Security & compliance
When an agent touches production, “we trust it” is not a control.
Regulators and auditors no longer ask whether you use AI — they ask you to prove what it did, who authorized it, and that you could have stopped it. Talaiz is built so those answers exist by default, for every call.
Where agent access meets the rules
The frameworks below all converge on the same demands: least privilege, logging, and accountability. This is how Talaiz answers each one.
| Framework | What it requires | Exposure if you can’t show it | How Talaiz helps |
|---|---|---|---|
| EU AI Act | Record-keeping and logging for high-risk AI systems (Art. 12/19); deployers retain logs. | Up to €35M or 7% of global turnover for prohibited practices; up to €15M / 3% for other breaches. | Per-call audit events sealed into a tamper-evident hash chain, with retention and a signed checkpoint. |
| GDPR | Accountability and security of processing (Art. 5, 30, 32); demonstrable access control. | Up to €20M or 4% of global turnover. | Deny-by-default access, per-call audit, redaction before storage, and least-privilege roles. |
| SOC 2 | Monitoring and logging (CC7) and logical access control (CC6). | Not a fine — lost enterprise deals and failed reviews. | Live monitoring, role-based access, human approval and a kill switch that acts in seconds. |
| HIPAA Security Rule | Audit controls and activity review (§164.312(b)). | Civil penalties up to roughly $1.5M per violation category per year; criminal exposure for wilful neglect. | An immutable audit trail for every tool call, plus approval gating for sensitive data access. |
| PCI DSS 4.0 | Logging and monitoring of access to system components (Req. 10). | Card-brand contractual fines and loss of processing rights. | Centralized, tamper-evident audit and redaction of card-like data before results are stored. |
| ISO/IEC 42001 · NIST AI RMF | An AI management system and a documented risk process. | Certification and procurement risk. | A concrete policy enforcement point, human oversight and evidence for your risk register. |
Not legal advice. Penalty ranges are illustrative and change over time; the exact figures depend on jurisdiction, intent and the authority involved. Confirm your obligations with counsel before relying on them.
The controls, concretely
- Least privilege: no tool is reachable without an explicit policy rule.
- Accountability: every executed call writes exactly one audit event — who, what, when, arguments, result, decision.
- Integrity: events are chained by SHA-256; /api/v1/audit/verify recomputes the chain on demand.
- Retention: old events can be pruned under a signed, HMAC-anchored checkpoint so the surviving log stays verifiable.
- Human oversight: sensitive tools block until a person approves or denies them.
- Containment: a connector or agent can be disabled immediately, and the connector fails closed if the gateway is unreachable.