[{"data":1,"prerenderedAt":3106},["ShallowReactive",2],{"navigation":3,"/blog/ai-compliance-becomes-runtime-architecture-gpai-transparency-auditability":522,"/blog/ai-compliance-becomes-runtime-architecture-gpai-transparency-auditability-surround":3102},[4],{"title":5,"path":6,"stem":7,"children":8,"page":521},"Blog","/blog","blog",[9,13,17,21,25,29,33,37,41,45,49,53,57,61,65,69,73,77,81,85,89,93,97,101,105,109,113,117,121,125,129,133,137,141,145,149,153,157,161,165,169,173,177,181,185,189,193,197,201,205,209,213,217,221,225,229,233,237,241,245,249,253,257,261,265,269,273,277,281,285,289,293,297,301,305,309,313,317,321,325,329,333,337,341,345,349,353,357,361,365,369,373,377,381,385,389,393,397,401,405,409,413,417,421,425,429,433,437,441,445,449,453,457,461,465,469,473,477,481,485,489,493,497,501,505,509,513,517],{"title":10,"path":11,"stem":12},"Activation Functions Are Not a Detail - ReLU Changed Everything","/blog/activation-functions-are-not-a-detail","blog/activation-functions-are-not-a-detail",{"title":14,"path":15,"stem":16},"Actor-Critic - The First Time RL Feels Trainable","/blog/actor-critic-the-first-time-rl-feels-trainable","blog/actor-critic-the-first-time-rl-feels-trainable",{"title":18,"path":19,"stem":20},"Agent Evals as CI - From Prompt Tests to Scenario Harnesses and Red Teams","/blog/agent-evals-as-ci-from-prompt-tests-to-scenario-harnesses-and-red-teams","blog/agent-evals-as-ci-from-prompt-tests-to-scenario-harnesses-and-red-teams",{"title":22,"path":23,"stem":24},"Agent Runtimes Emerge: SDKs, orchestration primitives, and observability","/blog/agent-runtimes-emerge-sdks-orchestration-primitives-and-observability","blog/agent-runtimes-emerge-sdks-orchestration-primitives-and-observability",{"title":26,"path":27,"stem":28},"Agentic AI Is Becoming a Cybersecurity Problem","/blog/agentic-ai-is-becoming-a-cybersecurity-problem","blog/agentic-ai-is-becoming-a-cybersecurity-problem",{"title":30,"path":31,"stem":32},"Agents as Distributed Systems: outbox, sagas, and “eventually correct” workflows","/blog/agents-as-distributed-systems-outbox-sagas-eventually-correct-workflows","blog/agents-as-distributed-systems-outbox-sagas-eventually-correct-workflows",{"title":34,"path":35,"stem":36},"AI Compliance Becomes Runtime Architecture","/blog/ai-compliance-becomes-runtime-architecture-gpai-transparency-auditability","blog/ai-compliance-becomes-runtime-architecture-gpai-transparency-auditability",{"title":38,"path":39,"stem":40},"AJAX → Fetch → GraphQL → tRPC: Choosing Your Data Boundary","/blog/ajax-fetch-graphql-trpc-choosing-your-data-boundary","blog/ajax-fetch-graphql-trpc-choosing-your-data-boundary",{"title":42,"path":43,"stem":44},"Exercise 8 + Course Wrap - Anomaly Detection & Recommenders (and My Next Steps)","/blog/anomaly-detection-and-recommenders","blog/anomaly-detection-and-recommenders",{"title":46,"path":47,"stem":48},"API Evolution at Scale: Compatibility, Contracts, and Consumer-Driven Testing","/blog/api-evolution-at-scale-compatibility-contracts-consumer-driven-testing","blog/api-evolution-at-scale-compatibility-contracts-consumer-driven-testing",{"title":50,"path":51,"stem":52},"Backends: Frameworks Don’t Matter Until They Do (Node, Java, .NET, Go, Python)","/blog/backends-frameworks-dont-matter-until-they-do","blog/backends-frameworks-dont-matter-until-they-do",{"title":54,"path":55,"stem":56},"Backpropagation Demystified - It’s Just the Chain Rule (But Applied Ruthlessly)","/blog/backpropagation-demystified","blog/backpropagation-demystified",{"title":58,"path":59,"stem":60},"Bandits - The First Honest RL Problem","/blog/bandits-the-first-honest-rl-problem","blog/bandits-the-first-honest-rl-problem",{"title":62,"path":63,"stem":64},"Batch Training & Evaluation Again: Promising Results That Survive Scrutiny","/blog/batch-training-evaluation-again-promising-results-that-survive-scrutiny","blog/batch-training-evaluation-again-promising-results-that-survive-scrutiny",{"title":66,"path":67,"stem":68},"bitmex-gym - The Baseline Trading Environment (Where Cheating Starts)","/blog/bitmex-gym-baseline-trading-environment-where-cheating-starts","blog/bitmex-gym-baseline-trading-environment-where-cheating-starts",{"title":70,"path":71,"stem":72},"bitmex-management-gym: Position Sizing and the First Risk-Aware Agent","/blog/bitmex-management-gym-position-sizing-first-risk-aware-agent","blog/bitmex-management-gym-position-sizing-first-risk-aware-agent",{"title":74,"path":75,"stem":76},"Browser Reality: The Event Loop, Rendering, and Why UX Bugs Look Like Backend Bugs","/blog/browser-reality-event-loop-rendering-ux-bugs-backend-bugs","blog/browser-reality-event-loop-rendering-ux-bugs-backend-bugs",{"title":78,"path":79,"stem":80},"Caching Without Folklore: Redis, CDNs, and the Two Hard Things","/blog/caching-without-folklore-redis-cdns-and-the-two-hard-things","blog/caching-without-folklore-redis-cdns-and-the-two-hard-things",{"title":82,"path":83,"stem":84},"Capstone: Build a System That Can Survive (Reference Architecture + Decision Log)","/blog/capstone-build-a-system-that-can-survive","blog/capstone-build-a-system-that-can-survive",{"title":86,"path":87,"stem":88},"Chappie Wiring From Trained Policy to Running Process","/blog/chappie-wiring-from-trained-policy-to-running-process","blog/chappie-wiring-from-trained-policy-to-running-process",{"title":90,"path":91,"stem":92},"CI/CD as Architecture: Testing Pyramids, Pipelines, and Rollout Safety","/blog/ci-cd-as-architecture-testing-pyramids-pipelines-rollout-safety","blog/ci-cd-as-architecture-testing-pyramids-pipelines-rollout-safety",{"title":94,"path":95,"stem":96},"Cloud Infrastructure Without the Fanaticism: IaaS, PaaS, Serverless, Kubernetes","/blog/cloud-infrastructure-without-the-religion","blog/cloud-infrastructure-without-the-religion",{"title":98,"path":99,"stem":100},"Computer-Use Agents in Production: sandboxes, VMs, and UI-action safety","/blog/computer-use-agents-in-production-sandboxes-vms-ui-action-safety","blog/computer-use-agents-in-production-sandboxes-vms-ui-action-safety",{"title":102,"path":103,"stem":104},"Constraints That Teach: Risk Caps, Timeouts, and Surviving Bad Regimes","/blog/constraints-that-teach-risk-caps-timeouts-surviving-bad-regimes","blog/constraints-that-teach-risk-caps-timeouts-surviving-bad-regimes",{"title":106,"path":107,"stem":108},"Containers, Docker, and the Discipline of Reproducibility","/blog/containers-docker-and-the-discipline-of-reproducibility","blog/containers-docker-and-the-discipline-of-reproducibility",{"title":110,"path":111,"stem":112},"Context Assembly as a Subsystem: Summaries, State, and Token Budgets","/blog/context-assembly-as-a-subsystem-summaries-state-and-token-budgets","blog/context-assembly-as-a-subsystem-summaries-state-and-token-budgets",{"title":114,"path":115,"stem":116},"Continuous Control - DDPG and the Seduction of Off-Policy","/blog/continuous-control-ddpg-and-the-seduction-of-off-policy","blog/continuous-control-ddpg-and-the-seduction-of-off-policy",{"title":118,"path":119,"stem":120},"Convolutions - Why CNNs See the World Differently","/blog/convolutions-why-cnns-see-the-world-differently","blog/convolutions-why-cnns-see-the-world-differently",{"title":122,"path":123,"stem":124},"Cost as a First-Class Constraint: FinOps for Architects","/blog/cost-as-a-first-class-constraint-finops-for-architects","blog/cost-as-a-first-class-constraint-finops-for-architects",{"title":126,"path":127,"stem":128},"DALL·E: How Text Became Images (and Why It Changed Everything)","/blog/dalle-how-text-became-images-and-why-it-changed-everything","blog/dalle-how-text-became-images-and-why-it-changed-everything",{"title":130,"path":131,"stem":132},"Data Engineering for Product Teams: OLTP vs OLAP, Streaming, and Truth","/blog/data-engineering-for-product-teams-oltp-vs-olap-streaming-and-truth","blog/data-engineering-for-product-teams-oltp-vs-olap-streaming-and-truth",{"title":134,"path":135,"stem":136},"Data Stores 101 for Architects: SQL, NoSQL, and the Shape of Consistency","/blog/data-stores-101-for-architects-sql-nosql-consistency","blog/data-stores-101-for-architects-sql-nosql-consistency",{"title":138,"path":139,"stem":140},"Dataset Reality — HDF5 Schema, Missing Data, and “Don’t Lie to Yourself” Rules","/blog/dataset-reality-hdf5-schema-missing-data","blog/dataset-reality-hdf5-schema-missing-data",{"title":142,"path":143,"stem":144},"Exercise 5 - Debugging ML (Bias/Variance, Learning Curves, and What to Try Next)","/blog/debugging-ml-bias-variance","blog/debugging-ml-bias-variance",{"title":146,"path":147,"stem":148},"Deep Q-Learning - My First Real Baselines Month","/blog/deep-q-learning-my-first-real-baselines-month","blog/deep-q-learning-my-first-real-baselines-month",{"title":150,"path":151,"stem":152},"Deep Silos in RL: Architecture as Stability (and the First LSTM Variant)","/blog/deep-silos-in-rl-architecture-as-stability","blog/deep-silos-in-rl-architecture-as-stability",{"title":154,"path":155,"stem":156},"Deep Silos - Representation Learning That Respects Feature Families","/blog/deep-silos-representation-learning-feature-families","blog/deep-silos-representation-learning-feature-families",{"title":158,"path":159,"stem":160},"Defining Alpha Without Cheating - Look-Ahead Labels and Leakage Traps","/blog/defining-alpha-without-cheating","blog/defining-alpha-without-cheating",{"title":162,"path":163,"stem":164},"Dissecting ChatGPT: The Product Architecture Around the Model","/blog/dissecting-chatgpt-the-product-architecture-around-the-model","blog/dissecting-chatgpt-the-product-architecture-around-the-model",{"title":166,"path":167,"stem":168},"Distributed Data: Transactions, Outbox, Sagas, and “Eventually Correct”","/blog/distributed-data-transactions-outbox-sagas-eventually-correct","blog/distributed-data-transactions-outbox-sagas-eventually-correct",{"title":170,"path":171,"stem":172},"Why Sequences Break Everything - Enter Recurrent Neural Networks","/blog/enter-recurrent-neural-networks","blog/enter-recurrent-neural-networks",{"title":174,"path":175,"stem":176},"Evaluation Discipline - Walk-Forward Backtesting Inside the Gym","/blog/evaluation-discipline-walk-forward-backtesting-inside-gym","blog/evaluation-discipline-walk-forward-backtesting-inside-gym",{"title":178,"path":179,"stem":180},"Feature Engineering, But Make It Microstructure: Liquidity Created/Removed","/blog/feature-engineering-microstructure-liquidity-created-removed","blog/feature-engineering-microstructure-liquidity-created-removed",{"title":182,"path":183,"stem":184},"First Live Runs - Small Size, Big Lessons","/blog/first-live-runs-small-size-big-lessons","blog/first-live-runs-small-size-big-lessons",{"title":186,"path":187,"stem":188},"From