Topic

Compliance

All digests tagged Compliance

Why Your Enterprise Tech Stack Isn’t Ready for AI Agents — Christopher Lovejoy & Saul Howard thumbnail

· 19:15

Why Your Enterprise Tech Stack Isn’t Ready for AI Agents — Christopher Lovejoy & Saul Howard

The talk addresses why traditional enterprise tech stacks are insufficient for deploying AI agents in highly regulated industries like healthcare. The core argument is that focusing on achieving high accuracy during a Proof of Concept (POC) often leads to architectural debt when attempting productionization. To build scalable, compliant systems, engineers must prioritize non-functional requirements—specifically auditability, data security, and human oversight—from the outset. This requires adopting specialized primitives: immutable event logs, schema-driven object storage for sensitive data, and treating humans and models as equivalent agents.

Key takeaways

  1. Audit Trail vs. Developer Log 0:05

    In regulated environments (e.g., HIPAA, SOC 2), an audit trail must be a complete record of every action taken by the agent, every place it accessed data, and the authorization behind each step—not merely a developer log like those found in DataDog [5:19].

  2. Prioritize Constraints Over Accuracy 0:12

    Engineers should take regulatory constraints seriously first (e.g., auditability) and design the architecture around them, rather than bolting compliance requirements onto a high-performing POC [12:07].

  3. The Three Architectural Primitives 0:08

    Effective AI agent systems require three core primitives: an immutable append-only event log (for state tracking), schema-driven object storage (for data separation and Zero Trust), and human/model agent equivalency (for seamless escalation) [8:30].

  4. Evals as a Byproduct 0:10

    By implementing these three primitives, robust evaluation (evals) can emerge naturally—allowing for action replay, testing on production data without exposure, and comparing human vs. model performance—rather than being an afterthought [10:37].

Watch on YouTube Full article

Building Governed Agents: A Framework for Cost, Control and Compliance thumbnail

· 52:28

Building Governed Agents: A Framework for Cost, Control and Compliance

As autonomous agents scale in production environments, they introduce significant governance challenges related to cost control, data security, and regulatory compliance. This presentation outlines the necessity of implementing centralized runtime controls—such as an LLM Gateway—across the entire Agent Development Lifecycle (ADLC). Centralized governance is critical for managing unpredictable spend, ensuring reliability through fallbacks and rate limits, and maintaining consistent policy enforcement across diverse agent interactions (LLM calls, tool use, and inter-agent communication).

Key takeaways

  1. The Three Pillars of Agent Governance 5:40

    Production agents introduce three main pressure points: Cost (unpredictable spend from looping/context growth), Reliability (need for fallbacks and clear failure behavior), and Compliance (consistent policy enforcement required by regulated industries).

  2. Centralized Runtime Controls are Essential 8:30

    Governance must be implemented as a central infrastructure layer, rather than being bolted on application-by-application. This centralized approach manages interactions with external services (LLMs, tools) and ensures visibility across the entire system.

  3. Comprehensive Risk Management is Required 12:30

    Governance controls must cover four distinct interaction points: LLM calls (cost/data risk), Tool calls (unintended actions/permissioning), MCP calls (data leaving infrastructure), and Agent-to-Agent calls (identity and compounding errors).

  4. Compliance Requires Multi-Layered Guardrails 23:20

    For regulated industries, governance must address specific regulations like GDPR, CCPA, HIPAA, and the EU AI Act. This involves implementing guardrails for PII/secrets detection, role definition, and audit logging.

Watch on YouTube Full article