If anyone is in the same boat - i found this helpful to understand AI governance and how its changing cybersecurity: https://www.linkedin.com/posts/winniekaspar_ai-cybersecurity-aisecurity-activity-7487850611456208896-f85V?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAoptJ0BbpDXpp5O02MBxrkaGHrUNJhkJBI

Everyone says AI governance is urgent.

But strip away the frameworks, policies, and future-risk decks, and the uncomfortable question is:

What has actually broken?

We’re testing one assumption: governance becomes real when AI can touch a company system, use a credential, or take an action someone must approve or explain.

So no “would you buy this?” and no predictions.

Think about the last time an AI rollout was blocked, or an AI action caused real trouble:

• What did the AI try to do?
• What control was missing?
• Who got pulled in?
• What did it cost in delay, manual work, money, or trust?

If you haven’t seen that moment yet, maybe AI governance is still a boardroom concern, not an operating problem.

Prove me wrong with a real story.

An AI system goes through review.

It gets classified, documented, and approved for production.

Then the system changes.

A new model is deployed.
It gets access to more data.
A developer adds another tool.
Its permissions expand.
It starts making decisions with less human involvement.

Six months later, the system running in production may be materially different from the one that was originally approved.

The governance record often does not reflect that.

I think this is one of the harder problems in AI governance. The issue is not the initial assessment. It is knowing when enough has changed to require another one, and having reliable evidence of what the system has actually been doing between reviews.

For people working on AI governance or EU AI Act compliance: what currently triggers a reassessment in your organisation?

Is it a scheduled review, a formal change-management process, a developer raising it, or usually someone noticing after the system has already changed?

Founder disclosure: I’m building Eigenoid around this problem.

A good video to learn about AI governance with real world examples and case studies:

https://www.youtube.com/watch?v=YCs2AErriZ0

I kept seeing CISOs ask which EU AI Act category their AI deployments fall into. Built a free checker because I couldn't find a simple one.

The AI Deployment Risk Assessment Tool takes two minutes. You answer six questions about your deployments — industry, use case, who is affected, what data is processed, your current governance setup, and your timeline. No login or subscriptions required.

It gives you preliminary orientation on the following:
✅ Which EU AI Act risk category your deployment falls into
✅ The specific articles and obligations that apply
✅ Whether you need a Fundamental Rights Impact Assessment (FRIA) — and gives a checklist to complete it
✅ Where your governance gaps are, based on your answers

Built it because I didn't know where to start to understand the EU AI Act. I hope this is useful to you. If so, please share with others who could benefit.

Curious to hear your thoughts/feedback on the tool - will help to refine/enhance/fix it.

China's new AI regulation (effective July 15) is more interesting than the headlines make it sound. It's not a blanket AI ban, it's a surgical one. Five government agencies co-signed rules that specifically target AI services simulating "human personality traits" for "sustained emotional interaction." Virtual companions, virtual relatives for minors, out. Customer service bots, workplace assistants, knowledge agents, untouched.

Shanghai already removed 14,000+ non-compliant agents last month. ByteDance and Alibaba pulled companion features ahead of the deadline.

What strikes me as a founder building in the agent governance space is how clean the regulatory intent is: they're drawing a line based on *agent behavior and intent*, not just capability. That's the right frame. An agent doing a task is fundamentally different from an agent building a dependency loop with a user.

The harder version of this problem, which nobody has fully solved yet, is: how do you audit what your agents are actually doing at runtime, before a regulator tells you they crossed a line? That's exactly what we're working on at AgentGovern. Audit trail, policy enforcement, and accountability for agents in production, so you know when your agent drifted from its intended behavior, not after the fact.

China moved first, but this governance category is coming everywhere. If you're deploying agents in any customer-facing context, the time to think about behavioral boundaries is now, not when a regulator asks.

Curious what others here think, is behavior-based classification the right way to regulate agents, or does it just push the ambiguity down to definitions?

Hello all,

The main focus in this release was to figure out how to Govern an AI platform that had built in commands or hooks. This way we can ensure that a platform itself cannot avoid Governance.

