Start with the AI question on your desk.

A vendor, a tool, a team and an owner on every line. Billed kept apart from metered.

The board gets a number off the statement and it holds for ten seconds. Which teams, which tools, who signed them off: that answer is a spreadsheet nobody has updated.

Three states with unknown as the default, an owner on every entry, coverage on its own axis.

The approval that happened is in a thread somebody can nearly find. Meanwhile a tool nobody signed off renews on a card and a leaver's seat is still billing.

Detect sensitive data in requests and responses. Mask or tokenise supported text, with the detector limits set out below.

A card number or a live API key goes out inside a prompt. The question is not what it cost but who can say it will not happen again, and the answer is that a regular expression ran somewhere in a codebase.

Refused before egress, priced against everything the route could reach, never estimated at zero.

A retry loop or a promoted model turns an ordinary week into an invoice nobody budgeted for. You find out from the vendor, and the control everybody assumed was on turns out to have been a chart.

One bundle with a verification verdict inside it, and the protection level beside the verdict.

You assemble exports the week before the audit, and every one was produced by, or about, the party under examination. The auditor asks how you would know the file was not edited, and nothing in the folder answers it.

Grants re-checked at execution rather than at the list, and a changed descriptor is quarantined.

A whole server was granted rather than an action, so the endpoint that issues refunds sits next to the one that reads orders. Nobody outside the team that wrote the configuration can say what the agent may do.

Bring five evidence sources together. See which feeds are connected, stale or missing.

The export died in July. Nothing on the screen distinguishes that from an estate with nothing to find, so a green banner has been asserting a clean result over a dead feed.

One decision, bound to one exact payload, spendable once. Nothing calls the agent back.

The approval was somebody typing yes in a chat channel. Nothing binds it to the action that ran, and a slightly different call two minutes later is covered by the same yes.

Checked before every other control. Stops new governed work; it cannot recall actions already dispatched.

The stop takes as long as a deploy takes and depends on the owning team being awake. The person who noticed the problem and the person who can end it are in different time zones.

The authority as it stood at the moment of the call, and a review bound to a digest.

The current configuration answers a different question, because the role has been edited twice since. The access review recorded that the agent held the role and not what was in it.