Posts tagged "governance"
Planning agents for the future: what a platform needs to run them over time
Run logs, a short morning report, a supervising review agent, a release window with veto and four-eyes publishing: what a platform needs for agents, and what exists.
Does a classifier model always make sense? Deciding what an agent may do
Classifier models can route requests and judge agent actions, but they cost money and make mistakes. When rules are better, when a classifier helps, and how autonomy levels fit.
Agent platform readiness: the checklist that ties the series together
AI agent production readiness checklist across architecture, skills, security, operations, cost and evaluation, each item linked to the post behind it.
An architecture review for agent systems in one page
An AI architecture review template for agents on one page: purpose, boundaries, data flow, contracts, autonomy and failure paths, with questions for each.
Building an internal skills catalog: review, ownership and discovery
Build a skills catalog for your organisation: submit, review, publish with owner and version, then deprecate. Borrows ideas from public registries.
Treat agents like insiders: what misalignment research means for operations
AI insider threat: research on agentic misalignment suggests insider-risk controls for agents, such as separation of duties, limited access and monitoring.
Beyond tools: MCP sampling, elicitation and tasks
MCP sampling lets servers request model calls; elicitation asks users for input; tasks track long work. Each moves control and needs its own policy.
The agent security checklist: twenty questions before production
AI agent security checklist: twenty yes/no questions on identity, permissions, data flow, injection, sandboxing, supply chain and audit, each with a link.
An AI governance operating model for agents: who owns what
An AI governance operating model fails when nobody owns the agent registry, policies or budget. Roles and a RACI for platform, security, owners and reviewers.
Enterprise AI agent rollout: pilot, baseline, then scale
An enterprise AI agent rollout works best with a small pilot, telemetry from day one, spend limits and written exit criteria for each wider step.
Ops series: audit trails are not logs
An AI audit trail must be complete, attributable and tamper-evident; logs are for debugging. How to separate them on agent platforms and what goes where.
NIST AI RMF for agent teams: Govern, Map, Measure, Manage in practice
The NIST AI RMF is voluntary and has four functions. How agent registries, data-flow maps, evals, traces and policies map to Govern, Map, Measure, Manage.
Reading the OWASP Top 10 for Agentic Applications as a platform team
How a platform team can turn the OWASP agentic top 10 and related LLM Top 10 entries into controls: least privilege, sandboxing, approvals and audit.
Claude Code vs OpenCode: a governance comparison
Claude Code vs OpenCode on the controls a platform team needs: permission rules, auto modes, subagents, MCP, providers and managed config. No benchmarks.
Human in the loop for AI agents that works: fewer approvals, better ones
Human in the loop for AI agents fails when every call needs approval. Reserve people for high-risk actions, show context, and let policy handle the rest.
Ops series: change management and prompt versioning for agents
Prompt versioning and change management for AI agents: apply semantic versioning, review and rollback to prompts, skills and policies like code.
Running agents is operations: the old disciplines still apply
AI agent operations is not a new field: identity, least privilege, change management, SLOs, cost and audit all still apply. The opening of an operations series.
Agent architecture is not application architecture: the agentix pattern
Application architecture structures code. Agent architecture decides who may do what at run time. The agentix pattern - one MCP server per system, one agent per step - is our answer.
What is an agent harness, and why do harnesses keep shrinking?
An agent harness is the loop and scaffolding around a model. As models improve, much of it moves into the model or the API. What stays is governance, and that is why open-agentix treats the harness as replaceable.
Dark software factory: only for MVPs and PoCs
Letting agents build software with minimal human touch can be a fast way to a prototype. open-agentix offers it as an opt-in mode with a fixed notice, and keeps approval gates for production.
Cost is a platform concern: budgets, per-agent and per-tenant attribution, export
Agent systems can fail financially while working technically. open-agentix prices every step, attributes it to tenant, agent and use case, stops runs at their budget and exports the lines.
A model may ask, the policy decides: deterministic gates and tamper-evident audit
In open-agentix a model can request a tool call but never authorises it. A deterministic policy gate decides before each call, and a hash-chained audit trail records what it decided.