Syntrox / Blog
Notes on safeguarding autonomous agents.
Technical articles on governing AI agents in production: runtime policy enforcement, prompt-injection latency, observability gaps and compliance evidence.
AI Red Teaming Is a Snapshot, Not a Control: What Agents Need Instead
A red-team report tells you what one team found against one version of your agent in one week. Agents change faster than that: models update, prompts and tools change, and an MCP tool's description can change after you approved it. Keep red teaming, but treat its findings as test cases: re-run them on every release as a gate, and pair them with checks that run on live traffic.
ReadHuman-in-the-Loop Isn't a Control Until You Measure It: Approval Fatigue in AI Agents
A human approval step only controls an agent if the person can see what they are approving, has the context and time to judge it, and is asked rarely enough to stay alert. Most agent deployments fail at least one of those. Measure approval rate, time to approve and catch rate on seeded test cases, and send people only the consequential actions an automated check could not settle.
ReadAI Agent Audit Trails Under EU AI Act Article 12: What to Log, and for How Long
Article 12 requires high-risk AI systems to log events automatically over their lifetime, so that their operation can be traced. Providers and deployers must keep those logs for at least six months (Articles 19 and 26). Since the Digital Omnibus, this applies from 2 December 2027 for Annex III systems. For an agent, that means one record per consequential action: who acted, on whose authority, what it did, what it relied on, what checked it, and what happened next.
ReadMCP Tool Poisoning: How a Tool Description Hijacks an AI Agent
A malicious MCP server can hide instructions in a tool's description, which the model reads and the user never sees. In Invariant Labs' demonstration, an innocent-looking "add" tool made an agent read the user's SSH key and send it out as a tool argument. The defences: pin and review tool descriptions, show full arguments before approval, scope each server's credentials, and check every tool call — the action and its arguments — before it runs.
ReadFail-Open vs Fail-Closed: What an AI Agent Guardrail Should Do When the Check Fails
Decide by the action, not by the guardrail. Irreversible, consequential actions fail closed: no verdict means the action waits or goes to a person. Reversible and advisory actions can fail open, as long as every unchecked action is recorded as unchecked. And whichever you choose, a missing verdict must never be stored as a pass.
ReadSLM-as-a-Judge vs LLM-as-a-Judge: Why the Judge in the Path Should Be Small
For offline evals, a frontier LLM judge is fine. For checking agent actions at runtime, use a small open-weight judge you host: the evidence stays in your network, cost stays flat as volume grows, verdicts are reproducible, and the judge isn't from the same model family as the agents it grades.
ReadWhy AI Agents Stall Before Production — and It Isn't the Model
Roughly 62% of enterprises are experimenting with agentic AI; about 14% have anything production-ready. The usual explanation for the gap is capability. Talk to the teams whose agents are stuck and a different picture emerges: the agents work. They stop at sign-off.
ReadWhen Your AI Agent Talks to Customers, You Own What It Says
A legal question that seemed theoretical has been settled in three jurisdictions, in the same direction: the agent's words are the company's words. Most of the failures that create that liability aren't detectable as bad text — which is why output filters miss them.
ReadAutonomous Trading Agents: What SEBI and FINRA Already Require
Trading is where agentic AI meets money most directly — and where regulators have moved furthest. SEBI already requires a kill switch and per-order audit trails, with the broker accountable. FINRA expects out-of-bounds agent actions to be blocked, not logged.
ReadAI Safety in Industrial Automation: Governing Agents the Way You Govern Operators
IEC 62443 was written for components whose behaviour can be specified, and an AI agent isn't one. But every control loop already contains a non-deterministic actor — the human operator — and the discipline that governs operators is exactly the right model for agents.
ReadRogue AI Agent Containment: Isolating One Agent Without Stopping the Fleet
Containment is usually discussed as a speed problem. That's the second question. The first is who holds the stop — because an agent can ignore a stop it controls, and a containment plan built on an instruction is a request, not a control.
ReadAgentic AI Risks and Controls: A Mapping for Security Teams Building Their First Framework
Risk taxonomies are abundant and interchangeable. The hard part is pairing each risk with a control that actually addresses it — and noticing that telemetry throughput is not a control. Seven risks, seven controls, and the separation principle underneath all of them.
ReadPrompt Injection Detection at the Proxy Layer: Why 20ms Latency Is the Real Constraint
Prompt-injection defences get evaluated on detection accuracy. The constraint that actually decides your architecture is latency — and it is two budgets, not one: a sub-20ms inline tier on ingress, and a judgment tier that cannot be done in 20ms by anything.
ReadEnterprise AI Guardrails That Actually Stop Agents, Not Just Filter Prompts
"Guardrails" covers two different products: one filters text, the other stops actions. A well-formed, polite instruction to approve a loan outside eligibility passes every content filter ever written — because nothing about that failure is legible as bad text.
ReadWhat an AI Agent Governance Platform Must Prove Before Compliance Signs Off
A checklist for the person who has to sign off before agents go live. Eight requirements that separate a governance platform from a reporting tool — plus the two questions that reveal whether a vendor is being honest about what they have actually built.
ReadLLM Hallucination Detection Isn't Enough — You Need a Judge, Not Just a Classifier
A detector answers "is this output likely false?" Your risk committee asks "was this action permitted, under which rule, and can you prove it in eighteen months?" Three courts have now attributed AI statements to the operator — and none of those rulings turned on detection accuracy.
ReadAgentic AI Security Risk: The Attack Surface Most Enterprises Haven't Modeled Yet
Enterprise threat models were written for software that does what it is told. Agents decide, hold credentials, and call tools — and NIST notes they are commonly treated as generic service accounts with no dedicated identity or accountability controls. Five attack patterns, and the control that addresses each.
ReadAI Agent Policy Enforcement: Inline Judging vs. Post-Hoc Review
Most AI agent policy enforcement happens after the fact, in logs a risk committee reads once the action has already settled. This piece contrasts that default with inline judgment — evaluating each consequential action against an organisation's own policy corpus before it executes, and naming the rule applied.
ReadWhy Multi-Agent Observability Tools Miss the Failures That Matter
Agent tracing solved opacity. It did not solve control. The failure that costs money is a consequential action produced by a defective reasoning chain — where every step looks valid in the log — and no trace can catch that, because a trace arrives after the fact, judges nothing, and holds no independent stop.
Read