---
description: Research insights on why runtime behavioral monitoring solves AI security challenges that pre-deployment testing alone cannot address. The evidence base for risk-proportionate controls.
---

# Insights

The *why* before the *how*. Each article identifies a specific problem that the [core controls](../core) and [extensions](../extensions) then solve. Together, they make the case for risk-proportionate runtime controls that reduce harm without imposing disproportionate process.

## Start Here

These establish the foundational argument: AI systems are non-deterministic, so you can't fully test them before deployment. Runtime behavioral monitoring is the answer.

| # | Article | One-Line Summary |
|---|---------|-----------------|
| 1 | [The First Control: Choosing the Right Tool](the-first-control.md) | The best way to reduce AI risk is to not use AI where it doesn't belong |
| 1b | [The Model You Choose Is a Security Decision](the-model-you-choose.md) | Choosing a flawed model makes every control downstream harder - evaluate security posture, not just capability |
| 2 | [Why Your AI Guardrails Aren't Enough](why-guardrails-arent-enough.md) | Guardrails block known-bad; you need detection for unknown-bad |
| 2b | [Practical Guardrails](practical-guardrails.md) | What guardrails should catch, international PII, RAG filtering, exception governance |
| 3 | [The Judge Detects. It Doesn't Decide.](judge-detects-not-decides.md) | Async evaluation beats real-time blocking for nuance |
| 4 | [Infrastructure Beats Instructions](infrastructure-beats-instructions.md) | You can't secure systems with prompts alone |
| 5 | [Risk Tier Is Use Case, Not Technology](risk-tier-is-use-case.md) | Classification is about deployment context, not model capability |
| 6 | [Humans Remain Accountable](humans-remain-accountable.md) | AI assists decisions; humans own outcomes |

## Emerging Challenges

Where the three-layer pattern meets its limits - and what to do about it.

| # | Article | One-Line Summary | Solution |
|---|---------|-----------------|----------|
| 7 | [The Verification Gap](the-verification-gap.md) | Current safety approaches can't confirm ground truth | [Judge Assurance](../core/judge-assurance.md) |
| 8 | [Behavioral Anomaly Detection](behavioral-anomaly-detection.md) | Aggregating signals to detect drift from normal | [Anomaly Detection Ops](../extensions/technical/anomaly-detection-ops.md) |
| 9 | [Multimodal AI Breaks Your Text-Based Guardrails](multimodal-breaks-guardrails.md) | Images, audio, and video bypass text controls | [Multimodal Controls](../core/multimodal-controls.md) |
| 10 | [When AI Thinks Before It Answers](when-ai-thinks.md) | Reasoning models need reasoning-aware controls | [Reasoning Model Controls](../core/reasoning-model-controls.md) |
| 11 | [When Agents Talk to Agents](when-agents-talk-to-agents.md) | Multi-agent systems have accountability gaps | [Multi-Agent Controls](../core/multi-agent-controls.md) |
| 12 | [The Memory Problem](the-memory-problem.md) | Long context and persistent memory create new risks | [Memory and Context Controls](../core/memory-and-context.md) |
| 13 | [You Can't Validate What Hasn't Finished](you-cant-validate-unfinished.md) | Real-time streaming breaks the validation model | [Streaming Controls](../core/streaming-controls.md) |
| 14 | [The Orchestrator Problem](the-orchestrator-problem.md) | The most powerful agents in your system have the least controls applied to them | [Privileged Agent Governance](../maso/controls/privileged-agent-governance.md) |
| 15 | [The MCP Problem](the-mcp-problem.md) | The protocol everyone's adopting gives agents universal tool access - without authentication, authorisation, or monitoring | [Tool Access Controls](../infrastructure/agentic/tool-access-controls.md) |
| 16 | [The Long-Horizon Problem](the-long-horizon-problem.md) | The security properties you validated on day one may not hold on day thirty - time itself is an attack vector | [Observability Controls](../maso/controls/observability.md) |
| 17 | [Process-Aware Evaluation](process-aware-evaluation.md) | Evaluating what an agent produced is less important than evaluating how it got there | [Judge Assurance](../core/judge-assurance.md) |

## Operational Gaps

Blind spots in most enterprise AI security programmes.

