Technical Controls & Assurance

Model inventories record systems. They do not record the tool servers those systems act through, the credentials those servers hold, or the text that tells the model what to do with them. This guide covers what an MCP server is in governance terms, why the tool description is the control surface, what the 2026 disclosures actually showed, and how tool access engages ISO/IEC 42001, the NIST AI RMF and the EU AI Act.

AI moved onto the device, and gateway based controls stopped being sufficient without anything visibly breaking. This guide explains why desktop assistants, coding agents, local models and tool servers produce no inspectable traffic, what evidence actually sits on an endpoint, what each control layer can and cannot see, and how the gap connects to ISO/IEC 42001, the NIST AI RMF and the EU AI Act.

A bias audit is a measurement exercise with a policy decision hidden inside it. This covers selection rates and impact ratios worked through, where the four-fifths convention comes from and what it does not mean, and what independence actually requires.

Model validation asks whether an AI system works. Red-teaming asks whether it can be made to misbehave. This guide separates the two disciplines, maps them to the EU AI Act, NIST AI RMF, OWASP, and MITRE ATLAS, and lays out a program you can run and evidence.