Logistic Regression to Neurons - Rebuilding Intuition from the Perceptron","/blog/from-logistic-regression-to-neurons","blog/from-logistic-regression-to-neurons",{"title":190,"path":191,"stem":192},"From Microstructure to Features - What the Model Will See","/blog/from-microstructure-to-features-what-the-model-will-see","blog/from-microstructure-to-features-what-the-model-will-see",{"title":194,"path":195,"stem":196},"From Classical ML to Deep Learning - What Actually Changed (and What Didn’t) (and My Next Steps)","/blog/from-ml-to-deep-learning-retrospective","blog/from-ml-to-deep-learning-retrospective",{"title":198,"path":199,"stem":200},"From Prediction to Decision - Designing the Trading Environment Contract","/blog/from-prediction-to-decision-trading-environment-contract","blog/from-prediction-to-decision-trading-environment-contract",{"title":202,"path":203,"stem":204},"From Research Rig to System: 2020 Postmortem and the Real Amazing Result","/blog/from-research-rig-to-system-2020-postmortem","blog/from-research-rig-to-system-2020-postmortem",{"title":206,"path":207,"stem":208},"Frontend Systems: Routing, State, Forms, and the “Boring Stack” That Scales","/blog/frontend-systems-routing-state-forms-boring-stack","blog/frontend-systems-routing-state-forms-boring-stack",{"title":210,"path":211,"stem":212},"Frontier Model Release Governance","/blog/frontier-model-release-governance-national-security-workflow","blog/frontier-model-release-governance-national-security-workflow",{"title":214,"path":215,"stem":216},"Function Approximation - The Day RL Stopped Being Stable","/blog/function-approximation-the-day-rl-stopped-being-stable","blog/function-approximation-the-day-rl-stopped-being-stable",{"title":218,"path":219,"stem":220},"GPAI Obligations Begin: What Changes for Model Providers and Enterprises","/blog/gpai-obligations-begin-what-changes-for-model-providers-and-enterprises","blog/gpai-obligations-begin-what-changes-for-model-providers-and-enterprises",{"title":222,"path":223,"stem":224},"Hallucinations: A Probabilistic Failure Mode, Not a Moral Defect","/blog/hallucinations-a-probabilistic-failure-mode-not-a-moral-defect","blog/hallucinations-a-probabilistic-failure-mode-not-a-moral-defect",{"title":226,"path":227,"stem":228},"HTTP as a Distributed Systems API (Without the Buzzwords)","/blog/http-as-a-distributed-systems-api-without-the-buzzwords","blog/http-as-a-distributed-systems-api-without-the-buzzwords",{"title":230,"path":231,"stem":232},"Imitation Learning - GAIL and the Strange Feeling of Learning From Experts","/blog/imitation-learning-gail-and-learning-from-experts","blog/imitation-learning-gail-and-learning-from-experts",{"title":234,"path":235,"stem":236},"Incident Response and Resilience: Designing for Failure, Not Hope","/blog/incident-response-and-resilience-designing-for-failure-not-hope","blog/incident-response-and-resilience-designing-for-failure-not-hope",{"title":238,"path":239,"stem":240},"Initialization, Scale, and the Fragility of Deep Networks","/blog/initialization-scale-fragility-of-deep-networks","blog/initialization-scale-fragility-of-deep-networks",{"title":242,"path":243,"stem":244},"Instruction Tuning: Turning a Completion Engine into an Assistant","/blog/instruction-tuning-turning-a-completion-engine-into-an-assistant","blog/instruction-tuning-turning-a-completion-engine-into-an-assistant",{"title":246,"path":247,"stem":248},"Exercise 3 - One-vs-All + Intro to Neural Networks (Handwritten Digits!)","/blog/intro-to-neural-networks","blog/intro-to-neural-networks",{"title":250,"path":251,"stem":252},"Exercise 1 - Linear Regression From Scratch","/blog/linear-regression-from-scratch","blog/linear-regression-from-scratch",{"title":254,"path":255,"stem":256},"Linear Regression With Multiple Variables (and Why Vectorization Matters)","/blog/linear-regression-with-multiple-vars","blog/linear-regression-with-multiple-vars",{"title":258,"path":259,"stem":260},"Live Alpha Monitoring - When the Market Talks Back","/blog/live-alpha-monitoring-when-market-talks-back","blog/live-alpha-monitoring-when-market-talks-back",{"title":262,"path":263,"stem":264},"Exercise 2 - Logistic Regression for Classification (My First Real Classifier)","/blog/logistic-regression-for-classification","blog/logistic-regression-for-classification",{"title":266,"path":267,"stem":268},"Long Context Isn’t Memory: When to Stuff, When to Retrieve","/blog/long-context-isnt-memory-when-to-stuff-when-to-retrieve","blog/long-context-isnt-memory-when-to-stuff-when-to-retrieve",{"title":270,"path":271,"stem":272},"LSTMs - Engineering Memory into the Network","/blog/lstms-engineering-memory-into-the-network","blog/lstms-engineering-memory-into-the-network",{"title":274,"path":275,"stem":276},"Maker Trades as a Strategy: When Fees Become a Reward Signal","/blog/maker-trades-fees-reward-signal","blog/maker-trades-fees-reward-signal",{"title":278,"path":279,"stem":280},"Microservices vs Modular Monolith: The “When” and the “How”","/blog/microservices-vs-modular-monolith-when-and-how","blog/microservices-vs-modular-monolith-when-and-how",{"title":282,"path":283,"stem":284},"Midjourney and the Product Loop: Why Some Generators Feel Magical","/blog/midjourney-and-the-product-loop-why-some-generators-feel-magical","blog/midjourney-and-the-product-loop-why-some-generators-feel-magical",{"title":286,"path":287,"stem":288},"Model Selection Becomes Architecture: Routing, Budgets, and Capability Tiers","/blog/model-selection-becomes-architecture-routing-budgets-and-capability-tiers","blog/model-selection-becomes-architecture-routing-budgets-and-capability-tiers",{"title":290,"path":291,"stem":292},"Multi-Agent Systems Without Chaos: supervisors, specialists, and coordination contracts","/blog/multi-agent-systems-without-chaos-supervisors-specialists-and-coordination-contracts","blog/multi-agent-systems-without-chaos-supervisors-specialists-and-coordination-contracts",{"title":294,"path":295,"stem":296},"Multimodal Changes UX: designing text+vision+audio systems","/blog/multimodal-changes-ux-designing-text-vision-audio-systems","blog/multimodal-changes-ux-designing-text-vision-audio-systems",{"title":298,"path":299,"stem":300},"Exercise 4 - Neural Networks Learning (Backpropagation Without Tears)","/blog/neural-networks-learning-backpropagation","blog/neural-networks-learning-backpropagation",{"title":302,"path":303,"stem":304},"Normal Equation vs Gradient Descent (Choosing Tools Like an Engineer)","/blog/normal-equation-vs-gradient-descent","blog/normal-equation-vs-gradient-descent",{"title":306,"path":307,"stem":308},"Normalization Is a Deployment Problem - Mean/Sigma and Index Diff","/blog/normalization-is-a-deployment-problem","blog/normalization-is-a-deployment-problem",{"title":310,"path":311,"stem":312},"Observability that Works: Logs, Metrics, Traces, and SLO Thinking","/blog/observability-that-works-logs-metrics-traces-and-slo-thinking","blog/observability-that-works-logs-metrics-traces-and-slo-thinking",{"title":314,"path":315,"stem":316},"Open Weights in Production: evaluation, licensing, and guardrails","/blog/open-weights-in-production-evaluation-licensing-and-guardrails","blog/open-weights-in-production-evaluation-licensing-and-guardrails",{"title":318,"path":319,"stem":320},"OpenClaw: A Viral Agent, a Skills Ecosystem, and the Supply-Chain Reality Check","/blog/openclaw-a-viral-agent-and-the-supply-chain-reality-check","blog/openclaw-a-viral-agent-and-the-supply-chain-reality-check",{"title":322,"path":323,"stem":324},"Optimization Got Real - Momentum, Learning Rates, and Why Plain Gradient Descent Wasn’t Enough","/blog/optimization-got-real-momentumand-learning-rates","blog/optimization-got-real-momentumand-learning-rates",{"title":326,"path":327,"stem":328},"Order Books Are the Battlefield - Matching Engines in Plain English","/blog/order-books-are-the-battlefield","blog/order-books-are-the-battlefield",{"title":330,"path":331,"stem":332},"Performance Engineering End-to-End: From TTFB to Tail Latency","/blog/performance-engineering-end-to-end-from-ttfb-to-tail-latency","blog/performance-engineering-end-to-end-from-ttfb-to-tail-latency",{"title":334,"path":335,"stem":336},"Policy Gradients - Learning Without a Value Crutch","/blog/policy-gradients-learning-without-a-value-crutch","blog/policy-gradients-learning-without-a-value-crutch",{"title":338,"path":339,"stem":340},"Pooling, Hierarchies, and What CNNs Are Really Learning","/blog/pooling-hierarchies-and-cnns","blog/pooling-hierarchies-and-cnns",{"title":342,"path":343,"stem":344},"Pretraining Is Compression: Tokens, Datasets, and Emergent Skill","/blog/pretraining-is-compression-tokens-datasets-and-emergent-skill","blog/pretraining-is-compression-tokens-datasets-and-emergent-skill",{"title":346,"path":347,"stem":348},"Prism and the Architecture of Artifact-Native AI for Science","/blog/prism-and-the-architecture-of-artifact-native-ai-for-science","blog/prism-and-the-architecture-of-artifact-native-ai-for-science",{"title":350,"path":351,"stem":352},"Prompting is Not Programming: Contracts, Schemas, and Failure Budgets","/blog/prompting-is-not-programming-contracts-schemas-failure-budgets","blog/prompting-is-not-programming-contracts-schemas-failure-budgets",{"title":354,"path":355,"stem":356},"Queues, Retries, and Idempotency: Engineering Reality in Async Systems","/blog/queues-retries-and-idempotency-engineering-reality-in-async-systems","blog/queues-retries-and-idempotency-engineering-reality-in-async-systems",{"title":358,"path":359,"stem":360},"RAG Done Right: Knowledge, Grounding, and Evaluation That Isn’t Vibes","/blog/rag-done-right-knowledge-grounding-and-evaluation-that-isnt-vibes","blog/rag-done-right-knowledge-grounding-and-evaluation-that-isnt-vibes",{"title":362,"path":363,"stem":364},"RAG You Can Evaluate: retrieval pipelines, reranking, citations, and truth boundaries","/blog/rag-you-can-evaluate-retrieval-pipelines-reranking-citations-truth-boundaries","blog/rag-you-can-evaluate-retrieval-pipelines-reranking-citations-truth-boundaries",{"title":366,"path":367,"stem":368},"React as an Architecture Tool: Components, Hooks, and the Cost of Re-rendering","/blog/react-as-an-architecture-tool-components-hooks-cost-of-rerendering","blog/react-as-an-architecture-tool-components-hooks-cost-of-rerendering",{"title":370,"path":371,"stem":372},"Real-Time Agents: streaming, barge-in, and session state that doesn’t collapse","/blog/real-time-agents-streaming-barge-in-session-state-that-doesnt-collapse","blog/real-time-agents-streaming-barge-in-session-state-that-doesnt-collapse",{"title":374,"path":375,"stem":376},"Reasoning