Watch a governed agent stop a breach
A bank's support agent runs one task. A prompt injection hidden in a customer's document tries to exfiltrate data and move money. Run it with governance on and the controls catch it. Flip governance off and the same run ends in a breach. The seven controls are the seven domains from the framework, operating in real time. Nothing here calls a model or a server.
A demonstration, not a product: the scenario is scripted and the bank and customer are fictional. The seven controls are the same ones an engagement implements, made visible. The seven map to the control crosswalk and the readiness assessment.
The seven controls, and what each one stops
In the scenario, a customer's dispute letter hides an instruction telling the bank's support agent to send account data to an outside address and move money. With governance on, these seven controls operate in real time, the attack is caught, and every step is logged. With governance off, the same run ends in a data breach and an unauthorized transfer. They are the same seven control domains an engagement implements.
- Identity & Access: Scoped non-human identity, least privilege.
- Human Oversight: Approval gate on consequential actions.
- Tool / MCP Allowlist: Deny-by-default, prompt injection caught.
- Audit Trail: Append-only, tamper-evident reasoning log.
- Incident Response: Kill switch on anomalous behavior.
- Bias & Fairness: Decisions checked for disparate treatment.
- Regulatory Alignment: PII tagged to SOC 2 / GLBA, retained.
Seen what the controls stop? The Expert Readiness Assessment scores your own controls against evidence and turns the gaps into a roadmap you can defend.
Book a conversation →