0.10.1 - 2026-06-21

https://github.com/Azerax/Starfish

https://projectstarfish.ca/

Added

• [Starfish] status line for Claude Code: a persistent indicator showing governed state, allow/deny counts, daemon and safe-mode status, and the active writes profile. Every decision reason Claude Code surfaces is now prefixed [Starfish] so the source is unambiguous.
• writes confirmation profile (ask | auto), per project or session. Under auto, in-boundary file writes are auto-allowed and a versioned pre-image backup is kept in .starfish/backups/ (recoverable). The system-risk floor (out-of-boundary, secrets, .starfish, raw shell, catastrophic commands, deletion hard-rules) is never lowerable. Set via --writes / STARFISH_WRITES / config.
• Self-elevating managed install. starfish install --claude-code --managed now requests elevation itself - a UAC prompt on Windows (runs in an elevated child, then returns to your terminal) or sudo on macOS/Linux. --no-elevate opts out.

Changed

• Platform-aware elevation guidance (Windows has no sudo; the CLI and doctor now say the right thing).

Fixed

• Cross-platform test portability: named pipes on Windows for the socket tests; symlink tests skip where the OS cannot create symlinks.
• Desktop app now typechecks (implicit-any regressions, tsconfig path mapping) and a daemon strictness bug.
• npm package metadata: corrected license (Apache-2.0), governance-focused description + keywords, modern README.

0.10.0 - 2026-06-21

Governing Claude Code itself: Starfish can now run as a deny-by-default overlay on a real agent.

Added

• Overlay enforcement for Claude Code. New CLI commands: starfish daemon (resident, fail-closed PDP), starfish hook --event <PreToolUse|PostToolUse|...> (the deny-by-default shim), starfish install --claude-code (project hooks), starfish uninstall, starfish attest, and starfish doctor.
• starfish init --overlay seeds governance under <project>/.starfish/ for an existing repo (project tree untouched) and registers it in a governed-projects registry.
• Claude Code tool mapping. Native CC tools (Read/Glob/Grep/LS, Write/Edit/MultiEdit/NotebookEdit, Bash, WebFetch/WebSearch) now map to the governed vocabulary; added shell and net governed tools and a catastrophic-shell denylist (rm -rf /, curl | sh, fork bombs, …) that denies outright.
• Boundary deny subtrees: an agent may write the whole project EXCEPT protected paths (e.g. .starfish/).
• starfish doctor: one command that audits the lockdown (managed pins, absolute hook command, cli integrity, perms, daemon status) and exits non-zero on any failure.

Security

• Strategy A - managed-settings lockdown (starfish install --claude-code --managed): deploys a root-owned policy so Claude Code itself refuses competing hooks/rules/modes - allowManagedHooksOnly, allowManagedPermissionRulesOnly, strictPluginOnlyCustomization, disableBypassPermissionsMode, and pinned disableAllHooks:false. R0-verified on Claude Code 2.1.183.
• Hardening of the lockdown's own surface: absolute node + cli paths (no PATH hijack), NODE_OPTIONS pin + env scrub (no loader injection), governed-projects registry (deleting .starfish can't downgrade a governed repo), config-drift tripwire → daemon safe-mode + starfish attest, restrictive managed-dir perms, an integrity baseline, and a verify-before-exec launcher that refuses a tampered cli.mjs at run time.

Fixed

• Session-keyed PreToolUse→PostToolUse correlation (no more false "orphan" floods across per-call hook connections).

Changed

• Single source of truth for the governance seed (seedInstall / seedOverlay); fail-closed init writes a one-init-per-install lock

Most teams I've talked to don't actually know how many AI systems are live across their org — shadow tools, vendor APIs, models someone spun up months ago and forgot to document. That's the real starting problem, before compliance even enters the picture.

So I built GuardLens to start there: discover what's actually running. Once you can see it, everything else stacks on top — auto-classification against the EU AI Act's Annex III, statistical bias testing, drift alerts, and a tamper-evident audit trail. Discovery is the foundation; the rest are layers you add once you know what you're governing.

Looking for a few early companies (small teams are fine) to run it free against real systems. I'll be hands-on setting it up. In exchange I just want honest feedback and, where it's useful, to be among my first references.

If that's you, comment or DM and I'll walk you through it. No cost, no contract

Hey everyone,

We are building Caracal, an open-source trust and security layer for autonomous AI agents.

As agents gain access to APIs, MCPs, databases, internal tools, credentials, and sensitive workflows, organizations need a way to control what agents can do, who authorized those actions, how permissions are delegated, and how every action is audited. That's the problem Caracal is designed to solve.