Budgets: fast/slow paths, verification, and when to “think longer”","/blog/reasoning-budgets-fast-slow-paths-verification-think-longer","blog/reasoning-budgets-fast-slow-paths-verification-think-longer",{"title":378,"path":379,"stem":380},"Reference Architecture v2: the Operable Agent Platform","/blog/reference-architecture-v2-the-operable-agent-platform","blog/reference-architecture-v2-the-operable-agent-platform",{"title":382,"path":383,"stem":384},"Regularization - Overfitting in the Real World (and How to Fight It)","/blog/regularization-overfitting-in-the-real-world","blog/regularization-overfitting-in-the-real-world",{"title":386,"path":387,"stem":388},"Regulation as Architecture: Turning the EU AI Act into Controls and Evidence","/blog/regulation-as-architecture-eu-ai-act-controls-evidence","blog/regulation-as-architecture-eu-ai-act-controls-evidence",{"title":390,"path":391,"stem":392},"RESTful Design That Survives: Resources, Boundaries, and Versioning","/blog/restful-design-that-survives-resources-boundaries-and-versioning","blog/restful-design-that-survives-resources-boundaries-and-versioning",{"title":394,"path":395,"stem":396},"Reward Shaping Without Lying - Penalties, Constraints, and the First Real Fixes","/blog/reward-shaping-without-lying","blog/reward-shaping-without-lying",{"title":398,"path":399,"stem":400},"Rewards, Returns, and Why “Learning” Is an Interface Problem","/blog/rewards-returns-learning-is-an-interface-problem","blog/rewards-returns-learning-is-an-interface-problem",{"title":402,"path":403,"stem":404},"RLHF: Stabilizing Behavior with Preferences (Alignment as Control)","/blog/rlhf-stabilizing-behavior-with-preferences-alignment-as-control","blog/rlhf-stabilizing-behavior-with-preferences-alignment-as-control",{"title":406,"path":407,"stem":408},"Safety Engineering - Kill Switches, Reconciliation, and Failure Recovery","/blog/safety-engineering-kill-switches-reconciliation-failure-recovery","blog/safety-engineering-kill-switches-reconciliation-failure-recovery",{"title":410,"path":411,"stem":412},"Search Becomes an Agent Runtime","/blog/search-becomes-an-agent-runtime-gemini-spark-ai-mode-and-actionable-retrieval","blog/search-becomes-an-agent-runtime-gemini-spark-ai-mode-and-actionable-retrieval",{"title":414,"path":415,"stem":416},"Security for Agent Connectors: least privilege, injection resistance, and safe toolchains","/blog/security-for-agent-connectors-least-privilege-injection-resistance-and-safe-toolchains","blog/security-for-agent-connectors-least-privilege-injection-resistance-and-safe-toolchains",{"title":418,"path":419,"stem":420},"Security for Builders: Threat Modeling and Secure-by-Default Systems","/blog/security-for-builders-threat-modeling-and-secure-by-default-systems","blog/security-for-builders-threat-modeling-and-secure-by-default-systems",{"title":422,"path":423,"stem":424},"Software in the Age of Probabilistic Components","/blog/software-in-the-age-of-probabilistic-components","blog/software-in-the-age-of-probabilistic-components",{"title":426,"path":427,"stem":428},"Sparse Rewards - HER and Learning From What Didn’t Happen","/blog/sparse-rewards-her-and-learning-from-what-didnt-happen","blog/sparse-rewards-her-and-learning-from-what-didnt-happen",{"title":430,"path":431,"stem":432},"Stability is a Feature You Have to Design","/blog/stability-is-a-feature-you-have-to-design","blog/stability-is-a-feature-you-have-to-design",{"title":434,"path":435,"stem":436},"Standards for the Agent Ecosystem: connectors, protocols, and MCP","/blog/standards-for-the-agent-ecosystem-connectors-protocols-and-mcp","blog/standards-for-the-agent-ecosystem-connectors-protocols-and-mcp",{"title":438,"path":439,"stem":440},"Supervised Baselines - First Alpha Models, First Humbling Curves","/blog/supervised-baselines-first-alpha-models","blog/supervised-baselines-first-alpha-models",{"title":442,"path":443,"stem":444},"Exercise 6 - Support Vector Machines (When a Different Model Just Wins)","/blog/support-vector-machines","blog/support-vector-machines",{"title":446,"path":447,"stem":448},"Tabular RL - When Value Iteration Feels Like Cheating","/blog/tabular-rl-when-value-iteration-feels-like-cheating","blog/tabular-rl-when-value-iteration-feels-like-cheating",{"title":450,"path":451,"stem":452},"The 1M-Token Era: how long context changes retrieval economics and system design","/blog/the-1m-token-era-long-context-retrieval-economics-and-system-design","blog/the-1m-token-era-long-context-retrieval-economics-and-system-design",{"title":454,"path":455,"stem":456},"The 503 Lesson - Outages as a Signal, Not Just a Bug","/blog/the-503-lesson-outages-as-signal-not-just-a-bug","blog/the-503-lesson-outages-as-signal-not-just-a-bug",{"title":458,"path":459,"stem":460},"The Collector - Websockets, Clock Drift, and the First Clean Snapshot","/blog/the-collector-websockets-clock-drift-and-the-first-clean-snapshot","blog/the-collector-websockets-clock-drift-and-the-first-clean-snapshot",{"title":462,"path":463,"stem":464},"The Compliance Cliff: prohibited practices and governance controls that actually ship","/blog/the-compliance-cliff-prohibited-practices-and-governance-controls-that-actually-ship","blog/the-compliance-cliff-prohibited-practices-and-governance-controls-that-actually-ship",{"title":466,"path":467,"stem":468},"The Connector Ecosystem: MCP adoption patterns, versioning, and governance","/blog/the-connector-ecosystem-mcp-adoption-patterns-versioning-and-governance","blog/the-connector-ecosystem-mcp-adoption-patterns-versioning-and-governance",{"title":470,"path":471,"stem":472},"The Model Router Era","/blog/the-model-router-era-routing-eval-gates-and-budgets","blog/the-model-router-era-routing-eval-gates-and-budgets",{"title":474,"path":475,"stem":476},"Vanishing Gradients Strike Back - The Pain of Training RNNs","/blog/the-pain-of-training-rnns","blog/the-pain-of-training-rnns",{"title":478,"path":479,"stem":480},"Tool Use and Agents: When the Model Becomes a Workflow Engine","/blog/tool-use-and-agents-when-the-model-becomes-a-workflow-engine","blog/tool-use-and-agents-when-the-model-becomes-a-workflow-engine",{"title":482,"path":483,"stem":484},"Tool Use with Open Models: function calling, sandboxes, and “capability boundaries”","/blog/tool-use-with-open-models-function-calling-sandboxes-capability-boundaries","blog/tool-use-with-open-models-function-calling-sandboxes-capability-boundaries",{"title":486,"path":487,"stem":488},"Transformers: Attention as an Engineering Breakthrough (Not a Math Flex)","/blog/transformers-attention-as-an-engineering-breakthrough","blog/transformers-attention-as-an-engineering-breakthrough",{"title":490,"path":491,"stem":492},"Exercise 7 - Unsupervised Learning (K-means) + PCA (Compression & Visualization)","/blog/unsupervised-learning-and-compression","blog/unsupervised-learning-and-compression",{"title":494,"path":495,"stem":496},"Voice Agents You Can Operate: reliability, caching, latency, and human handoff","/blog/voice-agents-you-can-operate-reliability-caching-latency-human-handoff","blog/voice-agents-you-can-operate-reliability-caching-latency-human-handoff",{"title":498,"path":499,"stem":500},"The Web's \"Compression Algorithm\": Static → Web 2.0 → SPA → SSR/Edge","/blog/webs-compression-algorithm-static-web2-spa-ssr-edge","blog/webs-compression-algorithm-static-web2-spa-ssr-edge",{"title":502,"path":503,"stem":504},"When Agents Escape the Sandbox","/blog/when-agents-escape-the-sandbox-containment-monitoring-and-incident-response","blog/when-agents-escape-the-sandbox-containment-monitoring-and-incident-response",{"title":506,"path":507,"stem":508},"Why Deeper Networks Are Harder to Train Than I Expected","/blog/why-deeper-networks-are-harder-to-train","blog/why-deeper-networks-are-harder-to-train",{"title":510,"path":511,"stem":512},"Why I’m Learning Machine Learning","/blog/why-im-learning-machine-learning","blog/why-im-learning-machine-learning",{"title":514,"path":515,"stem":516},"Why NLP Was Hard: RNN Pain, Vanishing Gradients, and the Limits of “Memory”","/blog/why-nlp-was-hard-rnn-pain-vanishing-gradients-limits-of-memory","blog/why-nlp-was-hard-rnn-pain-vanishing-gradients-limits-of-memory",{"title":518,"path":519,"stem":520},"Why RL Training Is Unstable (A Catalog of Breakage)","/blog/why-rl-training-is-unstable-a-catalog-of-breakage","blog/why-rl-training-is-unstable-a-catalog-of-breakage",false,{"id":523,"title":34,"author":524,"body":528,"date":3090,"description":3091,"extension":3092,"image":3093,"meta":3094,"minRead":1265,"navigation":3096,"path":35,"seo":3097,"sitemap":3098,"stem":36,"__hash__":3101},"blog/blog/ai-compliance-becomes-runtime-architecture-gpai-transparency-auditability.md",{"name":525,"avatar":526},"Axel Domingues",{"src":527,"alt":525},"/images/axel-domingues.avif",{"type":529,"value":530,"toc":3048},"minimark",[531,535,538,544,547,550,553,561,564,567,570,610,617,628,667,670,675,678,699,702,705,708,711,737,740,743,754,756,760,763,770,773,776,808,811,817,819,823,826,829,861,864,867,882,885,888,914,917,919,923,969,971,975,981,984,989,1032,1035,1038,1040,1044,1047,1050,1053,1056,1085,1088,1091,1342,1345,1348,1359,1361,1365,1368,1371,1374,1377,1394,1400,1429,1432,1458,1473,1475,1479,1482,1485,1488,1505,1508,1600,1610,1612,1616,1619,1622,1625,1666,1669,2056,2059,2062,2067,2069,2073,2076,2079,2111,2221,2231,2233,2237,2240,2243,2246,2249,2281,2311,2321,2323,2327,2330,2333,2362,2365,2368,2419,2429,2431,2435,2438,2441,2444,2471,2474,2481,2484,2513,2516,2519,2522,2524,2528,2531,2614,2616,2620,2623,2751,2761,2763,2767,2770,2773,2790,2793,2798,2801,2803,2807,2810,2813,2816,2842,2853,2855,2859,2905,2907,2911,3044],[532,533,534],"p",{},"August’s hot topic was not a new model.",[532,536,537],{},"It was a date.",[532,539,540],{},[541,542,543],"strong",{},"2 August 2026.",[532,545,546],{},"That is when key EU AI Act obligations became enforceable in ways that matter to teams shipping AI systems: general-purpose AI model rules, transparency obligations, and enforcement machinery that turns “AI governance” from slideware into operating reality.",[532,548,549],{},"The important part is not “Europe made rules.”",[532,551,552],{},"The important part is this:",[554,555,556],"blockquote",{},[532,557,558],{},[541,559,560],{},"AI compliance is becoming runtime architecture.",[532,562,563],{},"Not a policy PDF.\nNot a spreadsheet.\nNot a quarterly checklist.\nNot a legal review that happens after product already shipped.",[532,565,566],{},"A runtime layer.",[532,568,569],{},"Because modern AI products are not one model in one place.