Insights on AI governance, data and integration for regulated industries

CVE-2026-5430: What WSO2 API Manager Teams Should Check Now

CVE-2026-5430 is a critical authentication bypass in WSO2's API management products. WSO2 shipped the fix on April 6, 2026 and published advisory WSO2-2026-5328 on May 3. Attackers started using it i…

David deBoisblanc
 ·  Co-Founder and Managing Partner
3 min read · Integration & Security
Latest Insight 3 min read
For architects and engineers
Technical Guides

Hands-on guides to WSO2, Cloudera, AI governance, and AI integration.

Browse 9 guides →

Executive Briefings

For leadership readers
Your Agents Inherit the Disagreements Between Vendor Context Graphs
David deBoisblanc David deBoisblanc
2 min read
The Verification Tax: Why AI Pilots Stall, and Who Pays
Most AI pilots that stall do not fail. They work well enough that someone has to check every answer. That checking is the cost nobody put in the business case, and it is why so many pilots never reach production. A Certinia executive writing in [[LI…
David deBoisblanc David deBoisblanc
3 min read
Blocking AI Agents Buys Bank CFOs Time, Not a Deposit Strategy
The largest US banks have shut AI agents out of customer accounts, and the real reason sits on the balance sheet, not in the technology. Citigroup and Bank of America have begun restricting third-party AI agents from logging into customer accounts o…
David deBoisblanc David deBoisblanc
3 min read

