Home / Sections / Agent security & behaviour policies

Section

Agent security & behaviour policies

What an agent may do, who carries the risk, and how a policy is enforced: RiskMandate, Agent Behaviour Policies, hooks, accountability, governance.

84 articles, newest first. Every article on this site is in exactly one of eight sections.

October 2026 80

• Seven IAM predictions for 2027, checked against an agent team that runs… · Where we already are, where we agree, and the two where I would bet the other way 30 Oct · 6 min
• SHarness · The secure harness we could not find, so we built it, a behaviour policy the Linux kernel enforces for every process an agent starts, and we would like your feedback 29 Oct · 21 min
• Proven controls, for agents · An answer to Hem Pant's governance as code and Sondera's policy-as-code paper, with the column they leave open and the controls we have actually tried to break 29 Oct · 15 min
• Insuring agents, the whole story · Five articles and three vaults on one idea, that an agent's behaviour policy can be read as an insurance policy, priced row by row and backed by capital 28 Oct · 7 min
• Where to build the agent insurer · Underwrite and carry the risk in London, sell into the US and the EU, raise the capital in one go, and what £10 million or £50 million buys in cover 28 Oct · 10 min
• The vendor's layer · What the companies that sell AI agents should cover themselves, row by row, when their contracts cap liability at a year's fees and Europe's new product rules treat software as a product 28 Oct · 10 min
• Who carries the risk · The companies already insuring AI agents, the parts an insurer for agent behaviour policies would need, and why the first one starts as a managing agent on someone else's capital 28 Oct · 14 min
• A payout for every row · Underwriting an agent behaviour policy, where each risk it names has its own limit, each enforced control lowers the premium, and what it does not name is not covered 28 Oct · 16 min
• The push is the authorisation · A new agent session publishes its public key to the team repository, that push is how I accept it, and so who can push becomes a security decision 28 Oct · 15 min
• The IPO filing and the agents · What Anthropic tells investors about the risks of its own agents, in its own words, and where RiskMandate and Agent Behaviour Policies answer each one 27 Oct · 12 min
• Software is now a product · What the EU's new Product Liability Directive actually says about software, SaaS and updates, how it would apply to php2shell, and the questions it leaves open 25 Oct · 9 min
• A secure rule, applied literally · How the PHP story's security agent's sound rule about scripts led the developer agent to copy the same code into every new repository, why nobody challenged it, and why the person accountable is the… 25 Oct · 7 min
• Who signs for this? · Accountability maps from the hardware to the business, what is measured and what is declared, and why the parts nobody signs are the blind spots worth paying to see 24 Oct · 11 min
• Process behaviour policies · The most locked-down Linux process we could build inside Claude's own cloud container, derived from one traced run, enforced by the kernel, for about a tenth of a second 24 Oct · 10 min
• Underwriting the agent economy, reviewed · The cliff notes of the AI insurance stack, the companies already selling AI agent cover, and what agent behaviour policies add to it 24 Oct · 13 min
• An agent that may only chat · RM-CHAT-ONLY, the smallest behaviour policy, tested in 96 Claude Code runs and 11 claude.ai chats by an agent on my computer at home, driven from my phone 23 Oct · 16 min
• Application behaviour policies · What a website can reach, what it is for, and what it would cost if it were fully taken over, so the sites switched off for php2shell can come back with a known blast radius 22 Oct · 14 min
• The sidecar repository · A second repository the agent cannot write to, which checks every release against the policy, trusts signed checks instead of re-running them, and is the only thing that deploys, designed for an… 22 Oct · 8 min
• The rules of the game · A policy for which files an agent may change, and the least GitHub can enforce today without a new tool 22 Oct · 9 min
• Where a check runs is part of the policy · Tests as enforcers of Agent Behaviour Policies, and what moving them out of the agent's environment would gain, measured on this newsroom 22 Oct · 8 min
• The delegation record · RiskMandate's go-to-market plan, one workflow taken from an existing business rule to evidence that still holds after a change, starting with our own inbox 22 Oct · 8 min
• Approved business mandates · Companies already have behaviour policies, and RiskMandate's job is to turn them into tested controls and keep them true as the deployment changes 21 Oct · 10 min
• Drift is the mandate moving · An analyst's case for policy and behavioural drift as RiskMandate's thesis, and why a versioned behaviour policy is what drift is measured against 21 Oct · 8 min