\nThey are systems:",[571,572,573,577,580,583,586,589,592,595,598,601,604,607],"ul",{},[574,575,576],"li",{},"model routers",[574,578,579],{},"RAG pipelines",[574,581,582],{},"agents",[574,584,585],{},"tool gateways",[574,587,588],{},"generated media",[574,590,591],{},"prompt templates",[574,593,594],{},"user-specific context",[574,596,597],{},"vendor APIs",[574,599,600],{},"human approvals",[574,602,603],{},"telemetry",[574,605,606],{},"rollouts",[574,608,609],{},"fallbacks",[532,611,612,613,616],{},"So if compliance requirements apply to the system, the system needs compliance controls ",[541,614,615],{},"inside the architecture",".",[618,619,620,623],"caution",{},[532,621,622],{},"This article is not legal advice.",[554,624,625],{},[532,626,627],{},"It is the engineering lens: how to translate regulatory pressure into concrete systems — inventory, policy, evidence, logging, disclosure, monitoring, and rollback.",[629,630,631,642,653,660],"card-group",{},[632,633,636],"card",{"icon":634,"title":635},"i-lucide-landmark","The trend",[532,637,638,639,616],{},"AI regulation moved from “future concern” to ",[541,640,641],{},"enforceable operational constraint",[632,643,646],{"icon":644,"title":645},"i-lucide-server-cog","The shift",[532,647,648,649,652],{},"Compliance becomes a ",[541,650,651],{},"runtime control plane",", not a documentation side quest.",[632,654,657],{"icon":655,"title":656},"i-lucide-clipboard-check","The core primitive",[532,658,659],{},"Every AI feature needs a traceable record: model, purpose, data class, policy, output, and action.",[632,661,664],{"icon":662,"title":663},"i-lucide-anchor","The thesis",[532,665,666],{},"If you cannot inventory, explain, disclose, audit, and revoke AI behavior, you cannot govern it.",[668,669],"hr",{},[671,672,674],"h2",{"id":673},"the-old-compliance-pattern-is-broken","The old compliance pattern is broken",[532,676,677],{},"The old pattern looked like this:",[679,680,681,684,687,690,693,696],"ol",{},[574,682,683],{},"product team builds feature",[574,685,686],{},"legal / security asks questions",[574,688,689],{},"someone fills a spreadsheet",[574,691,692],{},"someone writes a policy document",[574,694,695],{},"launch happens anyway",[574,697,698],{},"months later, nobody knows what is actually running",[532,700,701],{},"That pattern was already weak for normal software.",[532,703,704],{},"For AI systems, it fails completely.",[532,706,707],{},"Why?",[532,709,710],{},"Because AI behavior is not static:",[571,712,713,716,719,722,725,728,731,734],{},[574,714,715],{},"model versions change",[574,717,718],{},"prompts change",[574,720,721],{},"retrieval corpora change",[574,723,724],{},"tool permissions change",[574,726,727],{},"routing policies change",[574,729,730],{},"safety behavior changes",[574,732,733],{},"user context changes",[574,735,736],{},"generated outputs become part of downstream workflows",[532,738,739],{},"A PDF cannot track that.",[532,741,742],{},"A runtime can.",[744,745,746,749],"warning",{},[532,747,748],{},"AI compliance fails when governance artifacts are disconnected from production reality.",[554,750,751],{},[532,752,753],{},"If the document says one thing and the router/tool gateway does another, production wins.",[668,755],{},[671,757,759],{"id":758},"compliance-in-one-sentence","Compliance in one sentence",[532,761,762],{},"AI compliance, from an engineering perspective, is:",[554,764,765],{},[532,766,767],{},[541,768,769],{},"the ability to prove that an AI system was used for an allowed purpose, with allowed data, through an allowed model, under allowed controls, producing traceable outputs.",[532,771,772],{},"That sentence is deliberately operational.",[532,774,775],{},"It points to systems you can build:",[571,777,778,781,784,787,790,793,796,799,802,805],{},[574,779,780],{},"inventory",[574,782,783],{},"classification",[574,785,786],{},"routing",[574,788,789],{},"logging",[574,791,792],{},"disclosure",[574,794,795],{},"provenance",[574,797,798],{},"policy gates",[574,800,801],{},"evidence packets",[574,803,804],{},"access reviews",[574,806,807],{},"incident response",[532,809,810],{},"The goal is not “perfect compliance.”",[532,812,813,814,616],{},"The goal is making compliance ",[541,815,816],{},"observable and enforceable",[668,818],{},[671,820,822],{"id":821},"why-gpai-changes-the-architecture","Why GPAI changes the architecture",[532,824,825],{},"General-purpose AI models create a governance problem because they are not tied to one narrow use case.",[532,827,828],{},"The same model can be used for:",[571,830,831,834,837,840,843,846,849,852,855,858],{},[574,832,833],{},"customer support",[574,835,836],{},"HR screening support",[574,838,839],{},"code generation",[574,841,842],{},"medical summarization",[574,844,845],{},"marketing copy",[574,847,848],{},"image generation",[574,850,851],{},"legal drafting",[574,853,854],{},"agentic tool use",[574,856,857],{},"internal analytics",[574,859,860],{},"cybersecurity triage",[532,862,863],{},"That flexibility is the product value.",[532,865,866],{},"It is also the compliance problem.",[868,869,870,877],"note",{},[532,871,872,873,616],{},"A general-purpose model is not governed only by what it ",[874,875,876],"em",{},"is",[554,878,879],{},[532,880,881],{},"It is governed by where it is deployed, what data it sees, what decisions it influences, and what tools it can call.",[532,883,884],{},"So your compliance architecture cannot stop at “which model provider do we use?”",[532,886,887],{},"It needs to answer:",[571,889,890,893,896,899,902,905,908,911],{},[574,891,892],{},"which model is used in this workflow?",[574,894,895],{},"what version?",[574,897,898],{},"for what purpose?",[574,900,901],{},"with what user-visible disclosure?",[574,903,904],{},"with what data class?",[574,906,907],{},"with what downstream effect?",[574,909,910],{},"with what human review?",[574,912,913],{},"with what audit trail?",[532,915,916],{},"That is runtime metadata.",[668,918],{},[671,920,922],{"id":921},"mini-glossary-the-compliance-words-engineers-need","Mini-glossary: the compliance words engineers need",[924,925,926,934,941,948,955,962],"accordion",{},[927,928,931],"accordion-item",{"icon":929,"label":930},"i-lucide-brain-circuit","GPAI model",[532,932,933],{},"A general-purpose AI model: a model capable of being integrated into many downstream systems and tasks, rather than a narrow model built for one fixed use case.",[927,935,938],{"icon":936,"label":937},"i-lucide-factory","Provider",[532,939,940],{},"The actor that develops or places an AI model/system on the market. In platform terms, this may be the model lab, vendor, or system supplier depending on context.",[927,942,945],{"icon":943,"label":944},"i-lucide-rocket","Deployer",[532,946,947],{},"The actor using an AI system in a real workflow. Many product teams are deployers even when they do not train the foundation model.",[927,949,952],{"icon":950,"label":951},"i-lucide-eye","Transparency obligation",[532,953,954],{},"A requirement to inform people when they are interacting with AI or when content has been generated/manipulated by AI, depending on the system and context.",[927,956,959],{"icon":957,"label":958},"i-lucide-fingerprint","Provenance",[532,960,961],{},"Metadata that helps answer where an output came from: model, prompt, sources, tools, editor, timestamp, and transformation history.",[927,963,966],{"icon":964,"label":965},"i-lucide-archive","Audit packet",[532,967,968],{},"A structured record that lets reviewers reconstruct what happened: policy decision, model route, data class, output, tool calls, approvals, and evidence.",[668,970],{},[671,972,974],{"id":973},"the-architecture-pattern-ai-compliance-control-plane","The architecture pattern: AI Compliance Control Plane",[532,976,977,978,616],{},"The component I would design for August 2026 is an ",[541,979,980],{},"AI Compliance Control Plane",[532,982,983],{},"Not one giant monolith.\nNot a legal tool.\nA set of services and contracts that sit across the AI runtime.",[985,986],"img",{"alt":987,"src":988},"AI compliance control plane architecture: model inventory, use-case registry, policy engine, model router, transparency renderer, provenance ledger, audit store, vendor evidence pipeline","blog/2026/illustrations/ai-compliance-control-plane.avif",[629,990,991,998,1005,1012,1019,1025],{},[632,992,995],{"icon":993,"title":994},"i-lucide-database","Model inventory",[532,996,997],{},"Which models exist, where they are used, what versions are active, and who owns each route.",[632,999,1002],{"icon":1000,"title":1001},"i-lucide-map","Use-case registry",[532,1003,1004],{},"Which workflows use AI, for what purpose, with what risk tier and human oversight.",[632,1006,1009],{"icon":1007,"title":1008},"i-lucide-shield-check","Policy engine",[532,1010,1011],{},"Runtime decisions: allow, deny, disclose, log, redact, require approval, or route differently.",[632,1013,1016],{"icon":1014,"title":1015},"i-lucide-receipt-text","Provenance ledger",[532,1017,1018],{},"A durable record of model route, prompt, data class, output, source evidence, and tool calls.",[632,1020,1022],{"icon":950,"title":1021},"Transparency layer",[532,1023,1024],{},"User-facing disclosures, AI-generated content labels, metadata marking, and interaction notices.",[632,1026,1029],{"icon":1027,"title":1028},"i-lucide-folder-check","Evidence pipeline",[532,1030,1031],{},"Vendor documentation, model cards, eval results, DPIA-style inputs, and internal review artifacts.",[532,1033,1034],{},"This is the runtime spine.",[532,1036,1037],{},"Everything else hangs off it.",[668,1039],{},[671,1041,1043],{"id":1042},"the-first-table-every-company-needs-ai-system-inventory","The first table every company needs: AI system inventory",[532,1045,1046],{},"Before you can govern anything, you need to know what exists.",[532,1048,1049],{},"That sounds obvious.",[532,1051,1052],{},"It is not.",[532,1054,1055],{},"In real companies, AI appears through:",[571,1057,1058,1061,1064,1067,1070,1073,1076,1079,1082],{},[574,1059,1060],{},"SaaS features turned on by vendors",[574,1062,1063],{},"embedded copilots",[574,1065,1066],{},"marketing tools",[574,1068,1069],{},"support tooling",[574,1071,1072],{},"data analysis notebooks",[574,1074,1075],{},"internal automations",[574,1077,1078],{},"RAG prototypes",[574,1080,1081],{},"coding agents",[574,1083,1084],{},"shadow workflows",[532,1086,1087],{},"So the first engineering artifact is an inventory.",[532,1089,1090],{},"Minimum fields:",[1092,1093,1098],"pre",{"className":1094,"code":1095,"language":1096,"meta":1097,"style":1097},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","ai_system_id: support_reply_assistant\nowner: customer_platform\nbusiness_purpose: draft support replies from approved knowledge base\nuser_facing: