https://grcide.com/insights Reading notes, commentary and practice notes from the editors on AI, security practice, regulation and audit, and the craft of the work. en Sat, 05 Sep 2026 00:00:00 +0000 https://grcide.com/insights/agent-governance-is-a-permissions-problem https://grcide.com/insights/agent-governance-is-a-permissions-problem Sat, 05 Sep 2026 00:00:00 +0000 Singapore's advisory on the OpenClaw agent platform moves AI risk from what a model says to what an agent can do. The controls it lists are identity controls. https://grcide.com/insights/open-source-risk-is-a-maintainer-problem https://grcide.com/insights/open-source-risk-is-a-maintainer-problem Sat, 05 Sep 2026 00:00:00 +0000 A Chinese-language piece argues that open-source risk lives in maintainers and funding, not in CVE queues. We agree, and add the control it implies. https://grcide.com/insights/the-board-question-is-not-the-cve-count https://grcide.com/insights/the-board-question-is-not-the-cve-count Sat, 05 Sep 2026 00:00:00 +0000 A vendor piece uses Anthropic's Mythos findings to argue that boards should hear attack paths and expected loss, not patch rates. Half of it holds.