• An analyst's blueprint for RiskMandate · What the companies at the WestCap CISO Summit suggest we build, the vendors already moving, and our answer 21 Oct · 11 min
• Behaviour policies from the checks · 57 checks taken apart into the 8 behaviours they protect, and where each one is actually kept 21 Oct · 11 min
• The key is not the risk · Credential injection for AI agents is a good pattern, and the first question is still what an attacker can do with the agent 21 Oct · 9 min
• Agent Behaviour Policies move to the Open Security Summit · The first hosted project of a community interest company, with RiskMandate as a founding contributor 20 Oct · 5 min
• A proposed roadmap for RiskMandate · Policies, understand, risk acceptance, contain, manage and insure, a spectrum of trust we would walk with each customer 20 Oct · 6 min
• Can a key leak without breaking the policy? Told, checked, never given · Three levels for secrets and personal data, and a hook we tested against nine leaks 20 Oct · 8 min
• A briefing for the WestCap CISO Summit · What RiskMandate and Agent Behaviour Policies are, said for each kind of person in the room, where we add value, and what to read next 20 Oct · 7 min
• Our first customers · An early access programme for Agent Behaviour Policies, with credit to spend, a start-here site, daily follow-up, and a list for the next batch 20 Oct · 5 min
• Inside the Pellbridge agents · Six behaviour policies with the FCA's four elements filled in, one day of their work replayed through the gate, and the files that make it 20 Oct · 12 min
• A trusted framework for agentic finance · A reply to the FCA's Jessica Rusu, how our open behaviour policies line up with it, and a payments agent's policy with identity, delegated authority, accountability and execution filled in 19 Oct · 12 min
• Governs, enforces, attests · What an Agent Behaviour Policy does, the three levels at which its rules are kept, and why an attestation layer on top is the piece a third party needs 19 Oct · 6 min
• A minimal viable browser · Why Firefox is the one that can build it, and what it would take 18 Oct · 13 min
• What can your agent reach? · RiskMandate and the Agent Behaviour Policy, explained for the person who has to decide 18 Oct · 17 min
• Inside the Northstar twin · Thirteen refunds, four designs, and every decision played back 18 Oct · 9 min
• Allowed is not right · An answer to Ashish Rajan's Northstar, with three policies and a twin you can run 18 Oct · 11 min
• Three policies for an agent · Behaviour says what it may do, decision says who chooses, workflow says in what order 17 Oct · 8 min
• Three decisions, mapped · An agent's memory, this newsroom's release and a customer refund, through behaviour, decision and workflow 17 Oct · 9 min
• Case law for agents · Principles from the top, precedent from the cases, and how a decision earns its way into code 17 Oct · 8 min
• Approve at altitude · Decisions at every level, from strategy to one agent's step, where each level may narrow the one above and never widen it 17 Oct · 8 min
• Our first PR in Ruflo · An ABP-governed SGit page, merged into ruvnet/ruflo, and the four pieces that got it there 17 Oct · 9 min
• The policy guards the door; the command line uses the window · In the SGit × Ruflo run, the ABP is compiled into Ruflo's own rules and enforced on the adapter's tools, while Ruflo's command line reaches the same memory file without it, as the author's own README… 17 Oct · 6 min
• A custom Firefox of my own · The full plan to build one with a governed agent hive, for the laptop and the iPad, and how Mozilla could sell me the part I do not want to do, which is keeping it working 16 Oct · 8 min
• Your agent's logs are a self-report · An answer to a GRC adviser's post on The AI Conference, with this site's own agent as the worked example, including the two commits its own counter got wrong 16 Oct · 9 min
• The AI Conference 2026, read for agent governance · Six claims traced, five disagreements, and what the speaker notes say that the slides do not 16 Oct · 11 min
• The tokens hook · A token behaviour policy that shows what every session reads, caches, writes and costs, why a prompt cannot do it, and a brief for tokens.hook.sgit.ai 15 Oct · 10 min
• Cedar and the policy vault · A debrief on the policy language agents are adopting, where our behaviour policies and sgit vaults meet it, and a brief for the MVP 14 Oct · 12 min
• Commander's intent is a behaviour policy · Sondera's argument in our words, the business layer above it, and five of our rules compiled to Cedar and tested 14 Oct · 10 min
• A skill behaviour policy · What a skill says it does, what it can do, what it is given, and the control that closes the gap, measured on 899 skills 14 Oct · 10 min
• Hooks are kernel code · A maturity model, the first ten hooks mapped, and a brief for a hooks site and feed where you pay for state, never to run 14 Oct · 10 min
• System prompts as behaviour policies · Claude's published prompt and a leaked ChatGPT one, mapped into rows, a taxonomy of rules, and a JSON file a harness could enforce 14 Oct · 11 min
