Source-backed architecture notes for privacy, security, legal, and engineering teams building governed data systems.
When one AI agent delegates work to another, who checks the next action? Review tool permissions, data handoffs and audit records before connecting a multi-agent workflow.
Read article
A hospital AI review should follow the patient data, not stop at the model's sales sheet. Start with access, vendor handling, logs and the process for stopping a risky workflow.
Read article
Building an AI training dataset from public pages? Review the source, purpose, lawful basis and retained personal data before collection becomes a hard-to-unwind pipeline.
Read article
Source author: Bill Fisher, NISTAn assistant may need to read one support case. That does not mean it should inherit a person's full account. A recent NIST discussion makes identity and delegated authority a practical starting point for agent security.
Read article
Before sharing a dataset or sending it to an AI tool, ask what the recipient can learn from the fields that remain. The EDPB's July 2026 draft guidance offers a timely reason to review assumptions about anonymous data.
Read article
A preference screen can show that consent changed while a background job continues using yesterday's permission. A useful readiness exercise follows the withdrawal from the screen to the systems doing the work.
Read articleThe Act became broadly applicable on 2 August 2026. Classification matters; an accountable operating record matters more.
Read article
A precise healthcare security plan meets the rule in force and tracks the proposed cybersecurity changes without mislabelling them.
Read articleThe correct DPDP provisions, the systems that teams commonly miss, and the honest role of tokenization and cryptographic erasure.
Read articleBuild an incident evidence path that supports an early CERT-In report and a disciplined stream of verified updates.
Read article
Map and protect sensitive data moving through IDE assistants, RAG, MCP tools, agents, and configured model connections.
Read articleReduce third-party exposure with field-level minimization, scoped access, tokenization, and evidence on the routes you control.
Read articleWhy an audit database is not enough—and what an independent verification path changes for customers, investigators, and regulators.
Read articleA practical model for de-identification, governed rehydration, provider pinning, and disclosure manifests across AI data paths.
Read articleA phased engineering program for the period before the core operational provisions commence on 13 May 2027.
Read articleOfficial-source photographs provide context for our independent articles. They do not imply endorsement. Photographs are cropped for layout; headline overlays are added by Securelay.
