ShrikeLearn
Reference guides on governing AI agents. Written to be useful whether or not you ever use Shrike, and to say plainly where each control stops.
The argument in order: what the term means, what safety means once an agent can act, when it starts applying to you, and what the policy you declare looks like once it does.
What Is Action Governance?
The canonical definition, how it differs from prompt scanning, and why an agent cannot govern itself.
OutcomeWhat Is Agent Safety?
How the word changes once the agent can act, and how safety, security and governance each describe the same system.
ThresholdWhen Does an AI Agent Need Governance?
The five changes in a codebase that create the need, and why governance is missing by default.
The policyHow Are AI Agent Policies Written?
The three shapes a policy takes, who writes each, what it can see, how a change reaches a running agent, and which kind of limit to ask about.
Reference material you can check your own deployment against, with the gaps printed rather than hidden.
The 14 Governance Surfaces of an AI Agent
Every surface where an agent touches the world, what goes wrong on each, and the verdict that fits it.
Market mapThe AI Agent Security Stack
The control layers, what each one can and cannot do, and the downloadable control matrix.
CoverageThe 17 Agentic Attack Techniques
The published threat taxonomy mapped to inline controls, including the techniques nothing inline can catch.
MethodologyWhat Do Agent Benchmarks Actually Measure?
Which of the 14 surfaces public benchmarks exercise, why authorization is unmeasurable on corpora that declare no scope, and five questions to ask of any detection number.
DefinitionWhat Is Super Intelligence (SI)?
The federal rename of AI, quoted from the order, and why it points at the existing statutory definition rather than a capability threshold.
MethodologyCan You Audit an AI System Without Access to the Model?
What is auditable at the action boundary, why a training evaluation is not evidence, and six things an auditor can ask for without model access.
Where the general picture meets a particular technology you are probably already running.
What Is MCP Security?
Tool poisoning, rug pulls, and shadowing, and the controls that govern them.
ArchitectureWhat Is an MCP Gateway?
What a gateway centralises, what it cannot see, and where policy has to sit instead.
Local modelsSelf-Hosted LLM Security: The Two Halves
Harden the serving engine, then govern the agent behind it. A local model ships with no guardrails at all.
Every control an agent runs behind has an edge. These name where credential scoping, identity, and human approval each stop, and what sits in the gap the next control has to cover.
Four Approaches to Governing an AI Agent
Credential scoping, rule engines, design-time allowlists, and action-time adjudication: what each decides, and where each one stops.
IdentityWhat Is a Non-Human Identity?
The credential an agent authenticates with and the OWASP NHI Top 10. Identity answers who is calling, not whether the call is the one the caller should be making.
OversightWhat Is Approval Fatigue?
Why a human-in-the-loop degrades into a rubber stamp, why approving everything is the wrong fix, and what precision keeps the prompt worth reading.
HooksHow Do Claude Code Hooks Work?
What a hook can decide, rewrite and add to context, which of the thirty-odd events are worth wiring, and which hook output the model actually reads.
Looking for implementation rather than concepts? The documentation covers setup, the SDKs, and scope declaration. Narrative pieces and incident write-ups live on the blog.