# Secure

> Governance, agent oversight, shadow AI, cost accountability, and compliance evidence. What are the agents up to, and can you prove it?

Source: https://brocs.fyi/secure/
Part of the surface: S · Secure. Prove it is not going off the rails.
Framework: BROCS (Build, Run, Observe, Control, Secure), brocs.fyi. CC BY 4.0, attribute to brocs.fyi.

---

## The Secure surface

- Governance: policy encoded where it is enforced, not a PDF
- Agents: tool permissions, audit trails, human in the loop
- Shadow AI: discovery of what people use when you give them nothing
- Cost: who spends what, on which model, showback and chargeback
- Compliance: HIPAA, SOC 2, PCI, FedRAMP, EU AI Act as platform output


**Secure** is the part of the surface concerned with answering for the system: what it is
permitted to do, what it actually did, what it cost, and whether you can show any of that
to somebody who was not there.

It is the letter most often treated as a phase rather than a property. Something gets
built, it works, and then security and compliance are asked to bless it, which is the
point at which everyone discovers that the necessary records were never produced.

## The claim

Secure is not a subset of the other four letters and it is not a review gate at the end.
It is a set of standing requirements that change what the other four have to emit.

Three of them are genuinely different from pre-AI security work:

**Untrusted content is an instruction channel.** Every document, ticket, and email an
assistant reads can carry instructions to it. The perimeter model assumed data moves when
a person moves it; an agent moves data continuously as a side effect of working. See
[agents](/secure/agents/).

**The blast radius is the union of standing access.** For a conventional service you
reason about what a request can do. For an agent you have to reason about everything its
tools and identity can reach, which is usually larger than anyone intended.

**Spend is a security control.** An agent in a loop is a financial incident, and the
control that stops it is a quota rather than a policy. See [cost](/secure/cost/).

## The tests that matter

1. **Blast radius.** For your most autonomous agent, list its tools, identity, data reach,
   egress, and cost ceiling. Can anyone produce that today?
2. **Shadow.** Pull six months of expense reports. What AI subscriptions are on personal
   cards?
3. **Evidence.** Could you answer an auditor's access and change questions for last
   quarter with a query rather than an investigation?

## The tension

Secure pulls against every other letter, and the resolution is always the same: the
controls that get used are the ones inherited from a fast path, and the controls that get
routed around are the ones implemented as queues. A ban is the extreme case. It moves the
activity somewhere you cannot see rather than stopping it, which is why
[shadow AI](/secure/shadow-ai/) is a Secure problem with a [Build](/build/) solution.

Secure hands back to Build: what you learn here changes what you are willing to let
people make, and how quickly.


## Pages under Secure

- [Governance](https://brocs.fyi/secure/governance/): Policy encoded where it is enforced, not written where it is filed.
- [Agents](https://brocs.fyi/secure/agents/): What are the agents up to: tool permissions, audit trails, and human oversight that survives contact with volume.
- [Shadow AI](https://brocs.fyi/secure/shadow-ai/): Discovering unsanctioned tools, and understanding why people reached for them in the first place.
- [Cost](https://brocs.fyi/secure/cost/): FinOps for AI: who spends what on which model, and why monthly reporting is too slow to be a control.
- [Compliance](https://brocs.fyi/secure/compliance/): HIPAA, SOC 2, PCI, FedRAMP, and the EU AI Act: audit evidence as a platform output rather than a quarterly scramble.