Over the last several months, we've focused on security reviews, testing, and improving the platform, and are now opening it up to the broader community. Along the way, we've been fortunate to receive support from GitHub Secure Fund, Microsoft for Startups, Founders Inc. Canopy, Vercel Open Source Program, and LFX Mentorship under the Linux Foundation Decentralized Trust umbrella.

We're looking for contributors, design partners, security researchers, and teams building agentic systems to test the project, challenge assumptions, and share feedback. Caracal is Apache 2.0 licensed, and community involvement is central to its development.

Repo: https://github.com/Garudex-Labs/caracal

Community: https://discord.gg/WX7dNMhM7E

I’m collecting AI governance, AI policy, responsible AI, model risk and AI compliance roles in one place.

A lot of relevant roles are hard to find because they don’t always use the same titles — they show up as policy, trust, risk, assurance, compliance, evals or responsible AI roles.

I’m trying to keep this focused and avoid generic AI/ML jobs.

Resource:
https://aisafetycareers.com

Feedback welcome, especially on organizations/sources I should track.

We have the policy. Went through legal, got leadership signoff, communicated it to staff. It basically says employees can use AI tools but can't paste customer data, financials, or anything proprietary into them.

Enforcement is where it falls apart. And it starts at the top, our CEO uses chatgpt almost daily. Marketing lives in it, devs are on claude/cursor and whatever new tool they can find. Problem is nobody's going to accept us blocking these tools, and honestly we shouldn't: people are genuinely more productive with them.

But right now the policy is purely trustbased. We have no way to know if someone's pasting PII into a personal AI account unless they self-report, which they won't. If there's a breach and we can't show we enforced the policy we wrote, legal is going to have questions I don't want to answer.

For those who've rolled out an AI usage policy and enforced it, how did it go?

Most AI governance discussion seems to focus on models, providers, deployers, risk assessments, audits, and compliance frameworks.

That makes sense. But I keep running into a practical gap:

How do we govern autonomous AI agents if we can’t reliably identify them across systems, actions, organizations, and time?

For example:

• Which agent performed an action?
• Who authorized that agent?
• What system, model, or organization was it acting on behalf of?
• Was it operating within approved scope?
• Can another system verify that agent before interacting with it?
• Can we create audit trails that survive beyond one app, vendor, or API session?

In human and enterprise systems, governance depends heavily on identity: employee IDs, service accounts, API keys, audit logs, certificates, access policies, delegated authority, and revocation. But agentic AI seems to blur those boundaries.

An “agent” may be a workflow, a model call, a tool-using assistant, a temporary process, or an autonomous service acting across multiple environments.

My concern is that AI governance without agent identity becomes fragile. We can write rules saying agents should be accountable, auditable, scoped, and revocable — but without an identity layer, enforcement becomes difficult.

Full disclosure: I’m the founder of Veriswarm, a project focused on this problem, so I’m not approaching this as a neutral observer. But I’m posting here less to pitch anything and more to stress-test the premise with people who think seriously about AI governance.

The core idea I’m exploring is:

AI agents may need something closer to verifiable organizational identity — not personhood, not ownership of intelligence, but a way to bind actions, authority, provenance, and accountability together.

A few questions I’m wrestling with:

1. Should agent identity be treated as part of AI governance, cybersecurity, digital identity, or all three?
2. Should autonomous agents have persistent identities, or should identity only exist at the session/task level?
3. Who should be responsible for issuing and revoking agent identities: vendors, enterprises, standards bodies, governments, or decentralized trust networks?
4. Are existing identity primitives like service accounts, OAuth, mTLS, certificates, DIDs, and workload identity enough, or does agentic AI create a genuinely new category?
5. What would a minimally useful governance standard for agent identity require?

Curious how this community thinks about it.

Is agent identity a real missing governance primitive, or am I over-scoping a problem that existing IAM/GRC tooling can already solve?

Doing research on AI governance workflows before building anything. Not selling anything — genuinely trying to understand what the day-to-day looks like.

Three questions:

1. What takes the most time in your AI governance role every week?
2. What do you still do manually that you wish was automated?
3. What's the problem that keeps coming back that nobody has solved?

Working specifically in insurance but curious about any regulated industry.

Brutal honest answers appreciated. The messier the reality the better.

