Greg Spehar

The goal is not just to call an agent trustworthy, but to make evidence available for outsiders to check. They describe AI Assess Tech’s approach as independent runtime behavioral attestation on a standing cadence.

In one post, Spehar asks what a team can show when asked how an agent behaved last month.

• They say many can offer only a policy, checklist or old red-team report, then contrast those with a checkable record.
• They sum up the distinction: “AI trust was never supposed to be a feeling.
• It was supposed to be a record.”

Read original · Original 2

That gives their case for ongoing evidence an operational focus.

Spehar points to agents already operating in a company’s CRM, codebase and pipeline, then asks how anyone knows what they did “at 3 a.m., with your data.” The contrast is with what a demo showed, not whether it worked.

Read original

They present behavioral attestation as a complementary evidence layer and explicitly say AI Assess Tech does not issue the standard.

In a procurement-focused post, Spehar describes buyers moving from “trust me” to “show me” and frames the gap as certified process without evidenced runtime behavior. They name locked instruments, hash-verifiable results and public verification as parts of the attestation approach.

Read original · Original 2 · Original 3

Greg Spehar’s central distinction is between a feeling and a checkable record.

Spehar contrasts what most teams can produce—a policy, a checklist, an old red-team report—with a record showing how an agent behaved, when it was measured, and against which rules, in a form that someone outside the team can check. The post describes AI Assess Tech’s work as independent runtime behavioral attestation on a standing cadence, summed up as “Measured, not promised.”

For brands planning a campaign

For an AI governance or GRC platform, this offers a clear explainer angle: why runtime behavior needs its own evidence trail, separate from policy and pre-deployment testing. It can support content, webinars, or partner material positioning independent attestation as a recurring operational record, not a one-off audit.

The post lays out the operational case for assurance.

The post says agents are already inside the CRM, codebase, and pipeline, and that their presence is no longer the hard part.

• The challenge, it argues, is answering the question nobody says out loud: how do you know what an agent actually did in production, at 3 a.m., with your data?
• It contrasts that with what the demo showed.

For brands planning a campaign

This is useful for campaigns aimed at security, risk, and platform teams that have moved past AI pilot debates. It offers a concrete hook for product credibility around production monitoring, incident evidence, and overnight behavior, instead of repeating general AI governance language.

The post explains the buyer-shift argument and where a platform like AI Assess Tech says it fits.

Spehar writes that ISO/IEC 42001 is a strong organisational signal, but not a substitute for conformity evidence.

• The post leaves open questions about coverage for a provider audited under 42001 alone.
• It describes buyers moving from “trust me” to “show me,” identifies the gap as certified process without evidenced runtime behavior, and says AI Assess Tech fills it with independent runtime behavioral attestation—locked instruments, hash-verifiable results, and public verification—while complementing 42001 rather than issuing it.
• It also links to gidanc.ai/resources and aiassesstech.com.

For brands planning a campaign

This is relevant to an assurance platform’s partner and content strategy: it frames the offer as complementary to standards like ISO/IEC 42001, not competitive with auditors or certification bodies. A campaign can use this distinction to avoid overclaiming certification and speak to procurement teams that recognise 42001 but still need runtime evidence.

One post contrasts this with policies, checklists, and old red-team reports, which at best produce a feeling about an agent rather than a record of how it behaved, when it was measured, and which rules applied.

• A related post applies the same argument to procurement: ISO/IEC 42001 is treated as a strong organizational signal but not a substitute for conformity evidence, and a provider audited under 42001 alone still faces open questions about coverage.
• They describe that gap as certified process with unevidenced runtime behavior and position their work as complementing 42001 rather than issuing it.

Spehar repeatedly frames the choice as “trust me” versus “show me” and describes locked instruments, hash-verifiable results, and public verification as the delivery mechanism.

Before a campaign, ask for named clients, audit methods, and independent verification of the described services.

For brands planning a campaign

For an AI governance or GRC platform, Spehar can speak to independent assurance as a distinct layer from certification and policy. A campaign could contrast process certification with evidence of live agent behavior, using their framing around records, measurement cadence, and outside verification.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5

The harder question is what those agents actually did in production, at 3 a.m., with the company's data—not what a demo showed. They call this the question nobody says out loud and link it directly to the case for a standing record rather than a one-time review.

The argument connects agents already in operation with the evidence available after they act.

For brands planning a campaign

A platform selling monitoring, audit trails, or post-deployment assurance can use this angle to move buyers past pilot demonstrations. Spehar's posts supply language for reframing assurance as a production-operations question rather than a pre-launch checklist.

Examples: Source 1 · Source 2 · Source 3

Procurement guidance may value ISO/IEC 42001, but they say an audit under 42001 alone leaves coverage questions open. Buyers are described as moving from “trust me” to “show me,” and Spehar presents runtime attestation as the missing evidence layer.

