Forged at USCYBERCOM. We replace "Detect & Respond" with Engineered Certainty. Architects of: 🛡️ Warden 🔗 Digital Shield 🤖 AI SAFE² 👇 Get the Blueprint
Baltimore - Washington DC
Joined January 2021
- Tweets24.7K
- Following556
- Followers1.3K
- Likes33.8K
Pinned Tweet
The Death of Governance & Compliance in an AI Era..
This statement is obvious for some, obscure for others and for many it is down right confusing.
Most "AI Security" advice is focused on governance and compliance guidance...aka how to create an AI policy or program.
It’s vague.
It’s theoretical.
It’s useless to an engineer.
But most of all it misses the point with AI.
We've been lead to believe if...
We document, monitor or detect risk, we can manage it and everything will be OK.
Reality is...
AI risk is executed in milliseconds & Documentation Does NOT STOP Execution.
♟️Strategic Truth
Most AI security advice from a policy standpoint:
🚫Optimizes for regulatory defensibility
🚫Assumes post-event containment
🚫Treats AI as a governance problem
But AI exploitation is an engineering problem.
Thus, until policy mandates preventive, runtime-enforced controls, AI security guidance will remain structurally misaligned with the threat landscape.
This is where we stepped in when we built the architecture standard back in Jun 25.
Been working hard on AI SAFE² ever since but accelerated after the explosion of risk last quarter by turning this holiday season into go-mode.
We Finalized a v2.0 then quickly finalized a v2.1 both are massive upgrades & industry must haves!
Introducing the AI SAFE² Framework (v2.1):
☑️The Universal GRC Standard for Agentic AI & ISO 42001 Compliance.
📂The open-source protocol for governing Agentic AI.
- Dropped our Github Repo
Let's unpack what all this actually means for AI Governance & Compliance moving forward...🧵
Star the repo to show your support👇
Your code review assumes a human wrote the change. For a growing share of commits, that's no longer true. Gate AI-written changes on four records: scan results, dependency checks, what the agent ran, and who approved what.
The four-layer merge gate, layer by layer: cyberstrategyinstitute.com/s…
The gap between IT and OT has physical consequences.
Fatal flaw #4: separate teams, separate plans, shared exposure.
Map dependencies. Control access. Exercise safe containment together.
Can security and operations execute the same response?
Agent harnesses get bypassed at the seams: tool description injection, gaps in approval flows, delegation that hands a sub-agent more authority than its task needs. Each one is testable. When an assessment names a bypass, ask to see the test that proves it.
The bypass paths, and the tests that catch each one: cyberstrategyinstitute.com/s…
Claude Code's own docs say bypassPermissions mode skips permission prompts, including writes to .git and .claude, and to use it only in containers or VMs. That's a harness setting. Map what your harness allows before you spend another week evaluating the model.
Agent harness security: architecture, controls and assessment: cyberstrategyinstitute.com/s…
Five places AI development breaks, five free tools: a coding agent baseline, an AI code debt estimator, a harness risk grader, a sandbox escape and leak test plan, and a Rego and Cedar policy pack. Each control tested with positive and negative cases.
Your patch queue is the attacker’s waiting room.
Fatal flaw #5: waiting for a fix without containment in place.
A remediation deadline does not stop an attack.
What protects your highest-risk asset before the patch lands?
Model safety training is a property of the model. It isn't a security boundary. Every consequential agent action needs a control outside the model: the harness, the tool boundary, a policy decision point. Put the decision where the model can't argue with it.
The next prompt injection may arrive as another agent’s finished work.
A2A messages, task artifacts and shared memory cross trust boundaries too.
AI SAFE²: verify the sender, inspect the content, constrain delegation, authorize the action.
What governs your handoffs?
Test the handoff with clean and tampered artifacts.
Does a forged approval reach a tool? Does legitimate work still complete?
Keep evidence of the principal, delegated scope, artifact and decision.
github.com/CyberStrategyInst…
Air-gapping doesn't make model output deterministic, and it doesn't stop local misuse. An isolated agent with broad permissions can still wipe files or abuse credentials. The test worth running: cold-start the full workflow with zero external connectivity.
One crown jewel. Too many keys to the kingdom.
Fatal flaw #6: centralized identity with authority that reaches everywhere.
If the attacker controls who gets trusted, access becomes part of the attack.
If your directory falls, what still refuses them?
Plenty of "air-gapped" AI still phones home. The model runs local, while the system pulls from container registries, identity providers, license servers, update endpoints and time sources. Isolation is a property of the whole system, so test the whole system.
Isolation boundaries, runtime controls and readiness tests for air-gapped AI: cyberstrategyinstitute.com/a…
Open weights and local compute are parts of a sovereign stack. They don't prove you have one. Pick one external dependency, identity or updates or telemetry, switch it off, and write down which workflows and decisions you still control.
How to build, and test, a sovereign AI stack: cyberstrategyinstitute.com/s…
