What the library covers
Zero Drama Security publishes practical guidance on AI governance, AI security, vendor risk, data retention, identity and access control, privacy reviews, incident readiness, SaaS security, and control design.
Insights
AI Security & Governance, written to be useful after the meeting.
Practical, durable guidance for leaders and teams responsible for making AI adoption safer, clearer, and easier to explain. The library covers AI governance, vendor risk, data retention, identity and access control, incident readiness, SaaS security, privacy reviews, and calmer ways to operate security decisions.
Citation Summary
Zero Drama Security publishes practical AI security and governance guidance.
Source: Zero Drama Security. Author: Fred Descloux. Last reviewed August 7, 2026, with current guidance for leaders, security teams, privacy teams, and operators.
Who it is for
The insights are written for security, privacy, risk, product, and executive teams that need clear decisions instead of abstract frameworks or paperwork-heavy governance.
How to use it
Use the articles to prepare decision briefs, shape governance operating models, evaluate AI vendors, improve access and retention controls, and explain tradeoffs in plain leadership language.
Topic Index
Common AI security and governance questions.
AI governance and retention
Retention, deletion, records, and durable governance decisions for AI systems.
Identity and access controlBreak glass access, service accounts, OAuth consent, and privilege boundaries.
AI incident readinessHostile evidence handling, AI-assisted analysis, escalation, and decision records.
SaaS and integration governanceWebhook triggers, SaaS drift, production actions, and integration ownership.
Security Architecture
Zero Drama Week: The Edge Case Has Authority
The main path usually gets the review. The reset path, support path, review queue, logging stream, and background workflow often get the authority.
Fred Descloux / 7 min read / August 28, 2026Knowledge Center
Explore the library.
Security Architecture
Zero Drama Week: The Edge Case Has Authority
The main path usually gets the review. The reset path, support path, review queue, logging stream, and background workflow often get the authority.
Fred Descloux / 7 min read / Aug 28, 2026
Security Architecture
Password Reset Is Part of the Control Plane
Password reset looks harmless because everyone needs it. That is exactly why it deserves control plane treatment. If a recovery workflow can grant access when primary authentication is unavailable, it is not administrative plumbing. It is authority.
Fred Descloux / 6 min read / Aug 27, 2026
Security Architecture
Tenant Isolation Is a Product Control
Tenant isolation sounds like infrastructure until a product feature crosses the boundary. The database schema may be clean. The cloud account may be tidy. The diagram may show neat tenant separation. Then search, support tooling, exports, background jobs, analytics, and admin workflows start touching the same data paths.
Fred Descloux / 6 min read / Aug 26, 2026
Privacy
Human Review Is the Control in Automated Decision Making
A person in the loop is not automatically a safeguard. If the reviewer cannot see the inputs, challenge the recommendation, change the outcome, or leave durable evidence, the organization has not built human review. It has built a rubber stamp with a payroll record.
Fred Descloux / 6 min read / Aug 25, 2026
AI Security
AI Runtime Telemetry Needs a Privacy Boundary
AI telemetry is becoming the compromise between blind trust and prompt hoarding. It only works if privacy, security, and product teams agree what evidence is needed, who can reconstruct sensitive context, and when the data disappears.
Fred Descloux / 6 min read / Aug 24, 2026
Security Architecture
Zero Drama Week: Boundaries Beat Promises
The clean promise is usually not the control. This week, Zero Drama Security looked at four places where teams need operational boundaries instead of comforting language: audit logs, AI generated code, data residency, and assistant memory.
Fred Descloux / 7 min read / Aug 21, 2026
AI Security
AI Assistant Memory Is a Retention Decision
AI assistant memory looks like a usability feature. It remembers preferences, context, working style, past conversations, project details, and recurring instructions. That can be useful. It also means the assistant is no longer just processing the current prompt. It is carrying forward retained context.
Fred Descloux / 6 min read / Aug 20, 2026
Privacy
Data Residency Is an Architecture Constraint, Not a Contract Clause
Data residency is often negotiated like a contract promise and then quietly broken by the architecture around it. The application may store customer records in the approved region while logs, support tools, exports, backups, analytics pipelines, and AI assistants create their own geography.
Fred Descloux / 6 min read / Aug 19, 2026
AppSec
AI Generated Code Needs a Merge Boundary, Not Prompt Policing
AI coding assistants are changing the speed and shape of software delivery. The mistake is treating prompt review as the control. The real security boundary is where generated code becomes product code.
Fred Descloux / 5 min read / Aug 18, 2026
Security Architecture
Audit Logs Are Product Features, Not Compliance Exhaust
A lot of application audit logging is built like exhaust. Something happened, the system emitted a record, and everyone hopes the record will be useful later. That hope gets expensive during an incident, customer question, regulator request, or internal dispute.
Fred Descloux / 7 min read / Aug 17, 2026
Security Architecture
Zero Drama Week: Convenience Is Not a Boundary
The features that create risk usually do not look dramatic. They look useful. Export a report. Help a customer. Search across internal knowledge. Retry a request after a timeout. The problem starts when those conveniences become the place where authority moves and nobody treats them like a control surface.
Fred Descloux / 6 min read / Aug 14, 2026
AppSec
API Idempotency Is a Security Control, Not Just Reliability Plumbing
Retries are normal. Duplicate business actions are not. Idempotency looks like reliability plumbing until an API creates the same order twice, sends the same payout twice, or approves the same workflow twice.
Fred Descloux / 6 min read / Aug 13, 2026