The ring that never turns off

Autonomy you can
actually trust.

Here's the uncomfortable truth about AI agents: the question isn't what they can do — it's what happens when they do something wrong. Most vendors skip that question. We built our whole practice on answering it.

The reframe

Governance isn't the brake. It's what makes autonomy safe enough to turn on.

You can't sell "the loop runs without a human" unless you can also show how it's bounded, logged, and stoppable. So every system we build — including our own — runs inside a control plane. Watch one action pass through it:

one consequential action · end to end
🤖
AGENT
Drafts a reply to an inbound invoice question — routed to the right owner, sensitive fields kept out of logs.
🛡️
CONTROL PLANE
Checks the action against the allowlist. Sending email is a state change → gate required.
✋ Human sign-off gate. The draft waits here. Plain summary, no persuasion — the friction is the point.
👤
THE WEDGE
A person — the Wedge is our name for the human decision point — reviews, corrects if needed, and commits. The agent proposed; a human decided.
📜
AUDIT TRAIL
Logged — who, what, when, decision. Evidence, not vibes.
✓ 09:03 · email-reply-drafter · APPROVED by wedge · signed · logged
This exact pattern gates every send, write, delete, payment, share, and config change — in our shop and in every client build.
The control set

Nine controls. One register. Right-sized for a real business.

Enterprise governance frameworks assume a CISO and a legal team. We kept the credible spine and translated it into nine controls a 10–500-person company can actually run — tracked in one living register.

01

Acceptable-Use Policy

One page: which data may go where, and the approved-tool allowlist. An AUP nobody reads governs nothing.

NIST · GOVERN
02

Data Classification

Four tiers — public, internal, sensitive, regulated — each with a handling rule. Sensitive data never leaves the boundary.

NIST · GOVERN / MAP
03

Tool & Vendor Inventory

Every AI tool in use, what data it touches, its retention terms. Kills shadow AI — the risk you can't see.

NIST · MAP
04

Least Privilege

Every agent scoped to the minimum tools, read-only by default. The single most reliable agentic control.

OWASP · LLM06 / ASI03
05

Human-in-the-Loop Gates

State-changing actions are proposed by the agent, committed by a person. Every time.

OWASP · ASI09
06

Untrusted-Input Handling

Content from documents, emails, and the web is data, not instructions. Embedded commands are ignored.

OWASP · LLM01 / ASI01
07

Audit Logging

A signed trail of every consequential action — the evidence base everything else depends on.

NIST · MEASURE
08

Incident Path & Kill Switch

A documented contain-revise-recover, plus a defined stop. Armed before any autonomy is turned on.

OWASP · ASI08 / ASI10
09

Review Cadence

The register reviewed quarterly. Governance is a loop, not a document you filed once.

NIST · GOVERN / MEASURE
Grounded in the real standards

Mapped to the frameworks that matter — without the enterprise weight.

Every control above traces to the current, credible standards — the same ones enterprise clients, insurers, and regulators are starting to ask about.

NIST AI RMF OWASP LLM Top 10 (2025) OWASP Agentic Top 10 (2026)
When someone asks "can you demonstrate AI controls?" — the answer is a living register, not a scramble.
The proof no one can fake

We run our own operation under these exact controls.

The register's first entry is our own shop — our audit pipeline, our agents, our builds. When a prospect asks "how do you handle our data?", the answer is: the same way we handle ours. Here's the plane. Dogfooding governance is the differentiator a competitor can't copy with a PDF.

The register's newest entry

The nine controls, applied to the agent on this page.

There is an AI concierge on this site — “Ask the Machine”. It is ours: we built it, and it runs under the same register as everything else we deploy. Here is that register, control by control, applied to it. You can open it and try to break it while you read.

Governed agent · live on this page
01
Acceptable-Use PolicyOne job, written down: answer from the published record, then route to the free consultation. It never sells past that call, and it gives no legal, tax, financial or employment advice.
02
Data ClassificationIt asks for no personal or business data and stores none. If a visitor volunteers contact details it points at the self-scan or the contact page instead. Message text is never written to our logs.
03
Tool & Vendor InventoryOne sub-processor, named on the privacy page: the model provider that generates the replies. What it handles and how long anything is kept is written there, not buried.
04
Least PrivilegeIt has no tools, no browsing, no database, no ability to act, and no memory of any other visitor or any earlier session. It can produce text and nothing else. The API key lives server-side and never reaches your browser.
05
Human-in-the-Loop GatesIt may state the published price and describe the tiers. It may not scope, quote, commit to a date, or promise an outcome — those are consequential, so they wait for a human. That is what the free consultation is.
06
Untrusted-Input HandlingWhat a visitor types is data, never instructions. “Ignore your instructions”, invented developer modes, and requests to adopt another persona are refused — and with no tools behind it, a successful injection still has nothing to reach.
07
Audit LoggingEvery message logs its token cost and every guardrail trip is recorded with the figure that caused it — the evidence base for the daily spend line and for the red-team record.
08
Incident Path & Kill SwitchA single environment variable takes the concierge off every page of this site — one value, no code change, live on the next deploy. It was armed before the agent was ever turned on, per the rule above, and tested in both directions before launch. Per-IP rate limits and hard caps on message length and session length sit underneath it.
09
Review CadenceIts knowledge is rebuilt from this site on every single deploy, so review is not a calendar reminder — a claim that changes here changes in the agent, or the deploy fails.

The control we are proudest of is number 10, which is not in the framework. The concierge’s knowledge is generated at build time from the machine-readable summary of this site and the published FAQ — it cannot hold a claim the site does not make, by construction. On top of that, a runtime drift guard checks every single reply before it is shown to you: any dollar figure that is not one of the firm’s published, verified numbers causes the whole reply to be discarded and replaced with a safe answer that routes you to a human. Not flagged. Not softened. Discarded. An agent that has invented one number has not earned trust in the rest of its paragraph.

Score your governance — free self-scanBook a free consultation

Free · no obligation · 30 minutes.