AI Governance and Red Teaming for a GenAI Platform
An AI management system built for certification, and 31 jailbreak paths closed before launch.
Client name withheld by agreement- Client
- Generative AI company
- Region
- U.S. and EU
- Year
- 2025 · Ongoing
- Duration
- 20 weeks
- Scope
- 6 production models · 40 agent tools
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A generative AI company was selling into banks and insurers whose procurement teams now asked for AI governance evidence, not slide decks. At the same time it was preparing to launch agents that could take actions inside customer systems.
Leadership needed two things at once: a management system an auditor would certify, and proof that the agents could not be talked into doing harm.
What we did
The approach, step by step.
- 01
AI system inventory
Six production models and every agent tool were registered with purpose, data, risk classification and an accountable owner.
- 02
ISO/IEC 42001 management system
Policy, impact assessments, lifecycle controls and monitoring were built to the standard and mapped to the NIST AI RMF and EU AI Act duties.
- 03
Adversarial testing
Our red team ran prompt injection, data exfiltration, tool misuse and jailbreak campaigns against models and agents under written rules of engagement.
- 04
Guardrails that hold
Findings became engineering fixes: tool permission scoping, output filtering, human approval for high-impact actions and continuous evaluation.
Outcomes
What changed, in numbers.
- 31
- jailbreak and injection paths closed before launch
- 40
- agent tools permission-scoped
- 6
- production models under governance
- 1
- management system ready for certification
Our enterprise customers stopped asking whether our AI is safe. They ask for the evidence, and we hand it over.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Austin, Texas · 14 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II Readiness for an HR PlatformA clean Type II report on the first audit window, and enterprise deals unblocked the same quarter.
-
Texas and Oklahoma · 26 weeks
AI, Cloud & Digital Trust · 2024Secure Cloud Landing Zone for a Health NetworkGuardrails in code across every account, with critical misconfigurations down 92% in two quarters.
-
North Texas · 16 weeks
AI, Cloud & Digital Trust · 2025CMMC Level 2 Readiness for a Defense SupplierAn SPRS score raised from 38 to 110 and a C3PAO assessment booked with confidence.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.