White Papers
In-depth guides on governing AI agents in regulated industries — from policy-as-code architecture to compliance requirements.
How We Stopped an AI Agent from Paying a Sanctioned Vendor — Automatically
A $2.3M near-miss nobody talks about: how policy-as-code at the kernel layer blocks sanctions violations before they happen, without slowing down AP automation.
Read white paper →
SOX Compliance for AI: Building an Unbreakable Audit Trail for Every Automated Payment
Every CFO is now asking: can we prove to auditors what our AI agents did, and why? Here's how immutable audit records answer that question.
Read white paper →
Why Your AP Automation Needs a Kill Switch (And How to Build One)
Runaway agents are a real risk in high-volume payment workflows. A governed kill switch — not a prompt — is the only reliable mitigation.
Read white paper →
From $0 to $250K: Spending Tier Policies That Actually Enforce Themselves
Approval matrices on paper don't stop agents. Policy-as-code spending tiers do — with zero reliance on the model to comply.
Read white paper →
The CFO's Guide to Trusting AI Agents with Money
What governance controls actually need to be in place before you hand financial authority to an LLM-based agent. A practical CFO-level checklist.
Read white paper →
HIPAA-Compliant AI Workflows: Why Policy-as-Code Changes Everything
The healthcare AI compliance paradox: you need speed and you need auditability. Policy-as-code is the only way to have both without human bottlenecks.
Read white paper →
Human-in-the-Loop Isn't Slowing Down Your AI — It's Protecting Your License
Why the human-in-the-loop vs. AI-speed false choice disappears when approval gates are built into the agent kernel rather than the workflow UI.
Read white paper →
When an AI Orders the Wrong Test: Saga Compensation in Clinical Workflows
Incomplete actions in clinical AI are not a UX problem — they're a patient safety problem. Saga compensation patterns are how you undo what can't stay undone.
Read white paper →
Delegating to AI Without Losing Professional Accountability: The OBO Chain
Law firms can't delegate professional responsibility to an LLM. The On-Behalf-Of chain makes every agent action traceable back to a named human principal.
Read white paper →
Conflict of Interest Checks at Machine Speed: Policy Enforcement for Legal AI
Conflict checks that take three days are now a liability. Here's how to run them at machine speed without sacrificing rigour or professional obligation.
Read white paper →
Your AI Paralegal Needs a Supervision Policy. Here's How to Write One in Rego.
AI paralegals are here. Governance is not. A practical guide to writing paralegal supervision policies in Rego that actually enforce themselves.
Read white paper →
The New Vendor Trap: Why AI Procurement Agents Need a Pending-Status Gate
AI procurement agents that can approve new vendors without a pending-status gate create a risk that multiplies at scale. Here's the architectural fix.
Read white paper →
Multi-Tier Supplier Approval Without the Bottleneck
How policy-driven approval routing eliminates the procurement bottleneck without removing the oversight that compliance requires.
Read white paper →
What Happens When Your AI Submits a Purchase Order to a Blocked Vendor?
A scenario that will happen. How hard-denial policy enforcement stops the transaction, logs the attempt, and routes it for human review automatically.
Read white paper →
FedRAMP-Ready AI Agents: What Governance Controls Actually Look Like
FedRAMP doesn't have an LLM checkbox yet. Here's how to map existing controls to agentic AI behaviour and pass a technical review.
Read white paper →
AI in Government: How OBO Chains Solve the Accountability Problem
Government deployments require a named human accountable for every automated action. The OBO chain is how you satisfy that requirement at agent scale.
Read white paper →
GDPR and Automated Decisions: Using Policy-as-Code to Stay Compliant
Article 22 is the AI clause nobody budgets for. How policy-as-code makes GDPR's automated decision requirements auditable and enforceable.
Read white paper →
LangGraph Is Great. But Who Governs the Agent?
LangGraph solves orchestration. It doesn't solve governance. The missing layer between your agent graph and your organisation's policies.
Read white paper →
OPA Is Not Enough: Why Agentic AI Needs Runtime Policy, Not Just Auth Policy
OPA is excellent for AuthZ. Agentic AI needs runtime policy that evaluates tool calls, spending limits, and saga state — a different problem entirely.
Read white paper →
The Saga Pattern for AI Agents: Rollback When Your LLM Gets It Wrong
LLMs fail. The question is how gracefully. Saga compensation patterns give agentic workflows the ability to undo partial state with no manual cleanup.
Read white paper →
Change a Policy. Don't Restart the Agent.
Hardcoded policy means every rule change is a deployment. Policy-as-code in the kernel means you update a Rego file and the running agent picks it up.
Read white paper →
Building a Human Approval Queue for AI Agents (Without Building an Approval System)
Every team building agentic AI eventually needs a human approval queue. How the kernel provides it out of the box so you don't have to build it.
Read white paper →
Why We Embedded Rego in Rust Instead of Calling OPA Over HTTP
The architectural decision that made sub-millisecond policy evaluation possible: embedding the Rego runtime in Rust rather than treating OPA as a sidecar.
Read white paper →
Hard Denial vs Soft Denial: Why How You Surface a Policy Block Matters
Blocking an agent action is only half the decision. Whether to hard-fail, soft-warn, or route for approval changes how your organisation learns from denials.
Read white paper →
The AI Governance Stack: Why Policy Belongs in the Kernel, Not the Prompt
The governance illusion: why prompt-level rules are structurally unenforceable and what a real governance stack — kernel-level, not prompt-level — looks like.
Read white paper →
Prompt Engineering Is Not a Control. Here's What Is.
The uncomfortable truth about prompt-based safety in enterprise AI. What constitutes a genuine control, and why the distinction matters for liability.
Read white paper →
The 5 Things That Go Wrong When You Skip AI Governance
Real examples of what happens when enterprises deploy agentic AI without governance infrastructure: sanctions violations, runaway spend, audit failures.
Read white paper →
Multi-Agent Trust: How Do You Know Which Agent Authorised That Action?
In agent meshes, trust chains get complex fast. The OBO chain as a cryptographic proof of delegation across multi-agent systems.
Read white paper →
Policy-as-Code vs. Rules Engines vs. Hard-Coded Logic: A Practical Comparison
Every architecture team faces this decision. A head-to-head comparison of the three approaches to policy enforcement in agentic AI systems.
Read white paper →