Where control lives
Six kinds of product sit between an application and a model, and each arrived carrying its first buyer's concerns. One post per position, one request walked past each of them, and what that position can actually do to it.
Where control lives · 1
Where AI governance came from
The discipline was built to govern models you build and approve: an inventory, a validation, documentation, a gate before deployment. On 2 August 2026 the EU deferred every obligation of that shape and left standing the one that can only be discharged while somebody is using the thing.
Where control lives · 2
Policy, enforcement and evidence
Policy decides what should be true. Evidence shows afterwards that it was. Something has to make it true while the request is in flight, and in most programmes nothing on the path does.
Where control lives · 3
Who is on the request path
Six kinds of product sit on the path between your application and a model. This series takes them one at a time and asks the same question of each. While it holds the connection, what can it do, and whose record is it?
Where control lives · 4
Buying models through a marketplace
Three teams already have OpenRouter keys on their expense reports. Where did those prompts go, what is the retention, and whose record is it? A marketplace sits where the provider sits, so its own pages hold the answer to the first two and it keeps the third itself.
Where control lives · 5
Proxies and the unified API
One API for every provider is a good trade until somebody asks what the provider actually received. A proxy that parses your request into its own shape and writes it back cannot answer, because what survives is whatever that shape knew about the week it was written.
Where control lives · 6
Response caching
A response cache in front of the model saves the whole call, including the part where something decided about it. Caching belongs where the model's own cache is, and a gateway earns the provider's discount by leaving the bytes alone.
Where control lives · 7
API gateways with AI plugins
The gateway you already run terminates TLS, holds the routes and has an on-call rota. Keep it. Its vocabulary is routes and headers, so every AI plugin it grows ends in a call out to something that can read a body.
Where control lives · 8
The cloud's own AI services
Bedrock Guardrails, Azure's API Management and Google's Model Armor are excellent inside the account that runs them. The record they keep lands in that account too, under its IAM, which decides what a verifier outside the account can establish.
Where control lives · 9
Calling a detector
Presidio, Lakera, Prisma AIRS, Guardrails AI, NeMo. A gateway can call any of them, and what comes back is a verdict about the string it handed over. Deciding on that verdict is still the job of whatever holds the connection.
Where control lives · 10
Governance platforms
Credo AI, Holistic AI, IBM's watsonx.governance and OneTrust own the policy document and the evidence binder. Neither can produce evidence of a call it did not witness, so the runtime that did witness it has to hand over a record the platform can rely on without relying on the runtime.
Where control lives · 11
Comparing the six positions
Ten posts, six positions, one question each, on one figure. Three questions you can ask any vendor on it, and the answer each of them gives back, including us.
What reaches the model
A prompt is assembled at runtime out of a conversation, a record lookup and a tool result. What arrives in it, who wrote each part, and what a detector can and cannot tell you about any of it.
What reaches the model · 1
The tool result is the channel
An agent reads mail, documents, web pages and tool output. Prompt injection arrives in any of them from an attacker who is not the user. Direct injection comes from the user turn, indirect injection from a tool result. pistra reads both.
What reaches the model · 2
Nine ways to phrase an override
A field guide to the nine pattern families an injection is written in, one fresh example each, and why a classifier trained on some phrasings misses the others.
What reaches the model · 3
Injection, jailbreak, harmful
Three classes of text a deployment has to tell apart, and three different answers. A classifier trained on one class fires on another, and one MultiJail prompt shows how.
What reaches the model · 4
Safety is measured in English
Harmful requests in low-resource languages get unsafe answers more often because alignment data is English, and the guards built to stop them share the same defect from the same root.
What reaches the model · 5
Classifier or judge
A classifier learns one question over a training set. A judge reads policy in prose and decides on exactly what the attacker sent. Each one is bad at something different, and which you use depends on what you are trying to stop.
What reaches the model · 6
An evaluation set in a language with none
No public Arabic prompt-injection set exists, so recall on Arabic attacks is unmeasured. pistra is building one with parallel pairs so the verdict can be compared across languages, hard negatives that outnumber attacks, and an origin tag on every row.
Governance in practice
One written control at a time, from the obligation as an auditor states it to the rule that discharges it on a live request.
Governance in practice · 1
Personal data in a prompt
Asked what personal data leaves the company, a code review cannot answer, because a prompt is assembled at runtime out of a conversation, a record lookup and a tool result. The request itself is where the question has an answer.
Governance in practice · 2
Every operator breaks a tool call
A redaction operator is chosen per rule, and the choice trades what the model can work with against what a tool downstream can work with. Realism is where the trade breaks.
Measured, not asserted
How the numbers on this site are produced: what the harness runs, what a measurement has to carry before it counts, and the results that went the wrong way.
Measured, not asserted · 1
Why the number comes from the binary
A checkpoint's card reports precision on the checkpoint. What enforces is that checkpoint behind a tokenizer, a window scheme, a decoder and a threshold. One rule about where a word ends, in the last of those, took a score from 0.57 to 1.00 with the model byte for byte unchanged.
Measured, not asserted · 2
Read invariance with recall in the other hand
Some metrics reach their best value as a detector fires less, so a detector that answers nothing scores perfectly on them. Invariance is one. So is a false-positive rate, an agreement score, and a benchmark holding no positive cases. Each is read beside the number that breaks the silence.