Controls in Practice
What are Compliance Shapes?
Compliance Shapes are the 20–30 consequential design decisions that determine how a company’s risks, controls, policies, evidence and compliance program should work.
By Paul WenhamAgentic Compliance
How can AI build, coordinate, and operate our program?
The three stages, context, Compliance Brain, permissions, human oversight, platforms, agent-produced evidence.
Start here
By Paul WenhamAgentic Compliance
Can AI run my compliance program?
AI can be your compliance manager, but a human still needs to be the compliance leader. How agentic compliance works, what it changes, and where accountability stays.
By Paul WenhamLatest insights
Compliance Planning
What SOC 2 looks like for an AI-native company
SOC 2 for AI-native companies: simpler stacks, agents running the program in your own tools, concise policies, and a report that covers AI in production.
By Paul WenhamAgentic Compliance
How to run your compliance program with AI: connectors, browser agents and a human in the loop
A practical guide to collecting SOC 2 and ISO 27001 evidence with AI: when to use connectors, when to use browser agents, when a human should act, and where audit evidence actually lives.
By Paul WenhamAgentic Compliance
Agentic Compliance: AI-Native, Human-Led
Compliance from first principles, the 95% problem, the compliance metadata AI needs, rethinking screenshots, spreadsheets and policies, and why audits should meet clients where they are.
By Paul WenhamAgentic Compliance
How do you build an agentic compliance program?
A practical architecture for agentic compliance: give AI a role, company context, system visibility, skills, bounded authority, escalation rules and human leadership.
By Paul WenhamControls in Practice
What are Compliance Shapes?
Compliance Shapes are the 20–30 consequential design decisions that determine how a company’s risks, controls, policies, evidence and compliance program should work.
By Paul WenhamAgentic Compliance
Can AI run my compliance program?
AI can be your compliance manager, but a human still needs to be the compliance leader. How agentic compliance works, what it changes, and where accountability stays.
By Paul WenhamAgentic Compliance
Do I still need a compliance platform?
How agentic compliance can reduce the need for a compliance platform, where platforms still add out-of-the-box value, and the question that matters: where do humans and AI do their teamwork?
By Paul WenhamAgentic Compliance
How do I give an AI agent enough context to manage my compliance program?
What a Compliance Brain is, the Compliance Metadata it should contain, and how to give an AI agent enough company context to manage a compliance program.
By Paul WenhamAgentic Compliance
Who can audit an agentic compliance program?
Who can audit a SOC 2 or ISO 27001 program run by AI agents, what auditors test for agent access and oversight, and how to choose an auditor for agentic compliance.
By Paul WenhamCompliance Strategy Workshop
What does this mean for your company?
Discuss your circumstances with a Throughline senior practitioner. A complimentary workshop to work through your goals, the decisions ahead and a practical path forward.