blog
Notes on governing the automated enterprise.
Regulatory updates, real enforcement cases, security practice and what we are building.
The Spanish DPA's guidance on agentic AI: 76 pages that read like a specification for governing automations
Seven insights up front, then the long version: the four vulnerabilities, the Rule of 2, the threats and the measures the Agency names — mapped measure by measure against what Kimetai does, and the condition under which each control is actually effective.
Read the article- Regulatory updates
· 11 min
The Spanish DPA more than doubled its breach proceedings — and put the spotlight on companies' controls
From 30 to 77 proceedings and €19.84M in fines — more than 40% of the annual total. What the 2025 Annual Report teaches companies that connect CRM, ERP, agents and automations, read number by number, with two resolutions and the 2026 agentic AI guidance.
- Security tips
· 8 min
PocketOS: nine seconds, one borrowed token, and an authorisation boundary that did not exist
A coding agent on a staging task found an account-scoped token in another file and deleted the production volume. Step by step, how a task's authority exceeded its mission — and why the control has to sit in front of the action.
- Real enforcement cases
· 9 min
The £1.25M chatbot: when your vendor does not know where its own software runs
The ICO did not fine Ticketmaster for the attack. It fined the company for not governing a third-party automation running inside its payment page — no risk assessment, no visibility over changes, and a contract standing in for a control.
- Kimetai news
· 3 min
We are opening the design partners programme
A limited number of European companies help us prioritise the roadmap against real needs — with preferential access and pricing while we build.
- Regulatory updates
· 6 min
The AI Act is now in application. Your automations do not know that.
Article 50 transparency duties apply since 2 August 2026. What Regulation (EU) 2024/1689 actually requires from a 200-person company with automations in production — and what waits until December 2027.
- Kimetai news
· 4 min
Why we stopped saying “AI agent governance”
Deterministic workflows and AI agents carry the same obligations and the same blind spot. Renaming the category was not marketing — it was the legal perimeter catching up with reality.
- Security tips
· 8 min
Enforcement vs. observation: why logging what your automations do is not governance
Most “governance” stacks are observability with a new label. The difference between recording a wire transfer and authorizing one is the difference between an incident report and a control.
- Security tips
· 7 min
Shadow automations: the inventory problem nobody owns
The first connection usually surfaces more operating automations than the CTO expected. Where they hide, and why business teams built most of them.
- Security tips
· 9 min
An identity model for non-human actors: DIDs, VCs and the backing human
Why every automation credential should name a person, and how W3C standards make it verifiable without trusting the automation itself.
- Security tips
· 5 min
Governing n8n workflows without touching them
One node, one OAuth consent, and every execution of the workflow passes a policy decision before it acts.