AI Governance Controls with Garak, NeMo Guardrails, Presidio & Promptfoo One-Pager

Confidential AI Governance Program

AI Product Security Architect / AI Governance Engineer

Context

Designed a practical AI governance control layer using Garak, NeMo Guardrails, Microsoft Presidio, Promptfoo, agentic identities, permission scoping, evaluation gates, and evidence-generation workflows to support ISO 42001, NIST AI RMF, and AIMS-style control objectives for agentic AI systems.

Problem

AI governance often fails when it remains a policy document instead of becoming an engineering system. Organizations need demonstrable controls for model behavior, prompt-injection resilience, privacy handling, output quality, agent permissions, tool access, identity, auditability, and evaluation evidence. The gap is especially severe for agentic workflows, where LLMs can call tools, process sensitive data, and perform actions across systems.

What I did

• - Mapped ISO 42001, NIST AI RMF, and AIMS-style governance objectives into concrete product-security and AI-security control categories.
• - Defined a practical AI control architecture covering model evaluation, red-team testing, prompt-injection testing, guardrails, PII handling, agent identity, tool permissions, logging, and acceptance gates.
• - Used Garak-style adversarial testing patterns to probe model and application behavior for unsafe, unreliable, or policy-violating responses.
• - Used NeMo Guardrails-style conversational guardrails to define allowed flows, blocked flows, topic constraints, refusal behavior, and policy routing.
• - Used Microsoft Presidio-style PII detection and redaction patterns to identify sensitive data before prompts, tool calls, logs, or downstream storage.
• - Used Promptfoo-style evaluation suites to make prompt, model, workflow, and regression tests repeatable.
• - Defined agentic identity patterns separating human user identity, service identity, agent identity, workflow identity, and delegated tool permissions.
• - Specified least-privilege permission boundaries for agent tools, connectors, files, APIs, browser automation, and workflow execution.
• - Created verification and validation gates for agent workflows before production or customer-facing use.
• - Designed scoring and evidence outputs that could be used in governance reviews, risk reviews, and security-control reporting.
• - Connected test results, guardrail behavior, PII handling, and permission enforcement to audit-friendly evidence artifacts.
• - Framed governance as a continuous control system rather than a one-time compliance checklist.

Outcome

• - Translated AI governance frameworks into concrete technical controls and evidence workflows.
• - Created a defensible control architecture for agentic AI systems using open-source and practical engineering tools.
• - Established repeatable testing for prompt behavior, unsafe responses, privacy exposure, guardrail bypass, and workflow regressions.
• - Defined agentic identity and permission boundaries for safer tool-calling and delegated action.
• - Created a path for ISO 42001, NIST AI RMF, and AIMS-style control evidence without slowing AI product delivery into pure bureaucracy.
• - Improved governance readiness by making controls testable, logged, scored, reviewable, and tied to acceptance criteria.
• - Produced reusable patterns for AI product security, AI governance engineering, and secure agentic workflow operations.

Evidence

• - Mapped governance objectives across ISO 42001, NIST AI RMF, and AIMS-style control categories into implementable engineering controls.
• - Defined a control stack using Garak-style adversarial testing, NeMo Guardrails-style policy flows, Presidio-style PII detection, Promptfoo-style evaluation, and agentic identity/permission boundaries.
• - Created repeatable evaluation gates for prompts, workflows, model behavior, PII handling, guardrail behavior, and tool permissions.
• - Established evidence artifacts suitable for governance review, security review, risk acceptance, and continuous control monitoring.
• - Public-safe metric language; exact internal control mappings, private test suites, sensitive prompts, customer data, and proprietary implementation details omitted.