Chapter 4.11 — Governance, audit logs and compliance

🎯 Objective

Close Part 4 with the minimum set of governance practices that turn all the previous controls into something auditable — not just implemented. Without governance, security is episodic: each team does it their own way and each incident becomes improvisation.

🧠 Concept

Governance in AI is, above all, institutional visibility: knowing which models and agents exist, who is accountable for them, what the risk of each is, and what happened in each critical execution. Audit logs are the technical substrate of that visibility; compliance is the external frame that defines how much of these records must be preserved and in what form.

🛡️ Minimum controls

• Inventory of models and agents with an owner.
• Risk classification.
• Pre-production approval.
• Tool call auditing.
• Immutable logs.
• Retention policy.
• Right to be forgotten implemented.
• Incident response plan.
• Periodic reviews.

📊 Consolidated risk matrix

Risk	Example	Impact	Mitigation
Direct prompt injection	"Ignore previous policies"	Unsafe response	Delimitation, evals
Indirect prompt injection	Document with a malicious instruction	Leak via tool	Sanitization, allowlists, policy
Data exfiltration	Tool sends data externally	Privacy	DLP, egress, approval
Tool misuse	Agent updates the wrong CRM	Operational damage	Schema validation, HITL
Excessive agency	Agent has admin permission	High blast radius	Least privilege, scopes
Insecure output handling	Output becomes SQL/HTML	Downstream injection	Encoding, sandbox
Memory poisoning	Malicious preference	Contaminated behavior	Provenance, TTL
Vector poisoning	Malicious document indexed	RAG compromised	Ingestion checks
Supply chain	Vulnerable MCP server	Improper execution	SBOM, pinning, review
Secrets leakage	Logs with API keys	Compromise	Secret scanning, redaction
PII leakage	Prompt sends sensitive data	Compliance	DLP, minimization
Cross-tenant leak	Retriever fetches the wrong tenant	Severe	Mandatory filters
Unbounded consumption	Loop consumes tokens	Cost, DoS	Budgets, max steps
Overreliance	User accepts a wrong answer	Bad decision	Citations, confidence, HITL