Mapping the Agent Before Anyone Attacks It
A reference operations agent on Google Cloud, threat-modelled against OWASP and MITRE ATLAS, with a first control: a deny-by-default policy check on its tool calls.
Tag
Security
Multi-Cloud Retail Without the Mess
21 minutes
Many QSR and retail estates run identity in Microsoft Entra ID, back-office systems on SQL Server in Azure, the data platform on Google …
Evidence That Looks Like Closure: Fuzzing, Fault Injection, and the GATE PARTIAL Checks
16 minutes
gate-fuzz v1.0.0 emits an artefact filed under Check15 that does not close Check15. Working out why is a useful way into which conformance …
GATE v1.4: Output Validation, a Rust Companion, and the Conceptual Layer as OKF
10 minutes
GATE v1.4 adds C20 output validation at the delivery boundary, formalises break-glass as a signed contract, adds informative mappings to …
Your System Prompt Is Not a Trust Boundary
16 minutes
A text-to-SQL agent's system prompt cannot enforce a data rule. sql-guard v0.2.0 puts the rule in a parser instead, and closes eight …
Your Managed Providers Are About to Be Regulated. Here Is What to Ask Them.
11 minutes
The UK Cyber Security and Resilience Bill and NIS2 both regulate managed service providers directly, wherever they are established. Seven …
Identity Is the Bank Now
10 minutes
Fraud, financial crime, KYC, and customer experience have collapsed into a single engineering question about who the customer is. This final …
Trust Is an Engineering Output
9 minutes
Being correct is not the same as being able to prove it. This final post in The Engineering Underneath argues that trust is an engineering …
Multi-Tenant Agentic AI on Google Cloud: A Production Walkthrough
25 minutes
A review of Google's multi-tenant agentic AI reference architecture stage by stage, naming trade-offs at each decision point and filling the …
GATE v1.4 Roadmap
6 minutes
A preview of the next GATE release: output validation, break-glass formalisation, OWASP AISVS and MITRE ATLAS alignment, a Rust library, and …
The Regulatory Stack, Part 6: Building Under the CRA - A Reference Architecture
11 minutes
A production-grade reference architecture translating the GATE specification into a live runtime, using Apigee, Envoy Proxy, and …
The GATE Conformance Runner: What You Can Automate and What You Cannot
8 minutes
The gate-conformance v1.2.0 runner automates 9 of GATE's 19 checks against a live evidence store. The other 10 return PARTIAL: not failure, …
GATE v1.3: New Controls for Shadow Agents, Data Quality, and Model Drift
4 minutes
GATE v1.3 adds three new controls and a CLI conformance runner to the Governed Agent Trust Environment, closing three assumptions that …