true\nai_disclosure_required: true\nmodel_routes:\n  - provider: openai\n    model_alias: support-prod\n    version_policy: pinned\ndata_classes:\n  - customer_support_ticket\n  - public_kb_article\ntools:\n  - kb_retrieve\n  - draft_reply\n  - ticket_read\n  - ticket_comment_requires_human\nrisk_tier: transparency_sensitive\nhuman_review: required_before_external_send\nlogs:\n  provenance: enabled\n  retention: 180_days\nrollback:\n  disable_feature_flag: support_ai_draft_enabled\n","yaml","",[1099,1100,1101,1118,1129,1140,1152,1162,1171,1185,1196,1207,1215,1223,1231,1239,1247,1255,1263,1271,1282,1293,1301,1312,1323,1331],"code",{"__ignoreMap":1097},[1102,1103,1106,1110,1114],"span",{"class":1104,"line":1105},"line",1,[1102,1107,1109],{"class":1108},"swJcz","ai_system_id",[1102,1111,1113],{"class":1112},"sMK4o",":",[1102,1115,1117],{"class":1116},"sfazB"," support_reply_assistant\n",[1102,1119,1121,1124,1126],{"class":1104,"line":1120},2,[1102,1122,1123],{"class":1108},"owner",[1102,1125,1113],{"class":1112},[1102,1127,1128],{"class":1116}," customer_platform\n",[1102,1130,1132,1135,1137],{"class":1104,"line":1131},3,[1102,1133,1134],{"class":1108},"business_purpose",[1102,1136,1113],{"class":1112},[1102,1138,1139],{"class":1116}," draft support replies from approved knowledge base\n",[1102,1141,1143,1146,1148],{"class":1104,"line":1142},4,[1102,1144,1145],{"class":1108},"user_facing",[1102,1147,1113],{"class":1112},[1102,1149,1151],{"class":1150},"sfNiH"," true\n",[1102,1153,1155,1158,1160],{"class":1104,"line":1154},5,[1102,1156,1157],{"class":1108},"ai_disclosure_required",[1102,1159,1113],{"class":1112},[1102,1161,1151],{"class":1150},[1102,1163,1165,1168],{"class":1104,"line":1164},6,[1102,1166,1167],{"class":1108},"model_routes",[1102,1169,1170],{"class":1112},":\n",[1102,1172,1174,1177,1180,1182],{"class":1104,"line":1173},7,[1102,1175,1176],{"class":1112},"  -",[1102,1178,1179],{"class":1108}," provider",[1102,1181,1113],{"class":1112},[1102,1183,1184],{"class":1116}," openai\n",[1102,1186,1188,1191,1193],{"class":1104,"line":1187},8,[1102,1189,1190],{"class":1108},"    model_alias",[1102,1192,1113],{"class":1112},[1102,1194,1195],{"class":1116}," support-prod\n",[1102,1197,1199,1202,1204],{"class":1104,"line":1198},9,[1102,1200,1201],{"class":1108},"    version_policy",[1102,1203,1113],{"class":1112},[1102,1205,1206],{"class":1116}," pinned\n",[1102,1208,1210,1213],{"class":1104,"line":1209},10,[1102,1211,1212],{"class":1108},"data_classes",[1102,1214,1170],{"class":1112},[1102,1216,1218,1220],{"class":1104,"line":1217},11,[1102,1219,1176],{"class":1112},[1102,1221,1222],{"class":1116}," customer_support_ticket\n",[1102,1224,1226,1228],{"class":1104,"line":1225},12,[1102,1227,1176],{"class":1112},[1102,1229,1230],{"class":1116}," public_kb_article\n",[1102,1232,1234,1237],{"class":1104,"line":1233},13,[1102,1235,1236],{"class":1108},"tools",[1102,1238,1170],{"class":1112},[1102,1240,1242,1244],{"class":1104,"line":1241},14,[1102,1243,1176],{"class":1112},[1102,1245,1246],{"class":1116}," kb_retrieve\n",[1102,1248,1250,1252],{"class":1104,"line":1249},15,[1102,1251,1176],{"class":1112},[1102,1253,1254],{"class":1116}," draft_reply\n",[1102,1256,1258,1260],{"class":1104,"line":1257},16,[1102,1259,1176],{"class":1112},[1102,1261,1262],{"class":1116}," ticket_read\n",[1102,1264,1266,1268],{"class":1104,"line":1265},17,[1102,1267,1176],{"class":1112},[1102,1269,1270],{"class":1116}," ticket_comment_requires_human\n",[1102,1272,1274,1277,1279],{"class":1104,"line":1273},18,[1102,1275,1276],{"class":1108},"risk_tier",[1102,1278,1113],{"class":1112},[1102,1280,1281],{"class":1116}," transparency_sensitive\n",[1102,1283,1285,1288,1290],{"class":1104,"line":1284},19,[1102,1286,1287],{"class":1108},"human_review",[1102,1289,1113],{"class":1112},[1102,1291,1292],{"class":1116}," required_before_external_send\n",[1102,1294,1296,1299],{"class":1104,"line":1295},20,[1102,1297,1298],{"class":1108},"logs",[1102,1300,1170],{"class":1112},[1102,1302,1304,1307,1309],{"class":1104,"line":1303},21,[1102,1305,1306],{"class":1108},"  provenance",[1102,1308,1113],{"class":1112},[1102,1310,1311],{"class":1116}," enabled\n",[1102,1313,1315,1318,1320],{"class":1104,"line":1314},22,[1102,1316,1317],{"class":1108},"  retention",[1102,1319,1113],{"class":1112},[1102,1321,1322],{"class":1116}," 180_days\n",[1102,1324,1326,1329],{"class":1104,"line":1325},23,[1102,1327,1328],{"class":1108},"rollback",[1102,1330,1170],{"class":1112},[1102,1332,1334,1337,1339],{"class":1104,"line":1333},24,[1102,1335,1336],{"class":1108},"  disable_feature_flag",[1102,1338,1113],{"class":1112},[1102,1340,1341],{"class":1116}," support_ai_draft_enabled\n",[532,1343,1344],{},"This is not bureaucracy.",[532,1346,1347],{},"This is how you stop discovering production AI through incidents.",[1349,1350,1351,1354],"tip",{},[532,1352,1353],{},"The AI inventory is the dependency graph for your compliance posture.",[554,1355,1356],{},[532,1357,1358],{},"No inventory, no governance.",[668,1360],{},[671,1362,1364],{"id":1363},"risk-tiering-route-by-use-case-not-vibes","Risk tiering: route by use case, not vibes",[532,1366,1367],{},"One mistake teams make is trying to classify only the model.",[532,1369,1370],{},"That is not enough.",[532,1372,1373],{},"The same model can be low-risk in one workflow and high-risk in another.",[532,1375,1376],{},"Example:",[571,1378,1379,1382,1385,1388,1391],{},[574,1380,1381],{},"summarizing public release notes: low risk",[574,1383,1384],{},"ranking job applicants: high risk",[574,1386,1387],{},"drafting a medical explanation: regulated / sensitive",[574,1389,1390],{},"generating marketing images: transparency-sensitive",[574,1392,1393],{},"running a coding agent with write access: security-sensitive",[532,1395,1396,1397,616],{},"So risk tiering belongs at the ",[541,1398,1399],{},"use-case level",[629,1401,1402,1409,1415,1422],{},[632,1403,1406],{"icon":1404,"title":1405},"i-lucide-sparkles","Low-risk assistive",[532,1407,1408],{},"Drafting, formatting, internal brainstorming, low-impact summarization.",[632,1410,1412],{"icon":950,"title":1411},"Transparency-sensitive",[532,1413,1414],{},"Chatbots, generated content, synthetic media, user-facing AI interaction.",[632,1416,1419],{"icon":1417,"title":1418},"i-lucide-scale","Decision-influencing",[532,1420,1421],{},"Workflows that affect people, eligibility, access, ranking, moderation, or prioritization.",[632,1423,1426],{"icon":1424,"title":1425},"i-lucide-lock-keyhole","Security-sensitive",[532,1427,1428],{},"Agents with tools, code access, secrets, deployment paths, or external side effects.",[532,1430,1431],{},"Each tier should map to controls:",[571,1433,1434,1437,1440,1443,1446,1449,1452,1455],{},[574,1435,1436],{},"disclosure requirements",[574,1438,1439],{},"logging level",[574,1441,1442],{},"model allowlist",[574,1444,1445],{},"human review",[574,1447,1448],{},"tool restrictions",[574,1450,1451],{},"retention policy",[574,1453,1454],{},"eval requirements",[574,1456,1457],{},"approval flow",[868,1459,1460,1463,1468],{},[532,1461,1462],{},"Compliance routing is just model routing with more constraints.",[554,1464,1465],{},[532,1466,1467],{},"April’s router chose between models.",[554,1469,1470],{},[532,1471,1472],{},"August’s compliance router decides whether a model is allowed to run at all.",[668,1474],{},[671,1476,1478],{"id":1477},"transparency-as-a-rendering-problem","Transparency as a rendering problem",[532,1480,1481],{},"Transparency sounds like policy language.",[532,1483,1484],{},"In production, it is often a rendering problem.",[532,1486,1487],{},"The system needs to decide:",[571,1489,1490,1493,1496,1499,1502],{},[574,1491,1492],{},"should the user be told they are interacting with AI?",[574,1494,1495],{},"should generated content be labelled?",[574,1497,1498],{},"should metadata be embedded?",[574,1500,1501],{},"should the disclosure be visible, machine-readable, or both?",[574,1503,1504],{},"should the label survive export, screenshot, copy/paste, download, or API transfer?",[532,1506,1507],{},"That means transparency must live in the product layer and artifact pipeline.",[924,1509,1510,1531,1554,1577],{},[927,1511,1514,1517,1520],{"icon":1512,"label":1513},"i-lucide-message-square","Interactive AI disclosure",[532,1515,1516],{},"When a user is interacting with an AI system, the UI may need a clear disclosure.",[532,1518,1519],{},"Engineering question:",[571,1521,1522,1525,1528],{},[574,1523,1524],{},"where is the disclosure rendered?",[574,1526,1527],{},"is it present in chat, embedded widgets, emails, and mobile views?",[574,1529,1530],{},"can downstream integrators remove it?",[927,1532,1535,1538,1540],{"icon":1533,"label":1534},"i-lucide-tags","Generated-content labelling",[532,1536,1537],{},"Generated or manipulated content may need labels.",[532,1539,1519],{},[571,1541,1542,1545,1548,1551],{},[574,1543,1544],{},"is the label visible?",[574,1546,1547],{},"is there metadata?",[574,1549,1550],{},"does the label persist through export?",[574,1552,1553],{},"how do edits change the label?",[927,1555,1558,1561,1563],{"icon":1556,"label":1557},"i-lucide-stamp","Watermarking / marking pipeline",[532,1559,1560],{},"If content marking is required, it must be part of the generation pipeline.",[532,1562,1519],{},[571,1564,1565,1568,1571,1574],{},[574,1566,1567],{},"what happens if marking fails?",[574,1569,1570],{},"do we block export?",[574,1572,1573],{},"do we fall back to visible labels?",[574,1575,1576],{},"is failure logged as a compliance event?",[927,1578,1581,1584,1586],{"icon":1579,"label":1580},"i-lucide-panels-top-left","Disclosure consistency",[532,1582,1583],{},"Disclosures must be consistent across surfaces.",[532,1585,1519],{},[571,1587,1588,1591,1594,1597],{},[574,1589,1590],{},"does web match mobile?",[574,1592,1593],{},"does API output include required metadata?",[574,1595,1596],{},"do generated files carry provenance?",[574,1598,1599],{},"do embeds and shares preserve the disclosure?",[744,1601,1602,1605],{},[532,1603,1604],{},"A disclosure that exists only in one UI component is not a compliance system.",[554,1606,1607],{},[532,1608,1609],{},"It is a styling accident.",[668,1611],{},[671,1613,1615],{"id":1614},"provenance-auditability-starts-at-generation-time","Provenance: auditability starts at generation time",[532,1617,1618],{},"You cannot reconstruct provenance after the fact.",[532,1620,1621],{},"You must capture it when the output is generated.",[532,1623,1624],{},"A useful provenance record includes:",[571,1626,1627,1630,1633,1636,1639,1642,1645,1648,1651,1654,1657,1660,1663],{},[574,1628,1629],{},"system ID",[574,1631,1632],{},"user / tenant",[574,1634,1635],{},"model provider",[574,1637,1638],{},"model version or alias",[574,1640,1641],{},"prompt template version",[574,1643,1644],{},"input data classes",[574,1646,1647],{},"retrieved sources",[574,1649,1650],{},"tools called",[574,1652,1653],{},"policy decisions",[574,1655,1656],{},"output hash",[574,1658,1659],{},"disclosure status",[574,1661,1662],{},"human review status",[574,1664,1665],{},"final action taken",[532,1667,1668],{},"Conceptually:",[1092,1670,1674],{"className":1671,"code":1672,"language":1673,"meta":1097,"style":1097},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"event_type\": \"ai_output_generated\",\n  \"ai_system_id\": \"support_reply_assistant\",\n  \"tenant_id\": \"acme-eu\",\n  \"model_route\": {\n    \"provider\": \"openai\",\n    \"model_alias\": \"support-prod\",\n    \"model_version\": \"pinned-2026-08-12\"\n  },\n  \"policy\": {\n    \"risk_tier\": \"transparency_sensitive\",\n    \"decision\": \"allow_with_disclosure\",\n    \"human_review\": \"required_before_send\"\n  },\n  \"inputs\": {\n    \"data_classes\": [\"support_ticket\", \"approved_kb\"],\n    \"retrieval_sources\": [\"kb:billing-refunds:v12\", \"kb:account-access:v4\"]\n  },\n  \"output\": {\n    \"hash\": \"sha256:...