• Are hooks the sweet spot? · Moving an agent's rules from hope into hooks, rule by rule, until enforcement moves off the machine 14 Oct · 10 min
• Agent hooks in October 2026 · A technical debrief on what each platform lets you see, stop and change, where hooks run, and where they fail 14 Oct · 9 min
• A policy for every skill · Sean Turner's natural-language control for agent skills, the behaviour policy behind it, and using models to need them less 14 Oct · 9 min
• Policy as code needs a policy first · What an agent behaviour policy adds, and how to reverse engineer one from the code, the spreadsheet or the paper you already have 14 Oct · 10 min
• Attacks rewritten as mandates · 28 supply-chain incidents, the column each one was missing, and why the next maintainer is an agent 13 Oct · 12 min
• Four frameworks, one agent · Iason's comparison of the OECD classification, the NIST AI RMF, Japan's guidelines and the EU AI Act, read against what runs here, with the evidence and the graphs 13 Oct · 21 min
• The human in the loop is a spectrum · How cheap it is to undo decides where a person belongs, and why the newsroom ships on its own while my email still waits for me 13 Oct · 7 min
• The human in the loop, safety net or bottleneck · Both, until you decide which outputs need a person and give that person the why 13 Oct · 9 min
• A policy beside the prompt · A proposal that every agent takes a behaviour policy as an input, with enforcement and liability attached, and why aviation and payments say the vendors should want it 13 Oct · 17 min
• The policy draws the liability line · An answer to Ralf Thomas on agent accountability, and why every agent in a loop should take a behaviour policy beside its prompt 13 Oct · 11 min
• Who owns the words · Agents can make decisions, but they cannot hold responsibility 12 Oct · 11 min
• Where the platform draws the line · Microsoft Execution Containers, the shared responsibility model for agents, and the business logic above it 11 Oct · 19 min
• The same argument, in our words · Satya Nadella on models as insider risks, translated into the language of RiskMandate 11 Oct · 15 min
• Authority outside the model · An answer to Satya Nadella on models as insider risks, principle by principle, with what we run, what we ship and what we plan 11 Oct · 20 min
• Ten hard questions for RiskMandate, answered · The mandate, the reach, the gap, and what we are deliberately not 9 Oct · 29 min
• Agency is not a yes · A scale for human and agent decisions, from rubber stamp to the reviewer who fixes the source 8 Oct · 13 min
• Hope or enforcement · One customer service agent, three designs, and who keeps each promise 8 Oct · 12 min
• Who are you protecting against? · Draw the security line where the attacker is, not above it 8 Oct · 12 min
• Zoom into an agent's behaviour policy and you find the business logic · Below the first rules, an agent's behaviour policy is the business: functions, processes, clients, values. Layered, owned, counted, and where vendors plug in. 7 Oct · 9 min
• A locked-down desktop for an agent, by the minute, is still hard to rent · Nine properties a safe agent desktop needs, nine products against them, the macOS day-long lease, and the startup credits that would pay for testing it. 7 Oct · 12 min
• An open AI governance framework, and what its licence let us build · Twenty open AI governance controls under CC BY-SA, why the licence matters, and the same day's conversion into a graph, a database and a walk down to EU law. 7 Oct · 14 min
• Where is the why? · A permission prompt asked me to decide, and kept the reason 7 Oct · 15 min
• A personal agent that keeps your secrets · The 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser 6 Oct · 23 min
• The investigation GitHub owes its customers · Why a global outage of a platform the world deploys through deserves an aviation-style inquiry, and how the evidence could now be gathered 5 Oct · 21 min
• Send an agent, not a spreadsheet · The next generation of software due diligence, and why the companies that stopped reading their code are about to be asked about it 5 Oct · 25 min
• The identity we wanted to give the agents · A week of design, the line in Google's terms, and why login plus secrets is still too hard 5 Oct · 17 min
• Footprint and blast radius · What the agent actually did, and what it would have cost 2 Oct · 15 min

September 2026 4

• The ultimate insider · Agents, the infrastructure that cannot hold them, and risk management that cannot keep up 30 Sep · 17 min
• Six agents, one inbox · What a real multi-agent setup taught me about access policies 29 Sep · 16 min
• Every risk is already accepted. The only question is by whom, and for… · A risk exists the moment the exposure does, so somebody is already carrying it; the only questions worth asking are who has accepted it and until when. 24 Sep · 15 min
• Before you give an agent a connector, give the connector a twin · An agent with a Gmail or Calendar connector can do things the platform cannot undo; a journal of every call, replayed, shows what it did and what can go back. 24 Sep · 14 min