Mark Emelianov
EN

Security compliance you can prove, even when AI agents do the work.

I am a security compliance specialist: ISO 27001, SOC 2, ISO 42001 and the EU AI Act, from gap analysis to audit. I help security and compliance leaders keep their controls and evidence solid as AI agents join the work.

My working rule: agents will be wrong, so build so it doesn't matter. I run my own work with a fleet of AI agents under approval gates, isolation and evidence, and bring that method to governance, risk and compliance. The projects and guides here show it in practice.

Work with me Read the seven principles Try the gates

Mark Emelianov, security compliance specialist. Track record

Gate lab a small simulation

  1. 🤖Agent
  2. 🔍Review
  3. 🛡Scan
  4. 👤Owner
  5. 🏁Core
  • Agent proposes a change
  • Review: reads the exact commit, looks fine
  • Scan: no organisation data found
  • Owner: approved the merge
  • Core: merged, record kept

1merged0mistakes contained

Review is bound to the exact commit; the scan blocks organisation data; the owner approves the merge. Nothing here is real data.

Seven principles

One approach in seven principles. Each links to its evidence.

  1. 1Agents will be wrong.Assume any agent can be wrong or manipulated; design so a mistake cannot reach far.
  2. 2Hard controls beat good intentions.Sandboxing, isolation and limited credentials protect more than prompts or instruction files.
  3. 3Gate, isolate, record.No important change without a gate; what must stay apart stays apart; every step leaves a record.
  4. 4People own decisions and evidence.Agents do the legwork; people decide and own the evidence.
  5. 5Compliance is a by-product of good work.Evidence should come from the work itself, so collecting and checking it can be automated.
  6. 6Relationships are data.Requirement, control, evidence, risk and finding belong together as linked records with a history.
  7. 7Show the method, not the setup.The method is shared openly; names, hosts and company data are not.

Read the principles in full

How this site is organised

Four parts, from ideas to person. Start where you like.

Ideas

What I think and why.

Practice

What it looks like when built.

Reference

Where to read further.

Person

Who is behind it.

Latest writing

All writing