Your System Prompt Is Not a Trust Boundary
A text-to-SQL agent's system prompt cannot enforce a data rule. sql-guard v0.2.0 puts the rule in a parser instead, and closes eight bypasses found in our own guard.
Tag
Ai
Arkhe: An Ontology Language for AI Systems
7 minutes
Two weeks ago I argued that your ontology is the asset and you should own it in a neutral, versioned form. Arguing is cheap. Arkhe v0.2 is …
Your Ontology Is the Asset. Stop Renting It Back.
10 minutes
Agentic AI post-mortems keep naming the same trio: determinism failures, hallucinations, and compliance gaps. An ontology retires all three, …
Multi-Tenant Agentic AI on Google Cloud: A Production Walkthrough
25 minutes
A review of Google's multi-tenant agentic AI reference architecture stage by stage, naming trade-offs at each decision point and filling the …
GATE v1.4 Roadmap
6 minutes
A preview of the next GATE release: output validation, break-glass formalisation, OWASP AISVS and MITRE ATLAS alignment, a Rust library, and …
The Regulatory Stack, Part 6: Building Under the CRA - A Reference Architecture
11 minutes
A production-grade reference architecture translating the GATE specification into a live runtime, using Apigee, Envoy Proxy, and …
The GATE Conformance Runner: What You Can Automate and What You Cannot
8 minutes
The gate-conformance v1.2.0 runner automates 9 of GATE's 19 checks against a live evidence store. The other 10 return PARTIAL: not failure, …
GATE v1.3: New Controls for Shadow Agents, Data Quality, and Model Drift
4 minutes
GATE v1.3 adds three new controls and a CLI conformance runner to the Governed Agent Trust Environment, closing three assumptions that …
The Regulatory Stack, Part 5: The Cyber Resilience Act Closes the Last Loophole
10 minutes
Think your AI agent escaped the EU AI Act's high-risk classification? The Cyber Resilience Act lands more than a year earlier, and it …
The Regulatory Stack, Part 4: Engineering Under the AI Act - Article 15 Cybersecurity in Practice
10 minutes
How to turn the EU AI Act's stringent cybersecurity requirements into a clean, automated side effect of your existing platform engineering …
The Regulatory Stack, Part 3: How the EU AI Act Made Verification a Legal Question, Not a Best-Practice One
13 minutes
The EU AI Act binds providers and deployers to a continuous, evidenced verification posture by December 2027. Here is the operational …
The Regulatory Stack, Part 2: Why the Boardroom Should Be Funding the Verification Layer in 2026
10 minutes
The capital deployment decisions boards make this year will determine whether their autonomous AI systems are governable assets or …
The Regulatory Stack, Part 1: AISVS Has 14 Categories. GATE Has 16 Controls. Here Is the Map.
11 minutes
AISVS tells you what to verify. The AI Act tells you that you must. Neither tells you how to enforce. This is the engineering map between …