Writing on behavioral drift in AI agents, agent governance and the evidence regulated companies are going to be asked for.https://kyde.comenhttps://kyde.com/behavioral-drifthttps://kyde.com/behavioral-driftBehavioral drift is not a single, well-defined phenomenon. At least seven related ways agent behavior can change, our synthesis rather than an established taxonomy: drift can be inherited between agents, agents can stop before the work is done, and reward hacking is related but different. Which signals are visible in production logs, at what cost, and where the evidence is still missing.Sat, 05 Sep 2026 00:00:00 GMTResearchNotehttps://kyde.com/blog/confidence-infrastructure-part-1https://kyde.com/blog/confidence-infrastructure-part-1Every transformative technology earns trust the same way: through the confidence infrastructure that grows around it. Hartford Steam Boiler, Lloyd's aviation pools, usage-based auto insurance, and what this means for autonomous AI agents.Mon, 29 Jun 2026 00:00:00 GMTEssayInsurancePart I of IIIhttps://kyde.com/blog/confidence-infrastructure-part-2https://kyde.com/blog/confidence-infrastructure-part-2Three EU frameworks, EU AI Act, PLD 2024, DORA, have assigned liability for AI agent failures. The DRCF 'Many Hands' problem, AIUC-1's temporal limits, and the four evidence requirements (complete, continuous, independent, tamper-evident) that liability adjudication actually requires.Mon, 29 Jun 2026 00:00:00 GMTEssayRegulatoryPart II of IIIhttps://kyde.com/blog/confidence-infrastructure-part-3https://kyde.com/blog/confidence-infrastructure-part-3Usage-based auto insurance replaced proxies with real behavioral data. AI agent insurance will follow. This essay examines the technical architecture of continuous behavioral monitoring: Ed25519 signing, hash chaining, WORM storage, behavioral baselines, and why independence from the monitored system is non-negotiable.Mon, 29 Jun 2026 00:00:00 GMTEssayTechnicalPart III of IIIhttps://kyde.com/blog/nist-critical-infrastructure-ai-convergencehttps://kyde.com/blog/nist-critical-infrastructure-ai-convergenceNIST, the EU AI Act, and NIS-2 were developed independently, in different jurisdictions, over different timelines. They are converging on the same answer: traceable identity, causal context capture, tamper-evident records, in a governance layer independent of the agents it governs.Sun, 17 May 2026 00:00:00 GMTRegulatoryStrategichttps://kyde.com/blog/drcf-agentic-ai-foresighthttps://kyde.com/blog/drcf-agentic-ai-foresightThe UK's Digital Regulation Cooperation Forum, CMA, FCA, ICO, and Ofcom, co-signed a foresight paper on agentic AI. The core message: 'my agent did it' is not a defense. Organizational accountability is unchanged regardless of agent autonomy. Here are the seven risks, the 'Many Hands' problem, and what to do before enforcement begins.Sat, 02 May 2026 00:00:00 GMTRegulatoryhttps://kyde.com/blog/agent-goal-hijackinghttps://kyde.com/blog/agent-goal-hijackingOWASP ranks Agent Goal Hijacking ASI01, the #1 risk facing autonomous AI agents. 48% of security professionals name agentic AI as the top attack vector for 2026. Classical security tools are blind to it. Here is how it works, why it evades detection, and what forensic infrastructure is actually required.Sat, 02 May 2026 00:00:00 GMTSecurityhttps://kyde.com/blog/eu-ai-act-omnibus-collapsehttps://kyde.com/blog/eu-ai-act-omnibus-collapseThe Digital Omnibus trilogue collapsed on 28 April 2026, then reached preliminary agreement on May 7: Annex III enforcement moved to December 2, 2027. What the collapse looked like from the inside, and why the obligations were delayed, not softened.Sat, 02 May 2026 00:00:00 GMTRegulatoryhttps://kyde.com/blog/ai-governance-three-categorieshttps://kyde.com/blog/ai-governance-three-categoriesCISOs and compliance teams are evaluating products that all describe themselves as 'AI governance', but solve fundamentally different problems. This article defines the three distinct categories, maps them to regulatory requirements, and identifies where each falls short.Fri, 24 Apr 2026 00:00:00 GMTReferencehttps://kyde.com/blog/nobody-governs-the-chainhttps://kyde.com/blog/nobody-governs-the-chainMicrosoft has a governance story. Google has a governance story. Every major platform vendor is building agent governance, for the agents that run inside their own stack. Nobody is building governance for what happens between stacks. That gap is not an oversight. It is where most of the risk lives.Thu, 23 Apr 2026 00:00:00 GMTStrategichttps://kyde.com/blog/employees-using-ai-shadowhttps://kyde.com/blog/employees-using-ai-shadow78% of AI users bring their own tools to work. Your employees are not waiting for your AI strategy. They already have one, and the data they're processing with it isn't yours to govern yet.Thu, 26 Mar 2026 00:00:00 GMTSecurityhttps://kyde.com/blog/mcp-changes-ai-governancehttps://kyde.com/blog/mcp-changes-ai-governanceMCP lets AI agents connect directly to enterprise systems, bypassing the application layer that was always the implicit governance control point. The app layer doesn't get rebuilt. It gets bypassed. Something needs to replace the control point it represented.Wed, 25 Mar 2026 00:00:00 GMTTechnicalStrategichttps://kyde.com/blog/compromised-agent-no-logshttps://kyde.com/blog/compromised-agent-no-logsForcedLeak demonstrated prompt injection against production enterprise agents in 2025. The most important question it raises isn't technical, it's operational. If this happened in your environment, would you know?Wed, 25 Mar 2026 00:00:00 GMTSecurityhttps://kyde.com/blog/shadow-ai-production-systemshttps://kyde.com/blog/shadow-ai-production-systemsShadow AI is the same problem as Shadow IT, at a different order of magnitude. Every LLM call that touches enterprise data without logging, attribution, or scope is a liability accumulating in silence.Wed, 25 Mar 2026 00:00:00 GMTSecurityhttps://kyde.com/blog/missing-layer-agent-architecturehttps://kyde.com/blog/missing-layer-agent-architectureThe distinction between agent core and agent harness cuts to the heart of what most enterprise deployments get wrong. Single-user architecture breaks at scale in four predictable ways. The harness isn't an add-on, for enterprise, it's the product.Wed, 25 Mar 2026 00:00:00 GMTTechnicalhttps://kyde.com/blog/hbr-ai-agents-infrastructurehttps://kyde.com/blog/hbr-ai-agents-infrastructureHarvard Business Review identified four frictions that derail enterprise AI agent deployments: identity, context, control, and accountability. The article stops short of specifying what the infrastructure layer looks like. That's what we build.Wed, 25 Mar 2026 00:00:00 GMTThought Leadershiphttps://kyde.com/blog/dora-ai-agentshttps://kyde.com/blog/dora-ai-agentsDORA is already in force. Financial entities using AI agents for operational functions have a specific problem: vendor-provided logs don't constitute an independent audit trail. Here's why, and what does.Wed, 25 Mar 2026 00:00:00 GMTRegulatoryhttps://kyde.com/blog/eu-ai-act-audit-trailshttps://kyde.com/blog/eu-ai-act-audit-trailsThe enforcement deadline is December 2, 2027. Most enterprises assume their LLM provider's logs will be sufficient. They won't be. Here's what the regulation actually demands, and where the gaps are.Wed, 25 Mar 2026 00:00:00 GMTRegulatory