AI Agent Governance & Security

In practice

Aesthetic Nurse Software needed a platform that respected the clinical, regulatory, and operational realities of its users: appointments, consent, clinical records, and payments, without the bloat of a generic practice tool. Governance work starts in the same place. Who can act, what they can touch, and what you can show later.

Make AI safe to ship, and able to be proven

Boards and risk committees are not blocking AI because the technology does not work. They are blocking it because nobody can answer their questions: who can it act on behalf of? What did it do last Tuesday? How do we stop it doing X?

We build the governance layer that answers those questions. It is for agents that act, not just chatbots that talk.

What we cover

• Identity and permissions: agents inherit the access of the user they're acting for, never more.
• Action allowlists and rate limits: preventing runaway behaviour and protecting downstream systems.
• Comprehensive audit logging: every prompt, tool call, and outcome captured for review.
• Evaluation pipelines: continuous regression tests so model upgrades don't silently degrade performance.
• Privacy and data residency: alignment with the Australian Privacy Act, Notifiable Data Breaches scheme, and sector-specific requirements (APRA CPS 230, ISO 27001, SOC 2).
• Incident playbooks: clear procedures for the day something does go wrong.