Blog
Regulation, architecture, and the parts nobody demos.
Writing about what it actually takes to run an agent in a regulated environment: the
rules that are landing, the design decisions they force, and the controls that turn out to
matter once real customers are on the other end. No predictions about the future of work.
India's framework is enablement-first, which is a harder brief than a prohibition
would have been: a prohibition needs a policy document, enablement needs working
software. Seven sutras, and six of them resolve to the same underlying capability.
What each principle costs in build time, why oversight only counts when the agent
stops, and what the lifecycle language means if you bought rather than built.
OWASP's 2026 list for agentic applications leads with goal hijack, rogue agents and
unsafe tool execution. The mechanics have not changed: your instructions and the
attacker's text arrive in the same token stream, and the boundary is a convention rather
than a property of the system.
Assume the model gets convinced, then ask what the worst reachable action is. Typed
tools, limits the model cannot participate in, and a record that scopes the incident in
an afternoon.
2026-08-13 · Architecture
Tool poisoning works because a tool description is text the model reads and treats as
guidance. No breach required, and the resulting action runs with the agent's own
credentials through an approved path.
Why connecting a server is a permissions decision rather than a dependency bump, the
identity question underneath it, and the wrapper pattern that keeps the dynamic surface
out of production.
AI disclosure, the mini-Miranda, local calling hours, cross-channel frequency caps
and validation notices all land in the first fifteen seconds, which is exactly where an
improvising model is least predictable.
Three rulebooks on one call, why nothing in the opening should be generated, and the
stop conditions that tell you what was actually built.
LangGraph, CrewAI, the OpenAI Agents SDK, Pydantic AI and Parlant are all real
options, and the comparison articles all measure the same things: orchestration
expressiveness, state handling, and developer ergonomics. None of those decide a
regulated deployment.
A framework-selection checklist built around the four questions a second line of
defence will actually ask, and an honest account of where a generic framework plus glue
code is the right answer.
The Digital Omnibus deferred the Annex III high-risk compliance date, which several
teams have read as permission to stop. That is the wrong lesson: the obligations did not
change, the transparency duties that applied from August 2025 are untouched, and the
evidence takes longer to build than the extension buys.
What the four core obligations mean concretely for an agent deployment, and which
artefacts satisfy each one.
2026-07-28 · Architecture
The first critical ICT third-party providers were designated in late 2025 and came
under direct EU oversight in 2026. Almost every hosted agent product runs on one of
them, which makes your model dependency a register entry, a diligence exercise, and an
exit-strategy problem.
Why self-hosting stopped being a preference and became an architecture decision, and
what a credible exit strategy for an agent platform looks like.
Every team starts by writing the rules into the system prompt. It works in the demo,
degrades under adversarial input, and cannot be reviewed, versioned, or evidenced. The
fix is not a better prompt.
The four properties a rule needs before you can call it a control, why hard blocks
must be non-configurable, and what changes when guardrails run as steps on a bus.
Most teams have logs. Logs are not an audit trail. The distinction becomes expensive
the first time somebody has to prove that a record was not edited, or say which version
of a policy was live during a conversation eighteen months ago.
The seven things a record needs, why hash chaining is the cheap part, and how the
same artefacts map onto EU AI Act articles and SR 11-7 expectations.
Zolva