Vendor Approval Is Not Your Authorization Model
Restricted cyber-model access adds a governance decision above the API key. Your organization still has to decide who can use that capability, against which systems, and how to revoke it.
notebook / tag
#governance
5 entries with this tag.
Disabled Is Not Removed
Two Rovo disclosures show why agent governance cannot stop at an admin-console toggle. Security teams need to verify runtime capabilities, data reach, and egress independently.
Red, Blue, Green, and Who Can Change Production?
Project Perception puts red, blue, and green agents into a closed security loop. Autonomous remediation needs separate identities, signed evidence, deterministic policy, rollback, and independent validation.
Using Citadel to Make Microsoft Foundry Governance Real
I am using the Foundry Citadel reference platform to test how identity, network isolation, gateway policy, observability, and agent lifecycle controls fit together in a governed Azure deployment.
Using NIST AI RMF to Build an AISecOps Program
NIST AI RMF gives an AI security program its operating model: govern the work, map the context, measure the risk, and manage what happens next.