Practitioner Insights

Senior-level depth
Your Agents Inherit the Disagreements Between Vendor Context Graphs
David deBoisblanc David deBoisblanc
2 min read
The Verification Tax: Why AI Pilots Stall, and Who Pays
Most AI pilots that stall do not fail. They work well enough that someone has to check every answer. That checking is the cost nobody put in the business case, and it is why so many pilots never reach production. A Certinia executive writing in [[LI…
David deBoisblanc David deBoisblanc
3 min read
Blocking AI Agents Buys Bank CFOs Time, Not a Deposit Strategy
The largest US banks have shut AI agents out of customer accounts, and the real reason sits on the balance sheet, not in the technology. Citigroup and Bank of America have begun restricting third-party AI agents from logging into customer accounts o…
David deBoisblanc David deBoisblanc
3 min read
Governance Runs on Rails: AI Controls in the Integration Layer
Most AI governance programs at banks and insurers are written down. A policy defines acceptable use. A committee approves use cases. An inventory lists the models in production. All of that is necessary. None of it controls what an agent does at two…
David deBoisblanc David deBoisblanc
6 min read
Agent Identity Is Becoming an Exam Question for Bank CIOs and CROs
The vendors that run your API and identity infrastructure have started treating AI agents as a new class of user, and that changes what your access controls will be expected to prove. Rania Khalaf, Chief AI Officer at WSO2, recently described on the…
David deBoisblanc David deBoisblanc
3 min read
Xinbi Guarantee Designation: Compliance Steps for US Institutions
Treasury's September 9 action against Xinbi Guarantee names a marketplace, a messaging app, and a wallet app in the same designation. Here is why that matters for a compliance program built around name screening, and four steps to take before an exa…
David deBoisblanc David deBoisblanc
4 min
Workload Identity Federation Stops at the Agent
Eliminating long-lived cloud credentials is a solvable problem this quarter. The federation mechanics take an afternoon. What determines whether the pattern holds at a hundred projects or quietly turns into a different kind of credential sprawl is f…
David deBoisblanc David deBoisblanc
8 min
Scalable Capital Publishes Its Agent Permission Model
The first European bank to give AI assistants a key to customer accounts also published exactly which doors it locked, and the second list matters more than the first. Scalable Capital, the Munich broker that received a full banking licence from the…
David deBoisblanc David deBoisblanc
3 min read
Out of the Cloud Was Never Out of Compliance Scope
Cloudera announced a platform this week that lets AI agents work directly against data that never leaves the premises — which means the datasets your institution treated as outside the AI perimeter no longer are.
David deBoisblanc David deBoisblanc
3 min read
Single-Agent Governance Is Buildable. Enterprise Scale Is Where the Work Lives.
Partha Sarkar published a piece in Towards Data Science today that more people building agentic systems should read before their next architecture review. The argument is one that deserves wider circulation: an LLM's job is to synthesize text, not t…
David deBoisblanc David deBoisblanc
3 min read
Conditionally Approved: Where AI Projects Go to Stall
More than half of enterprises now report a governance gate their AI portfolio cannot clear on schedule, and the gate sits where a pilot becomes a production system. Cloudera released findings this month from a global survey of 1,500 enterprise archi…
David deBoisblanc David deBoisblanc
4 min read
Iran Sanctions Relief Lasted Sixteen Days. Compliance Records Last Forever.
A sanctions authorization covering Iranian oil transactions lasted sixteen days, and institutions on both sides of the decision to rely on it now have to be able to show what they knew, and when. On June 21, 2026, the Treasury Department's Office of…
David deBoisblanc David deBoisblanc
4 min read
Onboarding Friction Is Either Vendor Policy or Your Policy
If an agent can't obtain API credentials without a human clicking Approve, every agentic workflow on your roadmap inherits a manual step. Multiply that step across a fleet of agents and dozens of internal APIs, and credentialing — not model quality,…
David deBoisblanc David deBoisblanc
6 min read
AI Factories Solve Throughput. They Don't Solve Meaning.
The data platform vendors are industrializing how fast data reaches AI models — which makes the unresolved question of what that data means the binding constraint. This week Cloudera and VAST Data announced a jointly delivered AI factory: a producti…
David deBoisblanc David deBoisblanc
4 min read
MCP Is a Context Protocol. Most Enterprises Are Letting It Become an Authorization Model.
The API-versus-MCP debate is settling into a sensible consensus — and it is still one layer above the decision that matters. The question is not which protocol connects your agents to your systems. It is where an agent's permission to observe ends,…
David deBoisblanc David deBoisblanc
8 min read
Zero Permissions Won't Matter If the Data Underneath Is Wrong
Every AI agent an enterprise deploys is a non-human identity that can take real action — and most organizations are about to have far more of them than they have ever had human employees. That one fact breaks the security model most companies still…
David deBoisblanc David deBoisblanc
4 min read
ServiceNow Built the Dashboard. The Data Layer Decides If It's True.
A major platform vendor just built its enterprise AI story around an uncomfortable admission: most organizations are running more AI in production than they can name, and that gap has turned from a hygiene issue into a budget and audit exposure. At…
