The thinking behind AI security review.
Threat models, governance evidence, and the decisions that hold up under scrutiny. Written for security architects and the committees they report to.
New posts in your inbox,
when they publish.
Threat modeling, governance evidence, and what AI Committees actually need — written for security architects and AI governance leads. No cadence promises.
Reviewing SAP Joule agents — BTP integration and the A2A protocol surface
Joule agents run governed through SAP BTP, but pro-code agents built on LangGraph, CrewAI, and others connect in over A2A. What that hybrid model means for review.
Reviewing Salesforce Agentforce — the Trust Layer and what it doesn't cover
The Einstein Trust Layer sits between every prompt and every LLM. It's real security — and it's not the whole review. What still depends on the agent's running-user permissions.
Prohibited AI practices under the EU AI Act — what Article 5 actually bans
Article 5 now bans ten AI practices outright, including two additions from the 2026 AI Omnibus. What falls inside the line and how reviews distinguish.
Reviewing Microsoft Foundry Agent Service — hosted agents and hypervisor isolation
Every hosted agent session gets its own VM-isolated sandbox and an auto-provisioned Entra Agent ID. What that buys a review, and what it doesn't.
Reviewing AWS Bedrock AgentCore — Runtime isolation, Identity, and the Agent Registry
microVM-per-session isolation and enterprise identity federation solve real problems. What a review still has to check across Runtime, Identity, Memory, and the new Agent Registry catalog.
Reviewing Microsoft Agent Framework — the AutoGen and Semantic Kernel successor
AutoGen and Semantic Kernel are both in maintenance mode. Microsoft Agent Framework is what replaces them, with native MCP and A2A support — and the review questions that follow from that.
Reviewing OpenAI Agents SDK deployments — the handoff guardrail gap
Handoffs run through a different pipeline than tool calls, and the SDK's own documentation says tool guardrails don't apply to them. What that means for reviewing a multi-agent handoff chain.
What an AI Governance Committee actually needs in an evidence pack
The six artifacts an AI Committee needs to make a defensible decision, and the gaps that appear most often in evidence packs.
Reviewing CrewAI deployments — Crews, Flows, and the security the framework doesn't provide
CrewAI runs an estimated 450 million agents a month with, by its own maintainers' admission, no built-in auth, audit logs, or access controls in the open-source framework. What a review has to supply instead.
Reviewing LangChain and LangGraph agents — the serialization and checkpoint attack surface
Three real 2026 CVEs — a 9.3 serialization RCE, a path traversal, and a checkpoint SQL injection — show where LangChain and LangGraph's trust boundaries actually sit. The review questions that would have caught each one.
ISO 42001 audit readiness — the controls that fail most often
ISO 42001 audits surface the same gaps: incomplete risk registers, missing triggers, intent-not-practice evidence. Close them first.
Security review for agentic AI procurement — a buyer's checklist
Eight security areas procurement teams must address before an agentic AI system reaches production. A structured buyer checklist.
Free resources
Practical templates for every framework covered here.
AI Security Review Template
Full evidence pack with threat model, controls, and evidence grading.
OWASP Agentic Top 10 Controls
Each risk mapped to required controls and lifecycle gates.
Decision Memo
Clearance decision template with rationale and sign-off log.
AI Go-Live Security Checklist
Production gate checklist for security architects and CISOs.