Loading…
28 articles from Crelis on Observability. Most recent: “How Long Should Audit Logs Be Kept? How the Number Is Actually Chosen”.
Retention should start with the evidence the organisation may need to produce, not with a platform default.
A practical policy separates agent proposals from permission, names approval states, tests material changes, and keeps evidence for disputed actions.
AI model risk management for Singapore banks is an evidence problem, especially when agents can act at runtime.
AI agents can help compliance teams search, compare, draft and route, but verification is not sign-off and evidence must attach to the action.
Agentic AI controls are the limits, checks, approvals, and records that decide what an agent may do before it changes money, data, access, or records.
Agent security maps help only if they lead to evidence for the permission behind a consequential action.
NIST's agent standards work matters, but it does not prove that a payment release, deleted record, or changed credit limit was authorised.
MCP server guidance can reduce unsafe calls, but the audit problem is proving who authorised the action before money, records, or tools changed.
Entry-tier tracing plans keep traces for days or weeks, while a Singapore capital markets services licence holder must keep the books the Securities and Futures Act requires for not less than five yea
Dynatrace found that nearly half of organizations discard log data, excluding an average of 86% of it. Tamper-evident AI audit logs turn passive monitoring into proof of authorized execution.
Understanding a model's logic is not a legal defence. The industry is moving from model explainability to verifiable proof of what an agent actually did.
In a high-stakes clinical environment, an AI's output is a mere proposal until a human grants the permission to execute.
ClearPoint found that only 14.7% of AI-related metrics have a named owner. That structural void leaves autonomous agents operating without a definitive chain of command.
Traditional policy frameworks cannot govern non-deterministic agentic systems. Paper-based compliance is dead, and selecting the right AI compliance platform is now a matter of legal survival.
Intelligence isn't authority. A model's capacity to act matters less than your ability to prove why it acted — and what the record has to contain to do that.
The "black box" is not a legal defense. It's a confession of technical negligence. As the EU AI Act transparency obligations take effect on August 2, 2026, the era of blaming the algorithm has ended.
The era of "move fast and break things" has ended at the regulatory border. Every autonomous decision your system makes is a potential point of failure without a verifiable trail. You know that retros
Autonomous agents can make decisions that a legal team may struggle to defend. Speed is a poor substitute for security. Non-deterministic systems carry inherent risk.
The EU AI Act's high-risk obligations were deferred to 2 December 2027 by the Digital Omnibus. That is preparation time, not a reprieve, and most organizations are not using it.
Grant Thornton found that just 18% of banking leaders were fully confident they could pass an independent review of their AI controls in the next 90 days.
The moment an autonomous agent executes a six-figure transfer without explicit human authorization, the technology ceases to be an asset. It becomes a liability. Most enterprises currently operate in
Retool's 2026 survey found 22% of organizations had a production incident caused by an AI-generated internal tool, and 51% could not say for certain either way. That is the liability gap.
Theatrical oversight is the greatest hidden liability in your AI stack. Most governance processes are performances: they leave no evidence that a human ever meaningfully engaged.
From 2 December 2027 the EU AI Act's obligations for standalone high-risk systems begin to apply. "Best effort" AI compliance is running out of road.
The gap between an AI's proposal and an enterprise's permission is where catastrophic liability lives. Trust is a systemic vulnerability. You recognize that LLM agents exhibit unpredictable emergent b
A standard text file is not an audit trail; it is a liability. A log entry reading "Task Completed" offers no protection when an autonomous agent executes a flawed transaction.
Your autonomous agents are executing transactions and data decisions that your legal department cannot defend in a court of law. The Liability Gap is an active operational vulnerability.
Security decides what an AI agent is able to do; governance decides who is answerable for what it did — and only one of them leaves you evidence.