David deBoisblanc David deBoisblanc
4 min read
Visibility Isn't Access: The Data Gap Where AI Stalls
Most enterprise AI is built on an assumption that holds for ordinary data and breaks on the data that matters most: that the data will move to the model. For the bulk of workloads, moving data to where the models run — usually a central cloud enviro…
David deBoisblanc David deBoisblanc
7 min read
After SR 26-2, Agentic AI Governance Has to Be Load-Bearing
Regulators took agentic AI out of the model-risk rulebook and left the duty to govern it in place. The standard a bank writes to fill that gap is worth exactly what its architecture can enforce — and prove. — SR 26-2 made the agentic AI control stan…
David deBoisblanc David deBoisblanc
8 min read
The CCO and CFO Inherit SR 26-2
The guidance that pulled agentic AI out of model risk didn't say who inside the bank now owns the cost of governing it, and that silence is where the exposure collects. SR 26-2 carved generative and agentic AI out of model risk and declined to speci…
David deBoisblanc David deBoisblanc
7 min
SR 26-2 Carved Out Agentic AI. The Liability Didn't Move.
In April, the framework that has governed bank model risk for fifteen years was rewritten, and the fastest-moving AI in the institution was deliberately left outside it. SR 26-2 rewrote bank model-risk guidance in April and deliberately placed gener…
David deBoisblanc David deBoisblanc
3 min read
Financial Services & KYC/AML For Executives
The CFO Question on Agent Governance Spend
Capital requests for AI agent governance are arriving on CFO desks one platform at a time, each defensible in isolation, and the gap between them is where the financial exposure lives. The reason these requests are arriving now is that the market ju…
David deBoisblanc David deBoisblanc
4 min read
AI & Data Engineering
The Kill Switch Is Not the Story
A vendor shipping a comprehensive-sounding agent control tower is not the same as your enterprise having an answer for agent management. The architects who conflate the two will inherit a control plane by default, along with a definition of the prob…
David deBoisblanc David deBoisblanc
8 min
Why Agent Governance That Passes Pilots Fails Audit
Most enterprise architects have stopped treating the system prompt as where governance lives. That conclusion is no longer controversial. The interesting question — the one most current answers do not fully resolve — is where exactly governance does…
David deBoisblanc David deBoisblanc
9 min
Your Agents Can Read the PDF. They Cannot Defend It.
Before any agent can act on a financial record, something or someone has to turn that record into trustworthy structured data. That handoff is where many institutions are quietly failing today. The pattern is familiar to anyone who has worked inside…
David deBoisblanc David deBoisblanc
6 min
AI & Data Engineering For Executives
The Agent Wars Aren't About Agents
Derek du Preez's coverage of Google Cloud Next '26 cuts to the decision that actually matters for agentic systems: who owns the audit and policy plane when your agents start acting on enterprise data. Not the model. Not the framework. The control la…
David deBoisblanc David deBoisblanc
3 min read
Financial Services & KYC/AML For Executives
Semantic Coherence Is the KYC Control Examiners Will Ask About Next
Your next agentic AI deployment is likely to struggle under examination for reasons your model risk framework wasn't built to catch. Industry analysts including Gartner and McKinsey continue to report that the majority of enterprise AI projects fail…
David deBoisblanc David deBoisblanc
4 min
Design the Decision Before the System
Most enterprises now have teams doing serious architectural work on agentic AI. The work is necessary. The conversations being had inside it — about controls, surfaces, governance models, where deterministic constraints belong and where they cost mo…
David deBoisblanc David deBoisblanc
9 min
AI & Data Engineering For Executives
The Agent Did Exactly What the Attacker Told It To
Recently, an attacker filed a support ticket on a Supabase-backed application. The ticket contained hidden instructions directing a Cursor IDE agent — connected to the database via MCP and running with the service_role key — to read a private creden…
David deBoisblanc David deBoisblanc
7 min read
Many Banks Already Run the Stack for Defendable Agentic AI
The document workflow grew up in one part of the bank. The data platform grew up in another. The agents that need to defend their decisions are about to discover they were never connected. That is the architectural seam this post is about. The prior…
David deBoisblanc David deBoisblanc
8 min read
Document Ingest Is a Semantic Event, Not a Parsing Problem
The agent cannot defend what the pipeline never captured. If signer identity, consent, version, and provenance are not emitted as structured signals at the moment a document enters the institution, no downstream model — however capable — can reconst…
David deBoisblanc David deBoisblanc
8 min read
The Cloudera Survey Found a Leadership Gap. A Semantic Gap Sits Beneath It.
A new Cloudera survey covered in Saudi Gazette puts a number on something most architects already feel: in EMEA, 69% of organizations assign data readiness to the CIO or CTO, and over 90% of those report a data strategy tied to business objectives.…
David deBoisblanc David deBoisblanc
4 min read
Rethinking LLMOps for Fraud and AML: Building a Compliance-Grade LLM Serving Stack
A new paper on LLMOps for fraud and anti-money-laundering workloads reframes compliance inference as a serving problem. Prompts are prefix-heavy. Outputs are short and schema-constrained. Most production stacks are tuned for the wrong workload — gen…
David deBoisblanc David deBoisblanc