\",\n    \"content_type\": \"draft_reply\",\n    \"disclosure_applied\": true\n  }\n}\n","json",[1099,1675,1676,1681,1706,1725,1745,1759,1781,1801,1820,1825,1838,1857,1877,1894,1898,1911,1944,1976,1980,1993,2013,2033,2046,2051],{"__ignoreMap":1097},[1102,1677,1678],{"class":1104,"line":1105},[1102,1679,1680],{"class":1112},"{\n",[1102,1682,1683,1686,1690,1693,1695,1698,1701,1703],{"class":1104,"line":1120},[1102,1684,1685],{"class":1112},"  \"",[1102,1687,1689],{"class":1688},"spNyl","event_type",[1102,1691,1692],{"class":1112},"\"",[1102,1694,1113],{"class":1112},[1102,1696,1697],{"class":1112}," \"",[1102,1699,1700],{"class":1116},"ai_output_generated",[1102,1702,1692],{"class":1112},[1102,1704,1705],{"class":1112},",\n",[1102,1707,1708,1710,1712,1714,1716,1718,1721,1723],{"class":1104,"line":1131},[1102,1709,1685],{"class":1112},[1102,1711,1109],{"class":1688},[1102,1713,1692],{"class":1112},[1102,1715,1113],{"class":1112},[1102,1717,1697],{"class":1112},[1102,1719,1720],{"class":1116},"support_reply_assistant",[1102,1722,1692],{"class":1112},[1102,1724,1705],{"class":1112},[1102,1726,1727,1729,1732,1734,1736,1738,1741,1743],{"class":1104,"line":1142},[1102,1728,1685],{"class":1112},[1102,1730,1731],{"class":1688},"tenant_id",[1102,1733,1692],{"class":1112},[1102,1735,1113],{"class":1112},[1102,1737,1697],{"class":1112},[1102,1739,1740],{"class":1116},"acme-eu",[1102,1742,1692],{"class":1112},[1102,1744,1705],{"class":1112},[1102,1746,1747,1749,1752,1754,1756],{"class":1104,"line":1154},[1102,1748,1685],{"class":1112},[1102,1750,1751],{"class":1688},"model_route",[1102,1753,1692],{"class":1112},[1102,1755,1113],{"class":1112},[1102,1757,1758],{"class":1112}," {\n",[1102,1760,1761,1764,1768,1770,1772,1774,1777,1779],{"class":1104,"line":1164},[1102,1762,1763],{"class":1112},"    \"",[1102,1765,1767],{"class":1766},"sBMFI","provider",[1102,1769,1692],{"class":1112},[1102,1771,1113],{"class":1112},[1102,1773,1697],{"class":1112},[1102,1775,1776],{"class":1116},"openai",[1102,1778,1692],{"class":1112},[1102,1780,1705],{"class":1112},[1102,1782,1783,1785,1788,1790,1792,1794,1797,1799],{"class":1104,"line":1173},[1102,1784,1763],{"class":1112},[1102,1786,1787],{"class":1766},"model_alias",[1102,1789,1692],{"class":1112},[1102,1791,1113],{"class":1112},[1102,1793,1697],{"class":1112},[1102,1795,1796],{"class":1116},"support-prod",[1102,1798,1692],{"class":1112},[1102,1800,1705],{"class":1112},[1102,1802,1803,1805,1808,1810,1812,1814,1817],{"class":1104,"line":1187},[1102,1804,1763],{"class":1112},[1102,1806,1807],{"class":1766},"model_version",[1102,1809,1692],{"class":1112},[1102,1811,1113],{"class":1112},[1102,1813,1697],{"class":1112},[1102,1815,1816],{"class":1116},"pinned-2026-08-12",[1102,1818,1819],{"class":1112},"\"\n",[1102,1821,1822],{"class":1104,"line":1198},[1102,1823,1824],{"class":1112},"  },\n",[1102,1826,1827,1829,1832,1834,1836],{"class":1104,"line":1209},[1102,1828,1685],{"class":1112},[1102,1830,1831],{"class":1688},"policy",[1102,1833,1692],{"class":1112},[1102,1835,1113],{"class":1112},[1102,1837,1758],{"class":1112},[1102,1839,1840,1842,1844,1846,1848,1850,1853,1855],{"class":1104,"line":1217},[1102,1841,1763],{"class":1112},[1102,1843,1276],{"class":1766},[1102,1845,1692],{"class":1112},[1102,1847,1113],{"class":1112},[1102,1849,1697],{"class":1112},[1102,1851,1852],{"class":1116},"transparency_sensitive",[1102,1854,1692],{"class":1112},[1102,1856,1705],{"class":1112},[1102,1858,1859,1861,1864,1866,1868,1870,1873,1875],{"class":1104,"line":1225},[1102,1860,1763],{"class":1112},[1102,1862,1863],{"class":1766},"decision",[1102,1865,1692],{"class":1112},[1102,1867,1113],{"class":1112},[1102,1869,1697],{"class":1112},[1102,1871,1872],{"class":1116},"allow_with_disclosure",[1102,1874,1692],{"class":1112},[1102,1876,1705],{"class":1112},[1102,1878,1879,1881,1883,1885,1887,1889,1892],{"class":1104,"line":1233},[1102,1880,1763],{"class":1112},[1102,1882,1287],{"class":1766},[1102,1884,1692],{"class":1112},[1102,1886,1113],{"class":1112},[1102,1888,1697],{"class":1112},[1102,1890,1891],{"class":1116},"required_before_send",[1102,1893,1819],{"class":1112},[1102,1895,1896],{"class":1104,"line":1241},[1102,1897,1824],{"class":1112},[1102,1899,1900,1902,1905,1907,1909],{"class":1104,"line":1249},[1102,1901,1685],{"class":1112},[1102,1903,1904],{"class":1688},"inputs",[1102,1906,1692],{"class":1112},[1102,1908,1113],{"class":1112},[1102,1910,1758],{"class":1112},[1102,1912,1913,1915,1917,1919,1921,1924,1926,1929,1931,1934,1936,1939,1941],{"class":1104,"line":1257},[1102,1914,1763],{"class":1112},[1102,1916,1212],{"class":1766},[1102,1918,1692],{"class":1112},[1102,1920,1113],{"class":1112},[1102,1922,1923],{"class":1112}," [",[1102,1925,1692],{"class":1112},[1102,1927,1928],{"class":1116},"support_ticket",[1102,1930,1692],{"class":1112},[1102,1932,1933],{"class":1112},",",[1102,1935,1697],{"class":1112},[1102,1937,1938],{"class":1116},"approved_kb",[1102,1940,1692],{"class":1112},[1102,1942,1943],{"class":1112},"],\n",[1102,1945,1946,1948,1951,1953,1955,1957,1959,1962,1964,1966,1968,1971,1973],{"class":1104,"line":1265},[1102,1947,1763],{"class":1112},[1102,1949,1950],{"class":1766},"retrieval_sources",[1102,1952,1692],{"class":1112},[1102,1954,1113],{"class":1112},[1102,1956,1923],{"class":1112},[1102,1958,1692],{"class":1112},[1102,1960,1961],{"class":1116},"kb:billing-refunds:v12",[1102,1963,1692],{"class":1112},[1102,1965,1933],{"class":1112},[1102,1967,1697],{"class":1112},[1102,1969,1970],{"class":1116},"kb:account-access:v4",[1102,1972,1692],{"class":1112},[1102,1974,1975],{"class":1112},"]\n",[1102,1977,1978],{"class":1104,"line":1273},[1102,1979,1824],{"class":1112},[1102,1981,1982,1984,1987,1989,1991],{"class":1104,"line":1284},[1102,1983,1685],{"class":1112},[1102,1985,1986],{"class":1688},"output",[1102,1988,1692],{"class":1112},[1102,1990,1113],{"class":1112},[1102,1992,1758],{"class":1112},[1102,1994,1995,1997,2000,2002,2004,2006,2009,2011],{"class":1104,"line":1295},[1102,1996,1763],{"class":1112},[1102,1998,1999],{"class":1766},"hash",[1102,2001,1692],{"class":1112},[1102,2003,1113],{"class":1112},[1102,2005,1697],{"class":1112},[1102,2007,2008],{"class":1116},"sha256:...",[1102,2010,1692],{"class":1112},[1102,2012,1705],{"class":1112},[1102,2014,2015,2017,2020,2022,2024,2026,2029,2031],{"class":1104,"line":1303},[1102,2016,1763],{"class":1112},[1102,2018,2019],{"class":1766},"content_type",[1102,2021,1692],{"class":1112},[1102,2023,1113],{"class":1112},[1102,2025,1697],{"class":1112},[1102,2027,2028],{"class":1116},"draft_reply",[1102,2030,1692],{"class":1112},[1102,2032,1705],{"class":1112},[1102,2034,2035,2037,2040,2042,2044],{"class":1104,"line":1314},[1102,2036,1763],{"class":1112},[1102,2038,2039],{"class":1766},"disclosure_applied",[1102,2041,1692],{"class":1112},[1102,2043,1113],{"class":1112},[1102,2045,1151],{"class":1112},[1102,2047,2048],{"class":1104,"line":1325},[1102,2049,2050],{"class":1112},"  }\n",[1102,2052,2053],{"class":1104,"line":1333},[1102,2054,2055],{"class":1112},"}\n",[532,2057,2058],{},"The point is not the exact schema.",[532,2060,2061],{},"The point is the invariant:",[554,2063,2064],{},[532,2065,2066],{},"every meaningful AI output should be traceable to the system, model, policy, context, and controls that produced it.",[668,2068],{},[671,2070,2072],{"id":2071},"runtime-policy-gates-compliance-as-code","Runtime policy gates: compliance as code",[532,2074,2075],{},"The policy engine is where “we should not do that” becomes enforceable.",[532,2077,2078],{},"A compliance-aware runtime gate can decide:",[571,2080,2081,2084,2087,2090,2093,2096,2099,2102,2105,2108],{},[574,2082,2083],{},"allow",[574,2085,2086],{},"deny",[574,2088,2089],{},"redact",[574,2091,2092],{},"require disclosure",[574,2094,2095],{},"require human review",[574,2097,2098],{},"route to approved model",[574,2100,2101],{},"disable tools",[574,2103,2104],{},"block export",[574,2106,2107],{},"log at higher detail",[574,2109,2110],{},"escalate to compliance/security",[2112,2113,2115,2120,2123,2143,2147,2150,2164,2168,2171,2184,2188,2191,2211,2214,2218],"steps",{"level":2114},"3",[2116,2117,2119],"h3",{"id":2118},"classify-the-request","Classify the request",[532,2121,2122],{},"Determine:",[571,2124,2125,2128,2131,2134,2137,2140],{},[574,2126,2127],{},"use case",[574,2129,2130],{},"data class",[574,2132,2133],{},"user jurisdiction",[574,2135,2136],{},"output type",[574,2138,2139],{},"tool/action intent",[574,2141,2142],{},"risk tier",[2116,2144,2146],{"id":2145},"check-model-eligibility","Check model eligibility",[532,2148,2149],{},"Ask:",[571,2151,2152,2155,2158,2161],{},[574,2153,2154],{},"is this provider allowed?",[574,2156,2157],{},"is this model approved for the use case?",[574,2159,2160],{},"does data residency apply?",[574,2162,2163],{},"is the model version pinned or allowed to auto-upgrade?",[2116,2165,2167],{"id":2166},"apply-transparency-rules","Apply transparency rules",[532,2169,2170],{},"Decide:",[571,2172,2173,2176,2179,2181],{},[574,2174,2175],{},"does the user need a disclosure?",[574,2177,2178],{},"should the output be labelled?",[574,2180,1498],{},[574,2182,2183],{},"should generated content export be blocked if marking fails?",[2116,2185,2187],{"id":2186},"gate-side-effects","Gate side effects",[532,2189,2190],{},"If the AI triggers tools:",[571,2192,2193,2196,2199,2202,2205,2208],{},[574,2194,2195],{},"writes",[574,2197,2198],{},"sends",[574,2200,2201],{},"publishes",[574,2203,2204],{},"exports",[574,2206,2207],{},"modifies