Governance & privacy7 MIN READ
Permission-aware retrieval: the control most RAG diagrams omit
A retrieval system should establish the active principal and filter authorised resources before similarity ranking or model context assembly.
THE SOFTLANDER BLOG
Governable agents
Evidence, privacy and oversight practices for keeping agentic systems accountable as they change.
In Governable agents
10 articlesGovernance & privacy7 MIN READ
What should trigger an agent governance review?
Review should follow material changes in purpose, authority, data, users, dependencies, evidence or incidents—not an arbitrary calendar alone.
Governance & privacy7 MIN READ
You cannot govern AI systems you have not inventoried
An AI inventory becomes useful when it identifies deployed systems, their context, owners, dependencies and review triggers—not merely a list of model vendors.
Governance & privacy7 MIN READ
Can your agent truly forget?
Deleting a chat is not the same as removing personal data from memory, retrieval, logs, caches, evaluations, backups and learned models.
Governance & privacy7 MIN READ
Human oversight is a designed control, not a person watching a screen
Effective oversight gives a prepared person the signal, authority, time and interface needed to prevent or limit a defined AI failure.
Governance & privacy6 MIN READ
What a technical AI privacy review can—and cannot—conclude
A technical review can trace data and test controls, but it cannot alone determine lawful basis, resolve policy choices or certify compliance.
Governance & privacy7 MIN READ
A useful autonomy classification starts with consequences
Classify an AI agent by what it can affect, the authority it can exercise and how quickly people can recover—not by how autonomous a demo appears.
Governance & privacy7 MIN READ
How to build an evidence register for an AI system
An evidence register should connect each claim and requirement to versioned artefacts, review decisions, known gaps and the conditions under which evidence expires.
Governance & privacy7 MIN READ
Data minimisation for agents that always want more context
Better agent context is not the largest possible context. It is the smallest authorised, relevant and timely data set that supports the task.
Governance & privacy7 MIN READ
Turning AI governance principles into executable controls
A principle becomes operational only when it is translated into requirements, control owners, enforcement points, evidence and responses to failure.
KEEP EXPLORING
Take the thinking
into your next discussion.
Read the method, assumptions and questions to ask.