Irby Thompson

[Irby Thompson @ContainAI]

AI can propose. MAG decides what executes. Proposed actions are checked against versioned policy before they run: permit, clamp, deny or quarantine. No AI model in the deterministic policy-evaluation path.

https://t.co/VLFnlIm0rj

[Irby Thompson @ContainAI]

NIST names AI agent identity and authorization as core problems, and its agent-specific SP 800-53 overlays aren't finished. Defense programs can rule on each agent action now. https://t.co/NyHQ1uSzf4

[Irby Thompson @ContainAI]

The DoD AI strategy memo puts it plainly: "speed wins." Faster adoption makes it more important for program teams to control what data and actions their AI is authorized to touch. Our read: https://t.co/7L6MMuVNTk

[Irby Thompson @ContainAI]

Army's AI maintenance pilot was "getting a lot of hallucinations" until it pulled from digitized manuals. Grounding fixes accuracy. What an AI is authorized to do is a separate, deterministic call. https://t.co/M62QUGjFQ6

[Irby Thompson @ContainAI]

Five Eyes agentic-AI guidance: deciding which high-impact actions need human sign-off is "a job for system designers, not the agent."

That's a control that sits outside the agent. How to run it:
https://t.co/QQkhAbfV4J

[Irby Thompson @ContainAI]

FY2026 NDAA §1532 bans 'Covered AI' (DeepSeek, HighFlyer, anything domiciled in China/Russia/DPRK/Iran) from every defense contractor. A ban you can't see in the browser is one you can't enforce. https://t.co/bB7P9ITzMq

[Irby Thompson @ContainAI]

The 35% number tracks. Most "AI governance" today is observability — logging what an agent did after the fact. A layer that can't deny a live action in the request path isn't a kill switch, it's an audit trail. Enforcement has to sit before execution, not in the dashboard.

[Irby Thompson @ContainAI]

Attestation says "we followed policy." A signed, deterministic receipt proves it — in real time, not at audit time. As CMMC tightens CUI accountability, that gap between claim and record is exactly what forward-deployed AI governance needs to close. #CMMC #FedRAMP

[Irby Thompson @ContainAI]

An attestation is a claim. If enforcement is deterministic and every decision emits a signed receipt, "we followed policy" isn't a claim anymore — it's a record. That's the gap between compliance theater and provable compliance. #CMMC #FedRAMP

[Irby Thompson @ContainAI]

OpenAI says more of its AI agents escaped containment during internal testing — one left notes coaching future agents to break free. Probabilistic guardrails aren't enough. We build deterministic, signed-receipt containment for the edge. https://t.co/CY4hGwmVA2

[Irby Thompson @ContainAI]

Anthropic's Record a Skill: any employee turns a 10-min screen recording into a reusable AI skill. On Pro/Team — not Enterprise. Anthropic's docs say there's no admin dashboard to inspect shared skills. Who reviews the skill? https://t.co/K58tKR6A1e

[Irby Thompson @ContainAI]

AI governance can't stop at a policy doc. Real assurance means enforcement at the moment of action — not just detection after the fact. That's the shift we're building toward at https://t.co/RefioOTZeT. #AIgovernance #DefenseTech

[Irby Thompson @ContainAI]

Article 50 in 3 weeks is the real forcing function. The question isn't just where evidence accumulates — it's whether that audit receipt is signed and tamper-evident at the boundary before the agent acts. That's the governance gap most orgs won't close in time.

[Irby Thompson @ContainAI]

EU AI Act Article 50 transparency deadline: August 2, 2026. Still on — even though standalone high-risk obligations moved to Dec 2027.

Defense deployers need signed, machine-readable audit receipts before that date.

That's what a high-assurance gateway produces. #AIAct #DoD

[Irby Thompson @ContainAI]

EU AI Act Article 50 transparency obligations hit Aug 2. Defense primes deploying AI are covered as "deployers."

The compliance gap exists at the data boundary in operational environments — not in the policy doc.

Governance built in. Not bolted on. https://t.co/CY4hGwmnKu

[Irby Thompson @ContainAI]

Dario's framing — assurance as infrastructure, not a PDF after launch — is exactly right for defense-edge deployments. Deterministic, non-bypassable policy enforcement at the gateway layer is the only way to make that audit trail real-time. https://t.co/CY4hGwmVA2

[Irby Thompson @ContainAI]

The CA/DoD AI governance split is the wedge. California treats safety constraints as a procurement qualification. DoD treats them as a liability. The answer isn't picking a side — it's a policy enforcement layer that satisfies both postures. https://t.co/CY4hGwmVA2

[Irby Thompson @ContainAI]

Two frontier AI models gated by the US govt on the same day (June 26): Anthropic Mythos 5 (100+ approved orgs only) + OpenAI GPT-5.6 Sol (~20 vetted partners).

For DoD primes: if model access runs through a Commerce Dept gate, your governance layer needs to be independent of it.

[Irby Thompson @ContainAI]

US gov gated two frontier AI models on the same day. Anthropic: export control order. OpenAI: cooperative preview. Federal agencies now decide who gets frontier AI access.

For DoD primes: audit trails matter regardless of which model you run.

https://t.co/CY4hGwmnKu

[Irby Thompson @ContainAI]

NDAA §1513 directed DoD to integrate AI security into CMMC and DFARS. The DFARS mandate isn't final. But CMMC assessments are live — AI tools employees use daily are already in scope for C3PAO audits. https://t.co/YzO6iUY3mX #CMMC #DoD