| # | Article | One-Line Summary | Solution |
|---|---------|-----------------|----------|
| 14 | [The Supply Chain Problem](the-supply-chain-problem.md) | You don't control the model you deploy | [Supply Chain Controls](../extensions/technical/supply-chain.md) |
| 15 | [RAG Is Your Biggest Attack Surface](rag-is-your-biggest-attack-surface.md) | Retrieval pipelines bypass your existing access controls | [RAG Security](../extensions/technical/rag-security.md) |
| 16 | [The Visibility Problem](the-visibility-problem.md) | You can't govern AI you don't know is running - shadow AI, inventories, and governance KPIs | [Operational Metrics](../extensions/technical/operational-metrics.md) |
| 17 | [Seeing Through the Fog](seeing-through-the-fog.md) | In multi-product, multi-agent environments, the hardest problem isn't controlling agents - it's knowing where they are and what they're doing | [Observability Controls](../maso/controls/observability.md) |

## Framework Review

How the framework maps to the broader AI ecosystem and where it fits within the full AI lifecycle.

| # | Article | One-Line Summary |
|---|---------|-----------------|
| 18 | [Review: The Framework Against the AI Lifecycle](ai-lifecycle-review.md) | Systematic assessment of framework coverage across all seven standard AI lifecycle phases: where it leads, where it defers, and where adopters must supplement |

## Research & Evidence

What the peer-reviewed literature says about runtime AI security controls.

| # | Article | One-Line Summary |
|---|---------|-----------------|
| 17 | [The Evidence Gap](the-evidence-gap.md) | What research actually supports - and where the science hasn't caught up to the architecture |

## The Case for Runtime Security

The argument for why AI systems require a fundamentally different security model.

| Article | One-Line Summary |
|---------|-----------------|
| [Why AI Security Is a Runtime Problem](why-ai-security-is-a-runtime-problem.md) | Non-deterministic systems cannot be fully tested before deployment - security must be continuous |

## Analysis

Deeper examinations of where the framework meets production reality - what works, what scales, and where the pattern breaks.

| Article | One-Line Summary |
|---------|-----------------|
| [State of Reality](state-of-reality.md) | The AI security threat is real, specific, and concentrated in measurable failure modes |
| [Risk Stories](risk-stories.md) | Real production incidents show where missing controls caused or worsened failures |
| [What Scales](what-scales.md) | Security controls succeed only if their cost grows slower than the system they protect |
| [What Works](what-works.md) | Deployed controls are measurably reducing breach detection time and costs |
| [The Intent Layer](the-intent-layer.md) | Mechanical controls constrain what agents can do; semantic evaluation determines whether actions align with objectives |
| [Containment Through Intent](containment-through-intent.md) | Declared intent is the organising principle that gives every defence layer its reference point |
| [When the Pattern Breaks](when-the-pattern-breaks.md) | The three-layer pattern designed for single-agent systems fails to scale in complex multi-agent architectures |
| [Open-Weight Models Shift the Burden](open-weight-models-shift-the-burden.md) | Self-hosted models inherit the provider's control responsibilities |
| [PACE Resilience](../PACE-RESILIENCE.md) | How the three-layer architecture achieves operational resilience through layered, independent control redundancy |
| [Security as Enablement, Not Commentary](security-as-enablement.md) | Security frameworks create value when delivered as platform infrastructure, not as narrative that diagnoses teams from the sidelines |
| [The Constraint Curve](the-constraint-curve.md) | Every constraint reduces both risk and capability - proportionate controls find the peak; over-constraining destroys the value that justified using an LLM |
| [The Hallucination Boundary](the-hallucination-boundary.md) | The same hallucination is a nuisance in one context and a catastrophe in another - tolerance is a function of decision authority, blast radius, and reversibility |
| [Automated Risk Tiering](automated-risk-tiering.md) | Classification should take two minutes, produce an immediate result, and auto-apply the controls that make the risk manageable |
| [Graph-Based Agent Monitoring](graph-based-agent-monitoring.md) | Using an in-memory graph database to model agent interactions as a live graph, detect anomalous behavior through temporal graph analysis, and feed results into PACE escalation in near real-time |
| [Beyond Security](beyond-security.md) | The framework's architecture - layered independence, tiering, PACE, quantitative compounding - transfers to drift, fairness, explainability, and reliability |

