Halo blog
Field guides for governing AI at work
New every Tuesday. Practical writing on shadow AI, agent security, MCP, compliance evidence, and keeping AI spend efficient.
Build AI budgets that follow the owner
AI budgets work when each agent has an owner, thresholds trigger clear actions, and exceptions leave a record. See how account and per-agent budgets fit together.
Read articleWho reviews the governance assistant?
Assistants that draft governance work need provenance, permission boundaries, and an accountable human decision. Learn how to review their suggestions before anything is approved.
Read articleWhat ISO/IEC 42001 asks of your AI software
ISO/IEC 42001 sets requirements for an organization's AI management system. Learn what auditors may ask of your AI tools and what evidence software can supply for that system.
Read articleHow to evaluate an AI governance platform in one workflow
Use one realistic workflow to test discovery, policy, approval, failure behavior, and evidence. This run sheet works for any AI governance platform, including Halo.
Read articleHow to respond to an AI agent incident
When an agent misbehaves, the steps are contain, preserve evidence, revoke credentials, review, and recover. Here is a plan you can rehearse before you need it.
Read articleWhen should an AI system be reviewed again?
A review records a decision under particular conditions. Learn which changes should reopen it, how to scope the work, and how to keep both decisions on the record.
Read articleHow to roll out AI controls without surprising your teams
Start in observe mode, move to warn, then enforce. Measure false positives, communicate each change, and keep a path back so the teams you govern keep trusting the controls.
Read articleAI cost estimates need a coverage label
Before an AI spend number guides investment, label what it covers, how it was priced, and what it leaves out. Learn how to reconcile estimates with provider bills.
Read articleNIST AI RMF, from framework to runtime evidence
The NIST AI RMF organizes work into Govern, Map, Measure, and Manage. See how each function connects to operational controls and to runtime evidence a reviewer can inspect.
Read articleWhat happens when an AI control goes offline?
AI controls depend on other systems. Map the dependencies, choose failure behavior by action, and test outages with synthetic data before production decides for you.
Read articleWhat is an AI bill of materials, and who uses it?
An AI bill of materials lists the models, tools, data sources, and services behind your AI. See what it holds, how CycloneDX fits, and how security, procurement, and audit use it.
Read articleA practical checklist for MCP governance
Follow one agent tool call from server inventory to authorization, approval, execution, and evidence with this seven-step MCP governance checklist for security teams.
Read articleSmart model routing that keeps governance intact
Cost-aware routing can match each workload to an approved model that fits its cost, quality, and policy needs. Here is how to pursue that savings potential and keep control.
Read articleAn agent's permission is only the start of the decision
A valid credential shows what an agent may request. Learn how purpose, scope, arguments, and approval shape whether one specific action should run.
Read articleBrowser AI needs its own governance model
Browser AI spans websites, extensions, uploads, and pastes. A workable governance model uses audit, warn, and block modes, domain rules, and clear privacy boundaries.
Read articleConnecting AI spend to AI value
A token-cost dashboard shows where the money goes. Learn how to connect AI spend to owners, outcomes, cost boundaries, and honest assumptions before you scale.
Read articleThe EU AI Act timeline, translated for governance teams
The EU AI Act phases in over several years. See what each date means as a decision your team makes and a record you keep, and confirm the current official timeline first.
Read articleWhat should an AI audit log contain?
A useful AI audit log lets a reviewer reconstruct a consequential decision. Learn which fields to record, how to handle prompt content, and how to test the result.
Read articleGive AI agents identities you can revoke
Agents that borrow a person's login or a shared service account leave reviewers guessing. Give each agent its own identity, scoped credentials, and a path to revocation.
Read articleA policy is only useful if you can show where it runs
Turn an AI policy into a testable rule, name the point where it runs, and keep the evidence. This guide shows how to check each step before you enforce anything.
Read articleMCP security from server inventory to runtime enforcement
MCP servers behave like a supply chain. Learn how to inventory them, authorize them, scope their credentials, apply tool-call policy, and keep evidence reviewers can use.
Read articleYour AI inventory is a moving target
An AI inventory is only as useful as its coverage and freshness. Learn how to record where you looked, when you last looked, and which changes need a new decision.
Read articleWhy shadow AI discovery has to reach browsers and endpoints
Gateway and network logs miss local apps, browser extensions, IDE tools, and local runtimes. See how metadata-first discovery on browsers and endpoints closes the gap.
Read articleWhat is an AI governance platform?
An AI governance platform connects AI inventory, decisions, runtime controls, and evidence for each system. Learn what it does and how to test one with a real use case.
Read article24 articles published since May 2026
Put a halo around the AI your business runs.
See discovery, runtime policy, approvals, and evidence working together on your own use cases.