Service
AI Security and Governance
Agents get identities, permissions, logs and limits like any other user. LGPD, GDPR, ISO 42001 and NIST AI RMF turned into controls that run, not binders that sit.
- Engagement
- Fixed scope, or bundled with a deployment
- Typical duration
- 2 to 4 weeks on its own, continuous when bundled
- Ideal for
- Companies putting agents near customer data, regulated sectors, and anyone whose next audit will include a question about AI.
Problems it solves
Sound familiar?
- An agent with a broad API token is a new insider with no manager and no lunch break.
- Prompt injection turns a helpful assistant into a data exfiltration channel, and nobody is testing for it.
- Legal asks which personal data the AI processes and where. The answer is a shrug.
- Policies about AI usage exist as PDFs. Nothing in the environment enforces them.
Outcomes
What changes
-
A threat model for your agents and AI features. What they can reach, how they can be abused, and what stops it.
-
Identity and least privilege for agents through your existing provider, with scoped, short-lived credentials.
-
Guardrails that run. Input and output checks, tool allowlists, approval gates, rate and spend limits.
-
Governance mapped to LGPD, GDPR, ISO 42001, NIST AI RMF or your sector's rules, with evidence produced by the platform.
Deliverables
What you receive
- Threat model and risk register for the AI estate, with prioritized fixes
- Agent identity and permission model, implemented and tested against abuse cases
- Guardrail configuration, logging and monitoring for AI traffic
- Control matrix, AI usage policy and evidence design for the next audit
How it works
How the engagement works
Every agent is a user. It has credentials, it takes actions, it reads data. The difference is that it can be talked into things by a document it was asked to summarize. Security for AI is ordinary security done rigorously, plus a few new attack surfaces that most deployments ignore.
I give agents the same treatment as people: an identity, the minimum permissions for the job, logs of what they did, and limits on how much they can spend or send. Then I test the guardrails the way an attacker would, and I map the whole thing to the frameworks your auditor cares about.
The result is AI that legal, security and the board can say yes to, because the controls are in the system and the evidence is a query away.
Related work
Where this engagement has been applied
-
0 client documents in personal AI accounts after rollout
Deployed a Hermes Agent on the firm's own cloud tenant, connected to mail, calendar and documents with per-person access, replacing personal chatbot accounts and taking recurring drafting and research work off the partners' desks.
Next step
Start with AI Security and Governance.
Send a few lines about your setup and what is failing. I reply with the questions I need answered before we scope, and a slot for a first call.