eight …
Arkhe: An Ontology Language for AI Systems
7 minutes
Two weeks ago I argued that your ontology is the asset and you should own it in a neutral, versioned form. Arguing is cheap. Arkhe v0.2 is …
Your Ontology Is the Asset. Stop Renting It Back.
10 minutes
Agentic AI post-mortems keep naming the same trio: determinism failures, hallucinations, and compliance gaps. An ontology retires all three, …
AI Safety Assurance Is Still Goodwill, Not Evidence
6 minutes
The UN's first scientific assessment of AI says safety assurance still runs on developer goodwill, not verification. Here is what …
Multi-Tenant Agentic AI on Google Cloud: A Production Walkthrough
25 minutes
A review of Google's multi-tenant agentic AI reference architecture stage by stage, naming trade-offs at each decision point and filling the …
Engineered Compliance: Beyond Templates
10 minutes
Regulators do not ask for documents. They ask for systems that behave a certain way and the ability to prove it. We introduce Sakura Sky's …
The Regulatory Stack, Part 4: Engineering Under the AI Act - Article 15 Cybersecurity in Practice
10 minutes
How to turn the EU AI Act's stringent cybersecurity requirements into a clean, automated side effect of your existing platform engineering …
The Regulatory Stack, Part 2: Why the Boardroom Should Be Funding the Verification Layer in 2026
10 minutes
The capital deployment decisions boards make this year will determine whether their autonomous AI systems are governable assets or …
The Regulatory Stack, Part 1: AISVS Has 14 Categories. GATE Has 16 Controls. Here Is the Map.
11 minutes
AISVS tells you what to verify. The AI Act tells you that you must. Neither tells you how to enforce. This is the engineering map between …
The Autonomous Horizon, Part 6: The Architecture of Trust
10 minutes
The four pillars of the autonomous enterprise describe the operating model. GATE names the framework that makes it engineerable.