Why the AI Loop Will Test Every Security Assumption

This post introduces the concept of 'control drift' in the context of AI development loops, where security controls may not keep pace with the dynamic evolution of AI systems (models, agents, data). It argues that security must adapt to this 'AI loop' by ensuring controls like identity, key authority, telemetry, revocation, and audit evidence travel with the work across different stages (training, inference, evaluation, agent execution). It highlights Remote Key Encryption (RKE) as a mechanism for customer-held key authority to remain aligned with governance models, and touches on confidential computing and attestation as future directions for data-in-use protection. The core technical contribution is framing AI security not just as environment-based, but as a runtime enforcement problem tied to the continuous iteration of AI systems.