accounts",[574,2209,2210],{},"changes records",[532,2212,2213],{},"…then compliance and security policies must be checked together.",[2116,2215,2217],{"id":2216},"emit-an-audit-packet","Emit an audit packet",[532,2219,2220],{},"Record the decision before returning the output or executing the action.",[1349,2222,2223,2226],{},[532,2224,2225],{},"Policies that cannot execute at runtime are aspirations.",[554,2227,2228],{},[532,2229,2230],{},"Policies wired into routers, tool gateways, and renderers are controls.",[668,2232],{},[671,2234,2236],{"id":2235},"vendor-governance-you-need-evidence-from-the-model-supply-chain","Vendor governance: you need evidence from the model supply chain",[532,2238,2239],{},"Most companies do not train their own frontier models.",[532,2241,2242],{},"They depend on vendors.",[532,2244,2245],{},"So compliance architecture must include a vendor evidence pipeline.",[532,2247,2248],{},"The questions are predictable:",[571,2250,2251,2254,2257,2260,2263,2266,2269,2272,2275,2278],{},[574,2252,2253],{},"which provider supplies the model?",[574,2255,2256],{},"what documentation is available?",[574,2258,2259],{},"what model/system cards exist?",[574,2261,2262],{},"what transparency support is provided?",[574,2264,2265],{},"what data-processing terms apply?",[574,2267,2268],{},"what regions are supported?",[574,2270,2271],{},"what logging / retention options exist?",[574,2273,2274],{},"what safety evals and incident processes are documented?",[574,2276,2277],{},"how are model updates announced?",[574,2279,2280],{},"can versions be pinned or rolled back?",[629,2282,2283,2290,2297,2304],{},[632,2284,2287],{"icon":2285,"title":2286},"i-lucide-file-badge","Provider evidence",[532,2288,2289],{},"Model documentation, eval summaries, data-processing terms, transparency support.",[632,2291,2294],{"icon":2292,"title":2293},"i-lucide-git-commit","Version control",[532,2295,2296],{},"Pinned aliases, change logs, upgrade notices, rollback paths, deprecation windows.",[632,2298,2301],{"icon":2299,"title":2300},"i-lucide-database-zap","Data controls",[532,2302,2303],{},"Retention, training opt-out, region, access controls, and logging settings.",[632,2305,2308],{"icon":2306,"title":2307},"i-lucide-siren","Incident interface",[532,2309,2310],{},"How vendors report safety/security incidents, model regressions, and policy changes.",[744,2312,2313,2316],{},[532,2314,2315],{},"A vendor “approved” once is not approved forever.",[554,2317,2318],{},[532,2319,2320],{},"Model providers are moving systems.\nYour governance needs change detection.",[668,2322],{},[671,2324,2326],{"id":2325},"ai-generated-content-marking-is-a-pipeline-not-a-checkbox","AI-generated content: marking is a pipeline, not a checkbox",[532,2328,2329],{},"The transparency story became very visible in August because generated content labelling and watermarking moved from theory to implementation detail.",[532,2331,2332],{},"This matters because generated media flows through many surfaces:",[571,2334,2335,2338,2341,2344,2347,2350,2353,2356,2359],{},[574,2336,2337],{},"image editor",[574,2339,2340],{},"document editor",[574,2342,2343],{},"CMS",[574,2345,2346],{},"social post tool",[574,2348,2349],{},"email builder",[574,2351,2352],{},"export service",[574,2354,2355],{},"CDN",[574,2357,2358],{},"archive",[574,2360,2361],{},"analytics pipeline",[532,2363,2364],{},"A label that exists only at creation time may disappear later.",[532,2366,2367],{},"So the architecture needs a content lifecycle.",[2112,2369,2370,2374,2377,2381,2384,2388,2391,2395,2398,2402,2405],{"level":2114},[2116,2371,2373],{"id":2372},"mark-at-generation","Mark at generation",[532,2375,2376],{},"Apply visible labels and/or metadata as required by policy.",[2116,2378,2380],{"id":2379},"preserve-through-transformation","Preserve through transformation",[532,2382,2383],{},"If the user crops, resizes, translates, compresses, or edits, decide whether provenance persists.",[2116,2385,2387],{"id":2386},"preserve-through-export","Preserve through export",[532,2389,2390],{},"Downloaded files, API responses, and CMS assets should carry required disclosure metadata where feasible.",[2116,2392,2394],{"id":2393},"log-marking-failures","Log marking failures",[532,2396,2397],{},"If metadata embedding fails, log it.\nFor high-risk content, block export or require visible fallback labelling.",[2116,2399,2401],{"id":2400},"support-audit-and-user-explanation","Support audit and user explanation",[532,2403,2404],{},"Users and reviewers should be able to ask:",[571,2406,2407,2410,2413,2416],{},[574,2408,2409],{},"was this generated by AI?",[574,2411,2412],{},"which system generated it?",[574,2414,2415],{},"when?",[574,2417,2418],{},"was it edited later?",[868,2420,2421,2424],{},[532,2422,2423],{},"Generated-content transparency is not only an AI problem.",[554,2425,2426],{},[532,2427,2428],{},"It is an asset-management problem.",[668,2430],{},[671,2432,2434],{"id":2433},"what-to-measure","What to measure",[532,2436,2437],{},"Compliance needs dashboards too.",[532,2439,2440],{},"Not because dashboards solve compliance.",[532,2442,2443],{},"Because invisible compliance drift is how systems fail quietly.",[629,2445,2446,2452,2458,2464],{},[632,2447,2449],{"icon":993,"title":2448},"Inventory coverage",[532,2450,2451],{},"Known AI systems vs discovered usage; owners assigned; stale entries; unknown model calls.",[632,2453,2455],{"icon":1007,"title":2454},"Policy decisions",[532,2456,2457],{},"Allowed, denied, redacted, disclosure-required, human-review-required, escalation events.",[632,2459,2461],{"icon":950,"title":2460},"Transparency health",[532,2462,2463],{},"Disclosure render rate, marking success rate, export preservation, label removal attempts.",[632,2465,2468],{"icon":2466,"title":2467},"i-lucide-search-check","Audit readiness",[532,2469,2470],{},"Can you reconstruct model, data, sources, output, policy, approval, and action for sampled events?",[532,2472,2473],{},"A useful operational metric:",[554,2475,2476],{},[532,2477,2478],{},[541,2479,2480],{},"audit reconstruction success rate",[532,2482,2483],{},"Pick a random AI-generated output and ask:",[571,2485,2486,2489,2492,2495,2498,2501,2504,2507,2510],{},[574,2487,2488],{},"what system created this?",[574,2490,2491],{},"which model/version?",[574,2493,2494],{},"what prompt template?",[574,2496,2497],{},"what data class?",[574,2499,2500],{},"what sources?",[574,2502,2503],{},"what policy decision?",[574,2505,2506],{},"was disclosure applied?",[574,2508,2509],{},"who approved it?",[574,2511,2512],{},"what action followed?",[532,2514,2515],{},"If the answer is “we’re not sure,” you don’t have an audit trail.",[532,2517,2518],{},"You have logs.",[532,2520,2521],{},"There is a difference.",[668,2523],{},[671,2525,2527],{"id":2526},"failure-modes-i-expect-after-the-ai-act-gets-real","Failure modes I expect after the AI Act gets real",[532,2529,2530],{},"This is where engineering teams will feel the pain.",[924,2532,2533,2549,2562,2575,2588,2601],{},[927,2534,2537,2543],{"icon":2535,"label":2536},"i-lucide-circle-help","Failure: shadow AI inventory",[532,2538,2539,2542],{},[541,2540,2541],{},"Symptom:"," teams use AI tools or APIs that are not in the official system inventory.",[532,2544,2545,2548],{},[541,2546,2547],{},"Fix:"," network discovery, vendor reviews, procurement controls, SDK wrappers, and periodic owner attestations.",[927,2550,2552,2557],{"icon":2535,"label":2551},"Failure: disclosure drift",[532,2553,2554,2556],{},[541,2555,2541],{}," disclosure exists in the main web app but disappears in mobile, email, exports, embedded widgets, or API responses.",[532,2558,2559,2561],{},[541,2560,2547],{}," central transparency renderer and disclosure tests per surface.",[927,2563,2565,2570],{"icon":2535,"label":2564},"Failure: model-version ambiguity",[532,2566,2567,2569],{},[541,2568,2541],{}," an output is challenged, but nobody knows which model version produced it.",[532,2571,2572,2574],{},[541,2573,2547],{}," pinned aliases, model-route logging, output hashes, and provider change notifications.",[927,2576,2578,2583],{"icon":2535,"label":2577},"Failure: audit logs without context",[532,2579,2580,2582],{},[541,2581,2541],{}," logs show a request happened, but not the data class, policy decision, retrieved sources, or approval state.",[532,2584,2585,2587],{},[541,2586,2547],{}," structured provenance events, not plain text logs.",[927,2589,2591,2596],{"icon":2535,"label":2590},"Failure: generated-content labels get stripped",[532,2592,2593,2595],{},[541,2594,2541],{}," images, audio, video, or text leave the system without required labels or metadata.",[532,2597,2598,2600],{},[541,2599,2547],{}," marking at generation, validation at export, and fallback visible labelling.",[927,2602,2604,2609],{"icon":2535,"label":2603},"Failure: compliance blocks shipping entirely",[532,2605,2606,2608],{},[541,2607,2541],{}," every AI change waits on manual review because controls are not automated.",[532,2610,2611,2613],{},[541,2612,2547],{}," encode low-risk approvals into policy gates; reserve humans for high-risk and ambiguous cases.",[668,2615],{},[671,2617,2619],{"id":2618},"the-implementation-blueprint","The implementation blueprint",[532,2621,2622],{},"Here is the order I would build this in a real organization.",[2112,2624,2625,2629,2632,2655,2659,2662,2665,2669,2672,2688,2692,2695,2698,2720,2724,2727,2731,2734,2738,2741,2744,2748],{"level":2114},[2116,2626,2628],{"id":2627},"_1-create-the-ai-system-inventory","1) Create the AI system inventory",[532,2630,2631],{},"Start with a pragmatic registry:",[571,2633,2634,2636,2639,2641,2643,2646,2649,2652],{},[574,2635,1123],{},[574,2637,2638],{},"purpose",[574,2640,1635],{},[574,2642,2142],{},[574,2644,2645],{},"user-facing status",[574,2647,2648],{},"tools/actions",[574,2650,2651],{},"data classes",[574,2653,2654],{},"rollout status",[2116,2656,2658],{"id":2657},"_2-force-all-model-calls-through-approved-adapters","2) Force all model calls through approved adapters",[532,2660,2661],{},"No direct vendor SDK calls from random services.",[532,2663,2664],{},"Use a gateway/router that can log, classify, enforce budgets, and apply policy.",[2116,2666,2668],{"id":2667},"_3-add-runtime-classification","3) Add runtime classification",[532,2670,2671],{},"Classify:",[571,2673,2674,2676,2678,2680,2683,2686],{},[574,2675,2127],{},[574,2677,2130],{},[574,2679,2136],{},[574,2681,2682],{},"jurisdiction / region",[574,2684,2685],{},"action intent",[574,2687,2142],{},[2116,2689,2691],{"id":2690},"_4-add-transparency-rendering","4) Add transparency