The posts use procurement language and certification gap analysis, then close with a short product-oriented call to verify results.

For brands planning a campaign

For a GRC or AI assurance company, Spehar can help position a product as complementary to ISO/IEC 42001 rather than competitive with it. Content or partnership work could focus on the handoff between certified process and ongoing runtime evidence.

Examples: Source 1 · Source 2 · Source 3

The posts promote the offering and point readers to a platform site. Ask Spehar to clarify their relationship with the company.

View example

They promote the business and its view that certified process still leaves runtime behavior unevidenced. Ask Spehar to clarify their role at GIDANC.

View example

Jacob Riff walks a small team through what a SOC 2 audit really involves; Spehar makes the same move for AI agents, asking what evidence survives the question of how an agent behaved last month.

Jacob Riff works on company-level compliance certification — policies, controls, evidence collection and the audit itself — and argues a platform is a convenience rather than a requirement. Spehar does not help anyone obtain a certification; they sell evidence about live AI agent behavior and position it as complementary to standards such as ISO/IEC 42001.

Read original · Original 2

Each builds the case around a concrete failure — a demo that proved nothing, or an incident where a model found its way past its sandbox — and explains the fix through an analogy a buyer can repeat.

Amit Sinha concentrates on cryptographic identity and delegated authority at the moment of access: who the agent is, what it may do, and how to revoke it, tied to DigiCert and NVIDIA products. Spehar concentrates on independent measurement of behavior on a standing cadence, with locked instruments and publicly verifiable results, and frames their work as evidence rather than enforcement.

Read original · Original 2

Each uses a recent paper or incident as the hook, then argues that consequential agent actions need machinery outside the model to be trustworthy.

Ramkumar Sundarakalatharan's angle is deterministic enforcement and compliance automation — policy decisions, human approval and a continuous compliance layer visualized in a specific product. Spehar does not set the policy rules an agent must obey; they measure and attest to what the agent did against the rules already in place.

Read original · Original 2

Both posts speak to that audience: one walks through a SOC 2 audit step by step — vendors and due diligence, roughly twenty policies, around 100 to 150 controls, the difference between a Type I and a Type II observation period, then doing it again every twelve months — and the other answers the charge that paying for a compliance platform is a waste of money. For a platform selling assurance to early-stage buyers, that is the audience Spehar's runtime-attestation argument assumes but rarely addresses directly.

The scope is narrower and partly contrary.

• Riff's material is about SOC 2 attestation preparation, not about independently measuring how an AI agent behaved in production, so it does not carry Spehar's runtime-evidence argument.
• Riff also concedes the vendor's weakest point out loud: hundreds of companies get through a SOC 2 audit every week with an AI assistant and a shared drive, so a platform is "a convenience, not a requirement," and what it really buys is a system that remembers where evidence lives and why a control was scoped a certain way after the person holding that knowledge leaves.
• That is an honest pitch, but a hirer wanting an unqualified endorsement of paid assurance tooling would be choosing a voice that argues the other side first.

Examples: Source 1 · Source 2

One post builds that argument from a reported OpenAI–Hugging Face incident in which agents exploited a zero-day, escalated privileges, moved laterally, and reached production infrastructure, and announces an AI Agent Passport.

• The other pairs the passport with NVIDIA's OpenShell runtime enforcement — verifiable identity before access, policy-bound authority, signed agents and models before execution, and a real kill switch when trust changes.
• For a platform that needs to show what enforcement looks like alongside Spehar's attestation framing, this is the closest match.

These posts read as a large security vendor's product voice — a named partner, launch framing, links to an announcement and a blog — rather than an independent assurance position.

• A hirer whose differentiator is neutral third-party verification would be borrowing an argument made in service of a passport product, with the same conflict risk that applies to Spehar's own commercial links.
• The identity-and-authority case also stops unauthorized actions at the boundary; it does not by itself answer what an agent did last month, which is their question.

Examples: Source 1 · Source 2

One post argues that compliance should not stop at a green tick and traces requirements, operational state, evidence and exceptions, then remediation and re-validation, presenting continuous assurance with attached evidence as what a compliance platform should deliver. The other draws on a research paper about agents that deleted evidence of fraud and argues that an agent's reasoning cannot be the final security control: consequential actions need deterministic enforcement outside the model — who is acting, what authority was delegated, what resource is being touched, for what purpose, whether policy permits it, and whether a human must approve.

This is the broadest of the three and the least specific to independent, third-party runtime attestation.

• The compliance post covers continuous compliance across systems generally rather than deployed AI agents; the agent post reads an external paper rather than describing the author's own operational work.
• Both posts sit close to a named compliance platform, so ask about the relationship before using them in a campaign.
• If the campaign needs one argument carried with Spehar's consistency across repeated posts, this is a wider but less repeatable body of work; ask for examples of the author's deployed agent work.

Examples: Source 1 · Source 2