View AI Agent Identity: The Complete Enterprise GuideAI agent identity answers who this is and whether it's allowed in. It does not answer whether what it did was okay. This guide covers what agent identity is, why traditional IAM breaks for agents, the delegation-versus-impersonation decision, the four-layer identity model, seven identity mechanisms compared by the audit log line each one leaves behind, how identity failed in the ServiceNow BodySnatcher case, and what identity cannot solve on its own.
View AI Agent Accountability: Who's Responsible When It Acts?Four parties can be accountable when an AI agent takes the wrong action: the deploying organisation, the permission grantor, the agent vendor, and the model provider. Which one it lands on is decided by evidence, not by contract language, and the single field most logs are missing, an actor distinct from the human whose credential the agent borrowed, is enough to collapse every one of those claims at once.
View Apple can protect the audio. What happens to asking?Lessons from local AI, and the question of permission when capturing a conversation becomes routine.
View The list finally caught the god agentA deterministic decision point outside the model, in the live path, that decides before every action executes: that's the TLDR of every mitigation in the 2026 OWASP LLM Top 10. Excessive Agency jumped from rank 6 to rank 3, checked for the first time against 7,714 real incidents instead of a practitioner vote alone. Read the mitigations, not the ranks, and they all converge on one prescription: mediate everything.
View NPC Nation: what Australia's new AI framework actually coversThe 15 July framework binds data centres: where they sit, what power and water they draw, what they pay for the grid, plus training on Australian creative work. It puts no new obligation on anyone building with models. What already binds you is the law you have: consumer law, APRA, ASIC, the Privacy Act. Neither document says who gets to say no.
View Claude Tag: an agent that acts as itself, not on your behalfClaude Tag puts @Claude in Slack as its own per-channel service account, not on behalf of the person who asked. That breaks the delegation model everyone converged on, where the audit log can still name a human. Useful, but it revives the old service-account problems with an AI on top.
View Kill the God Agent: how we think about agent securityA God Agent is one model wired to every tool on one shared identity, holding the whole lethal trifecta at once: it reads untrusted content, touches private data, and talks to the outside world. You can't filter prompt injection out of that, so you change the architecture instead. Three deterministic moves: scope every agent, sign every call, stop every breach. Break even one leg of the trifecta and the blast radius shrinks.
View Four Layers of AI Agent Identity: The Model I UseAgent identity makes more sense as four stacked layers: a tamper-proof token format, cryptographic proof of which workload is running, a delegation chain that keeps the human as the subject, and a way to onboard to a service an agent has never met. Climb all four and you've proven who the agent is. You still haven't proven that what it did was okay.
View BodySnatcher and the Missing Identity LayerBodySnatcher (CVE-2025-12420) showed how AI agents with aggregated permissions can compromise entire platforms in seconds. Traditional security controls designed for humans don't work at machine speed. Organizations need threat modeling and runtime controls for all three layers: API auth, identity binding, and agent execution.
View Three Regulatory Philosophies, One Global AI MarketThe EU (9/10 risk), US (5/10), and Australia (6/10) take vastly different approaches to AI regulation. Build for EU standards globally: the Brussels Effect means you'll need them anyway.
View AI Agent Identity Crisis: Delegation vs. ImpersonationAI agents are breaking traditional identity and access management systems. From impersonation risks to cross-domain delegation chains, enterprises need new frameworks that balance autonomous operation with accountability and security.
View The $127M Algorithm: When Smart AI Goes WrongWhen AI appears to think but actually pattern-matches toward desired outcomes, you get sophisticated-looking failure. This fictional crisis demonstrates real research about AI limitations and how to build better systems.
View Shadow Coding: what, so what, now what?Shadow coding—developers using unauthorized AI tools or code—is creating significant security and compliance risks. Organizations need balanced governance that enables innovation while maintaining security.
View Claude 4 Risk Assessment - For enterprise deploymentClaude 4 models introduce novel enterprise considerations including high-agency behaviors, self-preservation instincts, and potential consciousness indicators that may require enhanced risk management depending on your deployment context.
View Safe AI by Design: Insights from a System PromptLearn key AI safety and security principles by examining the detailed instructions within a publicly available system prompt, showing how LLMs can be guided towards responsible behavior.
View How to use safety benchmarks to assess technical and business riskWe translate academic benchmarks into actionable risk signals through our proprietary AI governance pipeline, helping organizations implement regulatory-ready controls.
View Why We're Building an AI Governance and Security PlatformOrganizations need AI governance and security now more than ever. We're building a platform to make powerful protection accessible to everyone.
