AI Systems Security & Governance Consultant
Agent Authorization · Delegated Authority · Runtime Controls · Execution Evidence
I review consequential agentic and tool-enabled AI systems to determine whether the authority established upstream remains consistent with the authority that actually reaches runtime execution — and whether the resulting actions can be independently evidenced.
The work connects technical controls and system behavior to operational consequences, controllability, and bounded decisions about production reliance, client handover, scaling, increased autonomy, and privileged or write actions.
Authority → Runtime Controls → Execution → Evidence → Controllability
- delegated and derived authority, authority lifetime, approval binding, and authority non-transitivity
- effective runtime authority across orchestrators, credentials, tools, and downstream systems
- deterministic runtime controls, enforcement points, intervention, and recovery
- execution evidence, traceability, workflow reconstruction, and evidence integrity
- bounded risk and readiness judgment for a specific system, workflow, use, and evidence basis
I contribute to the OWASP GenAI Security Project's Agentic Security Initiative, mainly around Authorization & Scoped Delegation. My current work includes maturity-criteria integration and cross-subsection coordination. I also participate in specification review for the Agent Control Standard (ACS).
Independent external security and architecture reviewer for Surgical DevOps, with a bounded review focused on delegated and effective runtime authority, authority lifetime, provenance and recovery, containment, identity continuity, enforcement placement, and confused-deputy risk.
The project publicly records that questions raised during the review led to concrete hardening and additional qualification work.
The AI Systems Risk & Evidence Lab contains bounded public evidence for agent execution integrity, runtime authority and control, RAG, observability, and evidence quality.
CLAIM STRENGTH <= EVIDENCE STRENGTH
- Latest GitHub Release
- Professional Evidence
- Interactive Execution Evidence Demo
- Sample AI Agent Readiness Check
Lab outputs support professional review and decision-making. They do not constitute production-wide safety claims, certification, or legal conclusions.