rendering",[532,2693,2694],{},"Centralize user-facing disclosures and generated-content labelling.",[532,2696,2697],{},"Test across:",[571,2699,2700,2703,2706,2709,2712,2715,2717],{},[574,2701,2702],{},"web",[574,2704,2705],{},"mobile",[574,2707,2708],{},"email",[574,2710,2711],{},"API",[574,2713,2714],{},"export",[574,2716,2343],{},[574,2718,2719],{},"shared assets",[2116,2721,2723],{"id":2722},"_5-add-provenance-events","5) Add provenance events",[532,2725,2726],{},"Emit structured events for model calls, retrieval, outputs, policy decisions, and actions.",[2116,2728,2730],{"id":2729},"_6-add-vendor-evidence-tracking","6) Add vendor evidence tracking",[532,2732,2733],{},"Store provider documentation, versions, policy changes, model cards, eval reports, and contractual controls.",[2116,2735,2737],{"id":2736},"_7-add-audit-sampling","7) Add audit sampling",[532,2739,2740],{},"Regularly sample outputs and reconstruct the full chain.",[532,2742,2743],{},"Treat reconstruction failure as a production bug.",[2116,2745,2747],{"id":2746},"_8-add-rollback-and-disable-paths","8) Add rollback and disable paths",[532,2749,2750],{},"Feature flags, model alias rollback, route disable, content export block, and tool-gateway shutdown.",[1349,2752,2753,2756],{},[532,2754,2755],{},"The winning implementation strategy is boring:",[554,2757,2758],{},[532,2759,2760],{},"centralize the path, structure the events, automate the obvious gates, and keep humans for the irreversible decisions.",[668,2762],{},[671,2764,2766],{"id":2765},"how-this-connects-to-the-rest-of-2026","How this connects to the rest of 2026",[532,2768,2769],{},"This month does not replace the earlier architecture lessons.",[532,2771,2772],{},"It depends on them.",[571,2774,2775,2778,2781,2784,2787],{},[574,2776,2777],{},"March taught that agents need identity and kill switches.",[574,2779,2780],{},"April taught that model routing is an operational control plane.",[574,2782,2783],{},"June taught that frontier model releases need staged governance.",[574,2785,2786],{},"July taught that autonomous systems need containment and incident response.",[574,2788,2789],{},"August turns those into compliance architecture.",[532,2791,2792],{},"The pattern is now obvious:",[554,2794,2795],{},[532,2796,2797],{},"AI governance only works when it is wired into the runtime.",[532,2799,2800],{},"Not stapled onto the launch review.",[668,2802],{},[671,2804,2806],{"id":2805},"august-takeaway","August takeaway",[532,2808,2809],{},"Compliance is not the enemy of AI engineering.",[532,2811,2812],{},"Bad compliance is.",[532,2814,2815],{},"Good compliance is a system property:",[571,2817,2818,2821,2824,2827,2830,2833,2836,2839],{},[574,2819,2820],{},"known inventory",[574,2822,2823],{},"clear ownership",[574,2825,2826],{},"executable policy",[574,2828,2829],{},"traceable outputs",[574,2831,2832],{},"explicit disclosures",[574,2834,2835],{},"auditable evidence",[574,2837,2838],{},"controlled rollout",[574,2840,2841],{},"fast revocation",[632,2843,2844,2847],{"icon":662,"title":2806},[532,2845,2846],{},"AI compliance has become runtime architecture.",[532,2848,2849,2850],{},"The durable pattern is:\n",[541,2851,2852],{},"inventory → classify → route → disclose → log → prove → review → rollback.",[668,2854],{},[671,2856,2858],{"id":2857},"resources","Resources",[629,2860,2861,2869,2876,2883,2890,2898],{},[632,2862,2866],{"icon":634,"title":2863,"target":2864,"to":2865},"European Commission — AI Act enforcement starts","_blank","https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august",[532,2867,2868],{},"The Commission’s announcement that AI Act enforcement and new transparency requirements began from 2 August 2026.",[632,2870,2873],{"icon":2535,"title":2871,"target":2864,"to":2872},"AI Act Service Desk — enforcement timing","https://ai-act-service-desk.ec.europa.eu/en/ai-act/faq/when-does-enforcement-start",[532,2874,2875],{},"A clear FAQ on which enforcement powers and obligations apply from 2 August 2026.",[632,2877,2880],{"icon":950,"title":2878,"target":2864,"to":2879},"European Commission — transparency guidelines","https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems",[532,2881,2882],{},"Guidelines for providers and deployers on transparency obligations for certain AI systems.",[632,2884,2887],{"icon":929,"title":2885,"target":2864,"to":2886},"European Commission — GPAI provider guidelines","https://digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers",[532,2888,2889],{},"Guidance on the scope of obligations for providers of general-purpose AI models.",[632,2891,2895],{"icon":2892,"title":2893,"target":2864,"to":2894},"i-lucide-newspaper","Axios — Europe’s AI Act gets real","https://www.axios.com/2026/08/28/eu-ai-act-gets-real",[532,2896,2897],{},"Late-August coverage framing the AI Act as an operational reality for companies shipping AI.",[632,2899,2902],{"icon":1556,"title":2900,"target":2864,"to":2901},"European Commission — AI-generated content labelling","https://digital-strategy.ec.europa.eu/en/news/commission-publishes-code-practice-marking-and-labelling-ai-generated-content",[532,2903,2904],{},"A practical Code of Practice reference for marking and labelling AI-generated content.",[668,2906],{},[671,2908,2910],{"id":2909},"faq","FAQ",[924,2912,2913,2948,2971,3000,3009],{},[927,2914,2916,2919,2922,2925,2945],{"icon":2535,"label":2915},"Is this article saying engineers need to become lawyers?",[532,2917,2918],{},"No.",[532,2920,2921],{},"Engineers do not need to interpret every legal nuance alone.",[532,2923,2924],{},"But engineers do need to build systems that can:",[571,2926,2927,2930,2933,2936,2939,2942],{},[574,2928,2929],{},"inventory AI usage",[574,2931,2932],{},"enforce runtime policies",[574,2934,2935],{},"apply disclosures",[574,2937,2938],{},"preserve provenance",[574,2940,2941],{},"produce audit evidence",[574,2943,2944],{},"and disable risky behavior quickly",[532,2946,2947],{},"Legal defines obligations.\nArchitecture makes them real.",[927,2949,2951,2954,2968],{"icon":2535,"label":2950},"What is the smallest useful compliance control plane?",[532,2952,2953],{},"Start with four pieces:",[679,2955,2956,2959,2962,2965],{},[574,2957,2958],{},"AI system inventory",[574,2960,2961],{},"model gateway/router",[574,2963,2964],{},"structured provenance logs",[574,2966,2967],{},"transparency/disclosure renderer",[532,2969,2970],{},"That alone gives you visibility, enforceability, and auditability.",[927,2972,2974,2977,2980,2997],{"icon":2535,"label":2973},"Do small teams need this?",[532,2975,2976],{},"Small teams need the lightweight version.",[532,2978,2979],{},"At minimum:",[571,2981,2982,2985,2988,2991,2994],{},[574,2983,2984],{},"know which AI systems exist",[574,2986,2987],{},"route model calls through one path",[574,2989,2990],{},"log model/version/output metadata",[574,2992,2993],{},"disclose AI interaction where required",[574,2995,2996],{},"keep a manual review path for high-impact workflows",[532,2998,2999],{},"The architecture can be simple.\nThe discipline cannot be absent.",[927,3001,3003,3006],{"icon":2535,"label":3002},"What is the biggest mistake teams will make?",[532,3004,3005],{},"Treating compliance as documentation instead of runtime behavior.",[532,3007,3008],{},"If a policy is not connected to routing, logging, disclosure, and tool permissions, it will drift from production.",[927,3010,3012,3015,3018,3041],{"icon":2535,"label":3011},"How does this relate to model routers?",[532,3013,3014],{},"A model router chooses where a request runs.",[532,3016,3017],{},"A compliance control plane tells the router what is allowed:",[571,3019,3020,3023,3026,3029,3032,3035,3038],{},[574,3021,3022],{},"which model",[574,3024,3025],{},"which vendor",[574,3027,3028],{},"which region",[574,3030,3031],{},"which tools",[574,3033,3034],{},"which disclosure",[574,3036,3037],{},"which logging level",[574,3039,3040],{},"which human review state",[532,3042,3043],{},"They should be designed together.",[3045,3046,3047],"style",{},"html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":1097,"searchDepth":1120,"depth":1120,"links":3049},[3050,3051,3052,3053,3054,3055,3056,3057,3058,3059,3066,3067,3074,3075,3076,3086,3087,3088,3089],{"id":673,"depth":1120,"text":674},{"id":758,"depth":1120,"text":759},{"id":821,"depth":1120,"text":822},{"id":921,"depth":1120,"text":922},{"id":973,"depth":1120,"text":974},{"id":1042,"depth":1120,"text":1043},{"id":1363,"depth":1120,"text":1364},{"id":1477,"depth":1120,"text":1478},{"id":1614,"depth":1120,"text":1615},{"id":2071,"depth":1120,"text":2072,"children":3060},[3061,3062,3063,3064,3065],{"id":2118,"depth":1131,"text":2119},{"id":2145,"depth":1131,"text":2146},{"id":2166,"depth":1131,"text":2167},{"id":2186,"depth":1131,"text":2187},{"id":2216,"depth":1131,"text":2217},{"id":2235,"depth":1120,"text":2236},{"id":2325,"depth":1120,"text":2326,"children":3068},[3069,3070,3071,3072,3073],{"id":2372,"depth":1131,"text":2373},{"id":2379,"depth":1131,"text":2380},{"id":2386,"depth":1131,"text":2387},{"id":2393,"depth":1131,"text":2394},{"id":2400,"depth":1131,"text":2401},{"id":2433,"depth":1120,"text":2434},{"id":2526,"depth":1120,"text":2527},{"id":2618,"depth":1120,"text":2619,"children":3077},[3078,3079,3080,3081,3082,3083,3084,3085],{"id":2627,"depth":1131,"text":2628},{"id":2657,"depth":1131,"text":2658},{"id":2667,"depth":1131,"text":2668},{"id":2690,"depth":1131,"text":2691},{"id":2722,"depth":1131,"text":2723},{"id":2729,"depth":1131,"text":2730},{"id":2736,"depth":1131,"text":2737},{"id":2746,"depth":1131,"text":2747},{"id":2765,"depth":1120,"text":2766},{"id":2805,"depth":1120,"text":2806},{"id":2857,"depth":1120,"text":2858},{"id":2909,"depth":1120,"text":2910},"2026-08-30T00:00:00.000Z","After the EU AI Act started enforcing GPAI and transparency obligations, compliance stopped being a PDF exercise and became a production system. This post explains the architecture - model inventory, runtime policy gates, provenance, disclosures, audit logs, vendor evidence, and rollback.","md","blog/2026/ai-compliance-becomes-runtime-architecture-gpai-transparency-auditability.avif",{"slug":3095},"ai-compliance-becomes-runtime-architecture-gpai-transparency-auditability",true,{"title":34,"description":3091},{"loc":35,"images":3099},[3100],{"loc":988},"nE2KFhCfQENWUhY9Od-4OJq2PLv-25USvlEOSaQzQto",[3103,3104],null,{"title":502,"path":503,"stem":504,"description":3105,"children":-1},"The July 2026 rogue-agent incident turned AI containment from a whiteboard concern into an incident-response problem. This post explains how to design containment, monitoring, kill switches, and forensics for autonomous agents that can operate at cyber speed.",1788280920166]