audit
4 posts — newest first.
-
The Evidence an AI Operator Owes You Before It Acts
A tool-call log answers none of the eight questions an agent incident raises. A decision-time evidence record answers all eight, before the action runs.
-
OWASP published an MCP Top 10. Go count your servers before you read it.
OWASP now has a Top 10 dedicated to Model Context Protocol. The list is useful — but the census behind it is the part that should worry your platform team.
-
The runner is the API: why your remediator's contract matters more than your handlers
Everyone reviews the handler that restarts the pod. The safety lives in the runner around it — and handlers that skip it silently void every guarantee.
-
Identity was the easy half. Agent authorization is becoming an audit-trail problem.
NIST, a Senate bill and the MCP roadmap converge on one requirement: prove which agent did what, for whom, under whose grant. Your traces do not.