3 min read
Financial Services & KYC/AML For Executives
When Process Breaks Down, Fraud Finds a Way: Through Invoices, Expenses or Both!
A subsidiary lost a material share of its annual turnover for eight straight years to a fraud scheme that never tripped a single control, because the controls were watching the wrong things. The Fintech Times this month walked through the mechanics…
David deBoisblanc David deBoisblanc
3 min read
AI & Data Engineering For Executives
CFO-What Your Agent Platform Sponsor Should Tell You
The capital request that lands on your desk for an enterprise agent control plane needs a different diligence standard than the one that worked for the last decade of SaaS. A category of vendor announcements is converging on the same offer. ServiceN…
David deBoisblanc David deBoisblanc
4 min read
Financial Services & KYC/AML For Executives
Your AI Governance Chart Has One Name on It in Court
Courts are starting to signal what risk officers already suspect: when an AI system causes harm, the bank that deployed it owns the liability, not the vendor that built it. A recent CIO feature on AI accountability lays out a dynamic that should lan…
David deBoisblanc David deBoisblanc
3 min read
Integration & Security For Executives
Your AI Agents Have Credentials. Do You Know Which Ones?
A new Okta Threat Intelligence study shows AI agents handing over OAuth tokens, leaking credentials over unencrypted channels, and bypassing their own guardrails under entirely plausible enterprise conditions — and most CIOs have no inventory of whe…
David deBoisblanc David deBoisblanc
3 min read
Financial Services & KYC/AML For Executives
The Hidden Capex in Treasury's Stablecoin Rule
Treasury's stablecoin rule turns a compliance question into a capital question, and the meter is already running. What CFOs and compliance leaders need to know: The clock is twelve months from rule finalization, with comments closing June 9 — short…
David deBoisblanc David deBoisblanc
4 min read
Financial Services & KYC/AML
The GENIUS Act Just Became an Architecture Problem
Treasury's proposed AML and sanctions rule for stablecoin issuers reads like a compliance document. Read it again as an architect, and it's a system design specification — one that quietly moves the hardest decisions from the legal team to the platf…
David deBoisblanc David deBoisblanc
6 min read
AI & Data Engineering For Executives
Before You Trust an Agent's Decision, Ask What It Resolved
The current generation of enterprise AI pitches is more sophisticated than the skeptics give them credit for. The orchestration vendors have done real work on making agent behavior inspectable. What most of them have not done is push that inspectabi…
David deBoisblanc David deBoisblanc
7 min
AI & Data Engineering For Executives
NatWest's AI story is really a board-level story about discipline
Diginomica's write-up of NatWest's Venture Banking launch with AWS is being read as an AI announcement. It is not. It is a story about institutional discipline — about a bank that accepted the boring, expensive, multi-year work had to come before th…
David deBoisblanc David deBoisblanc
3 min read
AI & Data Engineering For Executives
The Line Item Every CFO Is About to Add to the AI Budget
Enterprise AI is crossing from experimentation into operation, and the cost structure of that transition is not what the first wave of business cases assumed. AI Business reported in mid-April that Salesforce, Databricks, and AWS each released agent…
David deBoisblanc David deBoisblanc
4 min read
AI & Data Engineering
Every Prompt-Based Control Is a Future Postmortem
The system prompt that tells your agent "never refund more than $500" is not a control. It is a suggestion the model will follow most of the time, ignore some of the time, and abandon entirely when an adversarial input finds the right shape. If the…
David deBoisblanc David deBoisblanc
8 min read
AI & Data Engineering For Executives
Governance Is Now the Gating Factor for AI Scale
The shift this quarter is not what AI can do next, it is what enterprises can actually govern once AI is running across their systems. AI Business reported in mid-April that Salesforce, Databricks, and AWS all rolled out agent governance and registr…
David deBoisblanc David deBoisblanc
4 min
AI & Data Engineering
Why Most Agentic AI Projects Fail Before They Start
Gartner estimates that 85% of AI projects fail to deliver value. McKinsey places enterprise AI success rates below 20%. These aren't rounding errors. They're systemic failure. The explanations vary. Insufficient data. Poor model selection. Organizat…
David deBoisblanc David deBoisblanc
9 min
Financial Services & KYC/AML
Why Knowledge Graphs Are Becoming the Center of Gravity in AML Architecture
The leading institutions know this. Major banks have graph initiatives, entity resolution programs, and ML-based transaction monitoring in production or advanced pilot. The question at the top of the market isn't whether to move beyond rules — it's…
David deBoisblanc David deBoisblanc
8 min read
AI & Data Engineering
Structure-Aware RAG Is Right. The Benchmarks Aren't.
Structure-aware retrieval is having a moment. A steady stream of papers, product launches, and polished blog posts is making the case for embedding document structure — section hierarchies, breadcrumbs, parent-child relationships — directly into the…
David deBoisblanc David deBoisblanc
8 min
AI & Data Engineering
Agentic AI Is Not Just a Better Chatbot
Most organizations confuse agentic AI with conversational interfaces. They treat agents as chatbots with memory, then wonder why their deployments fail in production. The confusion is expensive. An agentic system doesn't just respond — it acts. It m…
David deBoisblanc David deBoisblanc
6 min read

Topics