セキュリティとガバナンス
安全な自律性、認可、監査、ポリシー適用。
23件の記事
ガバナンスされたAI修復：制御を失わずにソフトウェアを修正する
修復が自律型信頼性において最も難しい部分である理由と、企業が安全にAIによる修正を導入する方法。
The Security Debt Crisis: AI Writes Code Faster Than You Can Secure It
AI now writes a large share of enterprise code, and it introduces critical flaws faster than scanner-and-ticket workflows can resolve them. Security debt compounds, regulatory exposure rises, and the answer is governed continuous validation, not more alerts.
A Reachability Model for AppSec: From Alerts to Velocity
Severity rates a vulnerability in isolation; reachability tells you whether it is exploitable in your running system. A reachability-driven model can cut exploitable exposure 70-90% while accelerating remediation.
Agents Propose, Humans Authorize: A Reference Architecture for Governed Autonomy
A reference architecture for letting agents act on production safely: the four control surfaces, policy, approval, evidence, attribution, and how they wire into the loop.
More Models Won't Save You: Why AI-Generated Code Needs a Control Layer, Not Smarter Autocomplete
Better code generation can't validate its own output. Why AI-written code needs a governed control layer that maps, tests, and proves every change.
Code Without Provenance: The Real Risk When 41% of Your Codebase Has No Author
When 41% of your codebase has no author, the real risk isn't bugs, it's lost intent. How a System Graph restores the provenance AI-generated code strips away.
The Audit Trail Is the Product: Evidence-Grade Logging for Autonomous Agents
Why the audit trail is the primary system of record for autonomous agents in fintech, and how to make it evidence-grade: attributable, complete, and tamper-evident.
The Governed-Autonomy Readiness Checklist for Regulated Industries
A pre-deployment checklist for compliance and risk officers evaluating governed autonomous agents in healthcare: policy-as-code, scoped permissions, signed capsules, attribution, and a kill switch.
Governing Customer-Owned Agents: Control-Layer Patterns for Mixed Agent Fleets
A platform engineer's guide to governing mixed agent fleets: how one control plane authorizes your agents and vendor agents alike, without trusting either by default.
Glossary of Governed Autonomy: Policy, Approval, Attribution, and Blast Radius
A precise glossary of governed autonomy for engineering leaders: define policy, approval, attribution, and blast radius so you can evaluate agent control planes on substance.
How to Measure Governance Overhead Before It Kills Your Velocity
Governance that can't prove its value gets dismantled. Three KPIs, approval latency, override rate, and blast-radius-contained incidents, show whether controls help or just slow you down.
Separation of Duties for AI Agents: Who Proposes, Who Authorizes, Who Is Accountable
A CISO's framework for applying separation of duties to AI agents: why the proposing agent can never authorize its own change, and who stays accountable.
Approval Gates That Don't Become Bottlenecks: Designing Autonomy Tiers for Engineering Teams
A practical guide for engineering managers to design read-only, propose-only, and auto-apply-with-rollback autonomy tiers that add confidence without adding queue time.
Why 80% of Developers Bypass Policy, and What That Means When the Developer Is an Agent
~80% of developers bypass policy. When the developer is an agent, advisory governance becomes a threat model. Why control must move to the action layer.
12 Ways AI Coding Assistants Quietly Introduce Critical Flaws
Industry research finds ~45% of AI coding tasks introduce critical flaws. Here are 12 concrete ways that happens, and how to govern it.
Kill Switches and Circuit Breakers: Designing Graceful Stand-Down for Reliability Agents
An SRE's guide to designing kill switches, circuit breakers, and graceful stand-down so reliability agents fail safe instead of failing open.
Your SAST Scanner Wasn't Built for AI-Generated Code. Here's What Reachability Changes.
SAST scanners flood the backlog when most code is AI-generated. Learn how reachability-driven triage cuts exploitable exposure by 70-90% instead of alert volume.
Security Debt Is the New Technical Debt, and AI Is Compounding It Daily
Security debt is a measurable, accruing liability that AI copilots compound daily. A definition, a model to track it, and how governed remediation pays it down.
The $2.41T Question: What Poor Software Quality Costs When AI Writes the Code
AI now writes ~41% of code, and ~45% of those tasks introduce critical flaws. Here's a CFO-legible model for what poor software quality actually costs.
We Verified What an AI Coding Agent Shipped for Two Weeks. The Loop Caught What Review Missed.
A case-study walkthrough of running the Understand-Test-Reproduce-Remediate-Verify loop on two weeks of AI-generated commits, and the defects it caught that PR review missed.
From Prompt to PR: The Checklist for Letting AI Write Production Code Safely
A control-layer checklist for platform engineers: the provenance, validation, reachability, approval, and evidence gates an AI-authored change must clear before merge.
41% AI Codebases Shatter Legacy QA Assumptions
Explore how AI-generated code is challenging and transforming traditional QA practices.
Why 80% of Developers Bypass Security Policy, and Why Blaming Them Misses the Point
~80% of developers bypass security policy. For CISOs, that's a control-design failure, not a discipline problem. Why advisory governance fails at AI scale, and the fix.
