Resources
Blog
Field notes on governing AI agents at runtime: MCP policy, spend controls, approvals, audit trails, and real incidents.
Featured
3 postsContext Is Not a Safety Boundary: Where Agent Guardrails Actually Have to Live
We verified every incident we could find where AI agents or the tools they call caused real harm. The constraints that failed all lived inside the model's context - and a context window is a buffer, not a boundary.
Oli Guei Malicious npm Packages With Valid SLSA Provenance: Inside the TanStack Attack
On 11 May 2026, malicious @tanstack npm packages shipped with valid SLSA provenance (CVE-2026-45321). Why every signature check passed - and what it means for supply-chain trust.
Oli Guei MCP Agent Governance: The Missing Layer Between Your Agent and Disaster
Your MCP agent can call any tool it can reach, and nothing deterministic checks what it does. The AI agent governance layer most teams skip - and how to fill it.
Oli Guei All posts
Context Is Not a Safety Boundary: Where Agent Guardrails Actually Have to Live
We verified every incident we could find where AI agents or the tools they call caused real harm. The constraints that failed all lived inside the model's context - and a context window is a buffer, not a boundary.
Malicious npm Packages With Valid SLSA Provenance: Inside the TanStack Attack
On 11 May 2026, malicious @tanstack npm packages shipped with valid SLSA provenance (CVE-2026-45321). Why every signature check passed - and what it means for supply-chain trust.
MCP Agent Governance: The Missing Layer Between Your Agent and Disaster
Your MCP agent can call any tool it can reach, and nothing deterministic checks what it does. The AI agent governance layer most teams skip - and how to fill it.
No posts match that filter.
Put the gate in. Then let them run.
Install the open-source proxy, watch real traffic, then add the rules your agents need.