// writing

Blog

Notes on AI governance, evidence and software supply chain security. Mostly about the same stubborn question from different directions — how you prove what a system did, to somebody who was not there and has no reason to take your word for it.

Diagram of four agent tool calls passing down into a harness layer that wraps the model block, with the harness stopping one call before it runs.

2026-09-14

The layer above the model — ASD says security lives in the harness

The Australian Signals Directorate's executive guide, "Agentic AI Harnesses," names the harness — the software layer around the model — as where agentic-AI security must be applied, because the deepest weakness cannot be fixed in the model itself. MoorAI is a runtime control at that layer, and this post maps it to ASD's guidance without inflating it: strong on privilege and behavioural risk, tool and connector validation; partial by design on accountability, since content-free logging keeps categories and hashes rather than verbatim text; and an honest gap on design-time review, cascade tracing, sandboxing and model provenance. A government framework read straight, with the unflattering parts left in — and no claim that ASD endorses anything.

Diagram of an agentic application as an attack graph, with an exploited path from prompt to tool to data highlighted and a guardrail node cutting the final edge before exfiltration.

2026-09-13

Agentic apps are attack graphs — and the guardrail is the missing node

ATAG, from Ben-Gurion University, models an AI-agent application as a formal attack graph — and its own rule for a prompt-injection attack fires only when the agent lacks an input-sanitization guardrail. In attack-graph logic that means adding a boundary guardrail node removes edges from the graph: the chain stops one node short. MoorAI is a concrete such node — a content-free control on the prompt, file, output, index, session and tool boundaries that both ATAG case studies propagate through. A reading of independent academic work, with the distinction kept honest: ATAG is design-time assessment, MoorAI is runtime enforcement, and the two have no relationship beyond arriving at the same interception point.

Six-row vendor scorecard with pass, fail and partial marks, and a magnifying glass showing one claim split into the part that was measured and the part that was only claimed.

2026-09-06

How to choose your agentic security vendor

The buyer's guide to this category: six questions that separate a measured claim from a decorated one, each with the weak answer, the good answer and how to verify it instead of trusting it — which set, would it have worked with the product off, detection or prevention, where the false-positive line sits, how much the model would have refused alone, and whether the detector is called by the shipping product at all. Then our own answers to all six, printed with the unflattering ones: 86.4% on a locked held-out set, 3.32% false positives on 602 benign prompts, and 20 of the 21 attacks the model does not refuse on its own — measured against a baseline where it refuses 52.3% of the corpus without us. Plus a one-page scorecard to take into the demo.

Dot diagram of 44 attacks: 23 stop at the model's own refusal, 20 of the remaining 21 stop at the action layer, and one gets past both.

2026-09-06

MoorAI, graded against AMTSO's agentic testing guidelines

The headline results, and the full benchmark as a downloadable report. Of the 21 attacks the model does not refuse unaided, MoorAI catches 20 — 95.2% of the gap, with 1 of 44 left past both layers and 97.7% combined. 38/44 on a locked held-out set at 100% precision, 12/12 malicious tool calls stopped at the action layer under an enforcing policy on Claude Code, 3.32% false positives on 602 benign prompts with 269 hard negatives, and 624 attack samples spread across all five AMTSO vectors. The per-vector scores, the four policy postures, the refusal chain and the limits are in the PDF.