Dtwo Blog

6 min read

AI governance evaluation

Expressiveness and usability. Everything else on the vendor's feature list is one of those two in disguise.

Dtwo turns "we can't risk it"into "we can govern it."

Visit dtwo.ai

Recently published

  1. Adaptive PoliciesA policy written once is wrong by next quarter. Here is the design we are building toward: policies that tighten and widen from how your workforce actually uses AI, from real-time signals like a new CVE, with a human accepting every change.
  2. Why Agentic AI Needs Dynamic SafeguardsStatic permissions judge each AI agent action alone. Dynamic safeguards react to what the agent already did in the session, so you can say yes to agents on sensitive data.
  3. How we are building our AI GTM System at DtwoHow Dtwo is building an AI GTM system where agents do real work across the stack, and policy decides what they're allowed to do.
  4. AI Blast RadiusOf all the questions to ask before handing an AI agent access to your systems, one does most of the work: if this goes wrong, what is the worst that can happen? Four versions of that question, and how to act on the answers.
  5. NVIDIA OpenShell governs reachability. Dtwo governs meaning.NVIDIA's OpenShell, announced September 28, decides what an agent can reach. Dtwo sits in its middleware hook and judges each call by its arguments and by what the session already did elsewhere. If you run agents in OpenShell, you still need that layer.
  6. AI governance evaluationExpressiveness and usability. Everything else on the vendor's feature list is one of those two in disguise.
  7. I sell agent security. So I gave my agents a boss.Our founding AE runs his entire sales job through Dtwo — prospecting, CRM, call prep, follow-up — and explains what a single control point actually buys you.
  8. The Wrong Chris Problem: Why AI Agents Need Smarter GuardrailsThere are two Chrises in our Slack — a coworker and a customer. Here's the policy I wrote so an agent picking the wrong one can't turn into a data breach, and what I learned when a policy went too far the other way.
  9. Connecting Claude to Microsoft 365, SafelySecurity teams keep saying no when users ask to connect Claude to email. The problem isn't access, it's granularity. Here's what a yes can look like.
  10. My Claude GuardrailsClaude Code can access our internal systems. Here are the guardrails: the policies that decide what my AI agent can actually reach, all published in our policy catalog.
  11. Code got cheap. Architecture got iterative.Cheap implementation moved the work upstream. Every architectural decision is now recorded in the same repo as code. It becomes the context for everything built after it, and gets revised when we turn out to be wrong.
  12. How CarNow Drove AI Adoption and Developer Productivity with DtwoCarNow consolidated access into a single Dtwo gateway to drive AI adoption and measurable productivity gains across its engineering team.
  13. Good policy is the hard part. So we're sharing ours.The risk from AI agents isn't any one system — it's the path between them. Policy guards that path. It's hard to write — so we open-sourced a library of policies.
  14. Audit kept us honest. Agents don't care.Audit worked because people feared getting caught. AI agents don't — so agent security must shift from audit to authorization across every system.
  15. Securing Claude CoworkA practical guide to rolling out Claude Cowork safely: restrict risky access paths, route MCP through a policy layer, and monitor what your agents actually do.
  16. Agentic AI security: why legacy controls fail AI agentsLegacy security controls were built for humans, not AI agents — that's why agentic AI security and governance are breaking. Here's the gap, and how to close it.
  17. Intent-Based Policies for AIThe policy model that closes the gap between what organizations mean and what their controls enforce.
    Get in touch

    Tell us what you need to govern.

    A few lines is plenty — what you're deploying, and what you need control over. We read every one.