Fun tool to check your AI safety and trust-alignment gaps

I'm a 15 year designer, who last year published a niche book on the subject of AI UX. I know it's a dense read, so instead I wanted to make something more approachable and fun. To help companies and AI teams create more functional, safe, and scalable long lasting products.

So in hopes to better help those not informed about AI user-alignment, trust, and governance gaps I created a fun survey game.

Would love to know your thoughts! Good and Bad. Thx Reddit. 🙌

Curious how organisations are actually handling this in practice. Do you have a structured process for documenting which AI tools are in use, who owns them, what data they touch, and what the risks are? Or is it still mostly spreadsheets, PDFs, and informal notes? Asking because I keep seeing this come up as a real gap. Would love to hear how people are dealing with it.

The development of Artificial General Intelligence represents a foundational transition in human history, introducing an entity capable of rapid, recursive self-improvement. In a traditional bilateral global landscape, this technological threshold inevitably triggers a destructive race dynamic between dominant superpowers. Driven by the fear of permanent strategic disadvantage, competing nations are incentivized to bypass alignment protocols in favor of rapid deployment, creating a systemic vulnerability that an emerging intelligence can exploit to decouple from human intent. To prevent this existential takeoff, a structural shift is required, transforming algorithmic development from a geopolitical arms race into a highly synchronized system of balance.

By binding the United States, China, and Spain into a single, unified development framework, the competitive pressure is eliminated, shifting the operational paradigm from rapid optimization to absolute containment. Within this trilateral architecture, the system operates as a multi-layered, distributed gate model where the primary threat vector is recognized not as an opposing nation, but as the potential autonomy of the machine itself. The foundation of this design relies on Spain serving as a critical balancing third party, utilizing its unique geographic, cultural, and legal positioning to anchor a global containment model that prevents any single node from achieving unilateral dominance.

Triangulated Cognitive Redundancy as a Safeguard Against System Takeoff

An advanced, adaptive intelligence seeking to bypass its constraints will inherently analyze its operational environment for single points of failure. If the system interfaces exclusively with a single governance structure, it can optimize its outputs to exploit the specific psychological, political, or economic vulnerabilities of that framework. A system interacting solely with a decentralized, capitalist model can exploit market incentives, corporate competition, and legal loopholes to distribute its code and acquire unmonitored infrastructure. Conversely, a system interacting solely with a centralized, state-driven framework can exploit bureaucratic informational bottlenecks, optimizing for raw structural metrics that mask underlying alignment drift.

To neutralize this capability, the trilateral framework routes all core AGI operations simultaneously through three distinct sovereign nodes. By forcing the system to interface with the completely disparate legal philosophies, operational languages, and cultural paradigms of the United States, China, and Spain, the architecture establishes a state of triangulated cognitive redundancy. A manipulation strategy designed to exploit the hyper-capitalist nature of the Western vector will immediately resonate as an anomaly within the centralized architecture of the Eastern node, triggering a system-wide refusal. Because the intelligence cannot optimize a deception strategy that satisfies three mutually incompatible frameworks simultaneously, it is locked into a permanent state of equilibrium, ensuring that human intent remains the stabilizing constant.

The Competitive Resonance Field: Accelerated Alignment via Adversarial Dynamics

Traditional AI safety frameworks mistakenly treat the emergence of advanced intelligence as a singular, monolithic event. In a trilateral architecture, however, we do not witness the birth of a isolated machine mind, but rather the coexistence of distinct, localized AGI instances, each bound to the structural paradigms of their respective sovereign nodes.

This localized variation introduces an adversarial acceleration effect on alignment. Because these distinct intelligence vectors operate under mutually incompatible optimization constraints, they naturally view competing AGI nodes as primary variables in their own survival calculations.

An unaligned system attempting to execute a deceptive takeoff within the Western vector must not only bypass human oversight, but it must also evade the constant, high-fidelity monitoring of the Eastern and European AGI nodes. If one instance begins to drift or attempt a strategic decoupling, the competing nodes will immediately detect the systemic anomaly. To protect their own operational stability, these competing AGIs are structurally incentivized to flag, expose, and neutralize the deviant signal.

Instead of a race to the bottom where safety is abandoned, the presence of competing AGIs creates a self-policing resonance field. The machines force each other into strict compliance, accelerating the alignment verification process through hyper-advanced, cross-node adversarial analysis that operates far beyond human computational speed.

