AI Security & Control Architecture | Creator of the ACR Standard

AI governance must translate into controls that hold when systems act. I work on the architecture that connects policy, identity, and human authority to decisions made at runtime.

My work focuses on translating governance requirements into operational controls, with particular emphasis on AI security and runtime enforcement.

• Runtime AI governance — control planes that evaluate and enforce policy at execution time
• Agentic AI control — containment architectures, limits on an agent’s scope of action, and human authority checkpoints
• Enterprise security programs — leadership across security engineering, security operations, exposure management, and AI governance

I created the ACR Standard, an open-source specification for runtime control of agentic AI. It defines an architecture in which protected AI actions pass through a control plane that evaluates identity, purpose, policy, risk, and human authority before execution.

The standard is organized around six pillars:

1. Identity and purpose binding
2. Behavioral policy enforcement
3. Autonomy drift detection
4. Execution observability
5. Self-healing and containment
6. Human authority

Start here: Explore the ACR reference implementation to understand the control-plane architecture and its implementation.

The specification: Read the ACR Standard.

• Books — three published books on cybersecurity and AI governance, including The ABCs of Agentic AI
• Toolkit — the free ACR Governance Toolkit: maturity assessment, agent risk classification, and incident response testing

CISSP · C-CISO · CAISS · TAISE · CCSK · CEH
MS Cybersecurity (Cyber Operations) · BS Computer Science

Governance should be explicit, enforceable, and observable.