A framework for governing the AI agents you already run in regulated enterprises
For CISOs, CIOs, VP Engineering, and Enterprise Architects
"Your employees are already using AI agents. You just don't know which ones, with what data, at what cost, and at what risk."
The architectural foundations covered in this Blueprint
Cryptographic agent identity. SPIFFE, Verifiable Credentials, JWT-SVIDs.
Per-tool-call policy checks. Default deny. Policy coverage for the tools your teams actually use. TBAC.
Mathematical proof of compliance. Multi-LLM cross-checking. Execution certificates.
Append-only logging with hash-chain integrity. SIEM export. Retention up to 7 years.
Cross-org agent collaboration. SPIFFE trust bundles. MLS encryption (RFC 9420).
Read online for free. Each chapter stands alone. Start anywhere.
Why 2026 is different. The Shadow AI crisis. Why policy documents fail. The governance gap.
5 levels from Ad-hoc to Industrial. Self-assessment matrix. Common transition patterns.
Identity, Authorization, Verification, Audit, Federation. Standards landscape. Implementation checklists.
EU AI Act, GDPR, HIPAA, SOX, DORA, NIS2 — mapped to agent-specific controls. Auditor-ready tables.
LLM Gateway pipeline. Cascading governance. Envelope encryption. Kill switch hierarchy.
Phase 0-4 roadmap. Role-by-role guidance (CISO, CIO, Platform Team, Business Owner).
MCP, A2A, SLIM, OASF, AI Card. How they compose. Interoperability matrix.
Build vs. buy. TCO analysis. Vendor evaluation (40 questions). Risk matrix.
All 8 chapters in one document. Print-ready A4 format. No watermarks. Share with your team.
MeetLoyd governs the agent estate you already have. The Shadow AI Scan maps it from the logs you already keep — every agent, every tool, every data path.