Assurance and Adoption
What turns the domains into a program: the gate that decides whether an agent reaches production, how an incident is handled, what is reported, what to ask a vendor, and where this maps onto existing standards.
The Production Readiness Gate
A pass-or-fail gate across nine control groups. Partial satisfaction is failure.
Exceptions and Compensating Controls
When a control cannot be met: what qualifies, what compensates, and the controls that admit no exception.
Incident Response for Agent-Driven Events
What changes when the incident moves at machine speed: containment, forensics without a hosted model, and four rehearsal scenarios.
Metrics and Board Reporting
The coverage, efficacy, detection, response and governance metrics to report — human and non-human identity separately.
Procurement Question Bank
Twenty-six questions to ask any vendor supplying agents or agentic features. The vague answer is itself the finding.
Standards Crosswalk
The ten domains mapped to OWASP ASI 2026, NIST AI RMF, ISO/IEC 42001 and the EU AI Act.
Implementation Roadmap
A sequenced program from the first thirty days to month twelve, ordered by leverage rather than by tidiness.