GRCIDE — Insights https://grcide.com/insights Reading notes, commentary and practice notes from the editors on AI, security practice, regulation and audit, and the craft of the work. en Mon, 07 Sep 2026 00:00:00 +0000 For a bank's security AI, high risk begins where it can change state https://grcide.com/insights/security-ai-high-risk-changes-state https://grcide.com/insights/security-ai-high-risk-changes-state Mon, 07 Sep 2026 00:00:00 +0000 An article reading China's AI guidance for banks and insurers puts the grading line at whether a security system can act, not at whether it touches money. Article 5 on 2 December 2026: the check a security function runs on its own tooling https://grcide.com/insights/ai-act-article-5-december https://grcide.com/insights/ai-act-article-5-december Sun, 06 Sep 2026 00:00:00 +0000 The prohibited-practice list reads as a product problem. A security function's own tooling touches three of its points, and two more start in December. The AI bill of materials is the next SBOM https://grcide.com/insights/ai-bom-is-the-next-sbom https://grcide.com/insights/ai-bom-is-the-next-sbom Sun, 06 Sep 2026 00:00:00 +0000 Three articles in one issue argue that the supply chain is now four chains. The bill of materials that stops at code no longer describes what ships. When agents deal with each other, the object is the connection https://grcide.com/insights/multi-agent-governance-is-the-connection https://grcide.com/insights/multi-agent-governance-is-the-connection Sun, 06 Sep 2026 00:00:00 +0000 An Australian government report moves the governance object from the single agent to the relationship between them. The stop-point sits where control ends. Agent governance is a permissions problem before it is a model problem https://grcide.com/insights/agent-governance-is-a-permissions-problem https://grcide.com/insights/agent-governance-is-a-permissions-problem Sat, 05 Sep 2026 00:00:00 +0000 Singapore's advisory on the OpenClaw agent platform moves AI risk from what a model says to what an agent can do. The controls it lists are identity controls. The permissions review that did not happen https://grcide.com/insights/agent-permissions-review https://grcide.com/insights/agent-permissions-review Sat, 05 Sep 2026 00:00:00 +0000 An agent reaches production on its installer's identity, holding every tool that person held. This is the review that should have run first. CRA in fifteen months: what to do first https://grcide.com/insights/cra-what-to-do-first https://grcide.com/insights/cra-what-to-do-first Sat, 05 Sep 2026 00:00:00 +0000 Article 14 starts in September 2026 and the essential requirements in December 2027. The first quarter is three decisions, not a compliance programme. Open-source risk is a maintainer problem, not a CVE count https://grcide.com/insights/open-source-risk-is-a-maintainer-problem https://grcide.com/insights/open-source-risk-is-a-maintainer-problem Sat, 05 Sep 2026 00:00:00 +0000 A Chinese-language piece argues that open-source risk lives in maintainers and funding, not in CVE queues. We agree, and add the control it implies. The board question is not the CVE count https://grcide.com/insights/the-board-question-is-not-the-cve-count https://grcide.com/insights/the-board-question-is-not-the-cve-count Sat, 05 Sep 2026 00:00:00 +0000 A vendor piece uses Anthropic's Mythos findings to argue that boards should hear attack paths and expected loss, not patch rates. Half of it holds.