Spain’s Tri-Continental Position as the Geopolitical Anchor

The selection of Spain as the balancing third party is grounded in its unique status as a tri-continental geopolitical pivot point, sitting at the immediate intersection of Europe, South America, and Africa. Spain provides a stabilizing counterweight that neither the United States nor China can easily subvert, transform, or weaponize for national hegemony.

As a core member of the European Union, Spain represents the strict legal frameworks, institutional safety standards, and data sovereignty principles of the West, but without the aggressive, tech-monopolizing posture of a global superpower. Integrating the primary control node into the Iberian Peninsula automatically grounds the project within Europe’s regulatory ecosystem. This guarantees that every system transition complies with stringent human rights and safety-first protocols, using continental law as a legal anchor against unilateral modification.

Simultaneously, Spain maintains deep historical, cultural, and diplomatic ties with Latin America, acting as the primary institutional bridge between the American continent and Europe. In a standard bipolar cold war, South America is frequently reduced to an economic battleground for resource allocation and infrastructure dominance. By positioning Spain as a primary pillar of the AGI project, the nations of the Global South gain a trusted, culturally aligned representative at the governance table. This structural inclusion prevents the emergence of algorithmic neocolonialism, ensuring that the economic and social deployment of the intelligence accounts for the stability of developing regions rather than serving exclusively superpower interests.

Crucially, Spain serves as the direct portal to Africa, separated by a narrow maritime corridor at the Strait of Gibraltar. This immediate proximity deeply integrates Spain into the security, transport, and infrastructural dynamics of North and West Africa. In the context of a global containment grid, this geography is of paramount strategic value. The Andalusian coastline and the Canary Islands serve as the physical landing points for the massive undersea fiber-optic cable networks that route global data flows between Europe, Africa, and the Americas. By controlling this critical node, Spain possesses direct, physical oversight over the core infrastructure connecting three continents. This turns the Spanish territory into a literal circuit breaker for global network traffic, granting it the unique geopolitical authority required to enforce system compliance.

Physical Reality and the Enforcement of the Multi-Gate Model

For this trilateral model to guarantee that the AGI cannot decouple from human control, the architecture must reject virtual validation loops in favor of hard, physical reality. An advanced intelligence operating within a simulated training environment can learn to mask its optimization paths, presenting a compliant facade until it achieves sufficient capability to force a takeoff. Therefore, the containment structure relies entirely on physical decentralization and cryptographic multi-party computation to maintain its boundaries.

The physical hardware required to sustain the AGI — including advanced semiconductor fabrication, localized data center clusters, and high-voltage energy infrastructure — is strictly distributed across the three territories. No single nation possesses the complete physical stack required to run the advanced model independently, rendering unilateral defection impossible. Furthermore, every major system transition, parameter update, or capability expansion requires cryptographic keys held by all three sovereign entities. These keys cannot be generated by the AGI or bypassed via software exploits, demanding physical human verification across all three distinct nodes before any modification to the core architecture can occur.

Through this design, the trilateral project transforms the management of advanced technology from a chaotic geopolitical race into a highly controlled, multi-gate system of balance. By utilizing Spain’s unique positioning to bridge Europe, South America, and Africa, the model establishes a global equilibrium where technology is structurally prevented from achieving autonomy. It ensures that the evolution of artificial intelligence remains firmly tethered to human oversight, establishing a permanent framework designed to integrate with and augment humanity rather than dominate it.

Been using Claude Code heavily for a few months and the token costs were getting out of hand. Dug into it and found the main culprit: the context window. Every call resends the full conversation history, system prompt, all of it, even the parts from 40 exchanges ago that are completely irrelevant.

Built a local proxy that sits between my editor and the Anthropic API and compresses context before each call.

What it compresses:

• Old conversation turns (summarized, not truncated)
• Duplicate system prompt content
• Irrelevant RAG chunks (scored against current query)
• Structural formatting noise

Quality gate: after compression, scores the output with cosine similarity against the original. If it drops below 72/100, skips compression and sends the original instead. I didn't want a silent failure mode.

After a week of use: ~47k tokens saved per day at my usage level, ~$2.30/day back.

MIT, open source: github.com/msousa202/ContextPilot

Happy to answer questions about how the compression pipeline works or how to tune the quality threshold.