Security & GovernanceWhen the internet burned, we sent in the dragons
A critical PHP vulnerability hit the internet on 21 October 2026. Here is how governed Quox agents, with a human approving every production change and an append-only record, mapped and fixed every exposed surface in about two hours.
Security & GovernanceHow long do you have to keep AI agent logs? A retention reference
A practical reference for how long records of automated and AI-driven activity must be kept, from the EU AI Act (6 months to 10 years) to PCI DSS, SOC 2, HIPAA, SOX and MiFID II, with sources. General guidance, not legal advice.
Security & GovernanceAI transparency law: a disclosure label is not transparency for an agent
Transparency obligations for AI are arriving, from the EU AI Act onward. For a chatbot that can mean a disclosure label. For an agent that takes actions, transparency means a verifiable record of what it did, on whose authority, and with what result.
Security & GovernanceLeast privilege for AI agents: scope the blast radius before anything goes wrong
An AI agent's risk is the access it holds, not how clever it is. Least privilege scopes four axes, tools, data, actions and duration, so a tricked or mistaken agent can only do a little.
Security & GovernanceDefending against prompt injection: contain what you cannot prevent
Prompt injection cannot be reliably prevented, because a model cannot tell instructions from data. The defensible posture is containment: bound what a tricked agent can do, and keep tamper-evident proof of what it did.
AI agentsWhat is an AI agent?
An AI agent is software that pursues a goal by taking actions, not just answering: it reasons, calls tools, and loops until the job is done. Here is what that means.
Security & GovernanceTen reasons to run your AI agents on an enterprise-grade harness
A harness is not a cage. It is the rig that lets something powerful do real work without doing real damage. Ten reasons to put your AI agents on one, and to try it yourself rather than take our word for it.
Security & GovernanceYou don't need to be an enterprise to want enterprise-grade AI
Enterprise-grade AI is not enterprise-only. If you let an AI agent do real work, you want to know what it did, why, and whether it was allowed. That matters at any scale, and a small team may need the controls most.
Security & GovernanceAI agent security is an access problem, not a model problem
AI agent security is about the access an agent holds, not whether the model behaves. How to secure AI agents: blast radius, human approval, credential custody, tamper-evident evidence.
AI governanceHuman in the loop only works if the approval is real
Human in the loop is the reassuring phrase everyone reaches for. But a person clicking approve on an action they cannot see, cannot scope, and cannot be held to later is not oversight, it is theatre. What a real AI agent approval actually needs.
AI agentsAgentic teams break in ways a single agent does not
One AI agent is a tool you supervise. A team of agents is a small organisation, and it inherits the problems of one: duplicated work, unclear hand-offs, and no straight answer to who did what. What actually breaks when you run agentic teams, and what keeps them accountable.
AI governanceRole-based access was built for people. Your agents are not people.
RBAC answers which role is allowed to do a thing. It cannot answer which agent actually did it, acting as whom, on whose authority. That gap is where agent accountability lives, and it needs more than a permission set.