the moat

Enterprise & Governance

Agents that touch money, customers, or regulated data need more than a demo. This section translates model-risk discipline — SR 11-7, OCC, FFIEC, EU AI Act — into concrete controls for agentic systems. All examples generic, no vendor pitch.

The agent adoption ladder: personal → team → enterprise, without the faceplant

What actually changes when an agent graduates from one laptop to a team to a company — identity, secrets, review, cost — and the checklist for each rung.

AI agent governance for regulated industries: a practical framework

A working control framework for agentic AI in banks, insurers and other regulated organizations: five control layers, a worked example of a refund agent, and a mapping table to SR 26-2 concepts and EU AI Act articles.

Agent observability: what to log, what to alert on, and what to keep

You cannot debug, defend, or bill what you did not record. The trajectory-log specification, the four signals worth alerting on, and retention that satisfies both engineers and auditors.

How to secure your agent supply chain: pinning, provenance, and MCP server vetting

A hands-on guide to locking down the packages and MCP servers your agents run on: hash-pinned lockfiles, release cooldowns, provenance checks, .pth audits, SBOMs, and tool-definition pinning against MCP rug pulls. Every command tested.

FinOps for AI agents: metering token spend before it meters you

An architecture for agent cost governance: OpenTelemetry GenAI conventions for instrumentation, a gateway for enforcement, and the reporting dimensions finance will actually ask for.

Human-in-the-loop patterns that scale: approval design for agent actions

Naive HITL either rubber-stamps everything or drowns reviewers. Five approval patterns, a materiality matrix for choosing, and the metrics that tell you when to loosen the loop.

Prompt injection for agentic systems: a working threat model

When agents read email, web pages, and documents, every input is a potential instruction. The lethal trifecta, the controls that actually work, and the ones that only feel like they do.

EU AI Act timeline for AI agents after the Digital Omnibus (2026–2028)

Which EU AI Act obligations already apply to AI agents, which moved under the Digital Omnibus (Regulation (EU) 2026/1744), and a checklist of what an agent team should do this quarter.

SR 26-2 explained: governing agentic AI when model-risk guidance excludes it

SR 26-2 replaced SR 11-7 in April 2026 and explicitly puts generative and agentic AI out of scope. What the guidance actually says, what that exclusion does and does not mean, and a practical control framework for the agents that fall into the gap.