Book

Compliance, governance, and accountability for teams building agentic AI systems.

Platform Agentic

Access the book — sign in with Google·LinkedIn

Introduction

  1. 1.
    Why Compliance Changes When Agents Act
    What makes autonomous agents different — and why existing compliance frameworks were not designed for them.
    1523 words · 8 min

Part 1 — For the Business

The Landscape

  1. 2.
    Know Your Risk Level
    How to classify your agents by risk — and how that classification shapes AI Act obligations and governance priorities.
    2066 words · 10 min
  2. 3.
    Vendor and Model Governance
    Your compliance obligations extend to every vendor in the agent's chain — including your model provider. What BAAs, DPAs, and vendor assessments look like when the vendor is an LLM.
    3376 words · 17 min

Your Obligations

  1. 4.
    Transparency and the Right to Know
    What users, regulators, and auditors must be able to see — and why no framework tolerates a black box acting on real data with real consequences.
    2414 words · 12 min
  2. 5.
    Data Rights and Minimisation
    Why agents that fetch broad context "because it might be useful" are a liability — and what GDPR, HIPAA, and PCI-DSS all say about it.
    2399 words · 12 min
  3. 6.
    Audit, Evidence, and Accountability
    The log is the evidence — what every framework requires you to record, who must own it, and why "the model decided" is never a sufficient answer.
    2911 words · 15 min

From Understanding to Action

  1. 7.
    The Five Principles
    Across every framework, five obligations keep reappearing. Get these right and you are most of the way there — regardless of which regulations apply to you.
    1204 words · 6 min
  2. 8.
    Your Governance Roadmap
    A practical five-step starting point for business teams who need to move from understanding to action — and know exactly what to do on Monday morning.
    1783 words · 9 min

Part 2 — For the Developer

Design Time

  1. 9.
    The Architecture of a Compliant Agent
    A shared blueprint — components, data flows, and trust boundaries every compliant agent system must define.
    2509 words · 13 min
  2. 10.
    Risk Classification and System Boundaries
    How to define and enforce the boundaries of what your agent system is — and what it is not allowed to become.
    2154 words · 11 min
  3. 11.
    Identity, Access, and Authorization
    How to design agent identity, scope permissions, and enforce access control across systems and users.
    1562 words · 8 min
  4. 12.
    What Agents Are Allowed to Do — Permission Models and Action Boundaries
    Designing the action layer — what agents can call, write, send, and execute, and how to enforce those limits.
    1514 words · 8 min
  5. 13.
    Securing the Model Layer
    Prompt injection, hallucination, and non-determinism — compliance risks unique to LLM-based agents and how to mitigate them.
    1641 words · 8 min

Runtime

  1. 14.
    Audit Trails and Explainability
    Building logs that satisfy auditors — what to capture, how to structure it, and how to make agent decisions explainable.
    1683 words · 8 min
  2. 15.
    Data Handling — Retention, Minimization, Encryption
    How agents must handle data in motion and at rest — what to keep, what to drop, and how to protect it.
    1485 words · 7 min
  3. 16.
    Human-in-the-Loop — When Agents Must Stop and Ask
    Designing escalation and approval flows — the engineering patterns that keep humans appropriately in control.
    2017 words · 10 min
  4. 17.
    Testing, Validation, and Ongoing Monitoring
    Evals, regression testing, and production monitoring — building the discipline that compliance requires over time.
    2161 words · 11 min
  5. 18.
    Incident Response for Agentic Systems
    What to do when an agent does something wrong — detection, containment, root cause, and regulatory notification.
    2109 words · 11 min

Conclusion

  1. 19.
    The Compliant Agent is the Better Agent
    Why the practices this book describes don't just satisfy regulators — they produce more reliable, more trustworthy, and more debuggable systems.
    2559 words · 13 min