https://lunaroccultation.com/blog Field notes from the frontier of regulated AI. Audit checklists, threat patterns, architecture decisions. en-us https://lunaroccultation.com/favicon.svg https://lunaroccultation.com/blog https://lunaroccultation.com/blog/why-a-dsl-not-a-ui-builder https://lunaroccultation.com/blog/why-a-dsl-not-a-ui-builder Every AI governance product on the market has a UI builder. Here is the engineering case for why we gave Sentry a regex-first language instead — and why your platform team will actually prefer it. Mikael Eyob Fri, 27 Feb 2026 09:00:00 GMT SentryDSL Architecture https://lunaroccultation.com/blog/gateway-vs-sidecar-ai-governance https://lunaroccultation.com/blog/gateway-vs-sidecar-ai-governance You can enforce AI policies in two places: at the gateway or in a sidecar. The choice sounds academic. It is not. One passes an audit; the other does not. Priya Chandrasekaran Sat, 21 Feb 2026 09:00:00 GMT Architecture https://lunaroccultation.com/blog/eu-ai-act-article-14-checklist https://lunaroccultation.com/blog/eu-ai-act-article-14-checklist Article 14 — Human Oversight — is the one AI Act obligation your deploy pipeline interacts with every day. A ten-point checklist that passes a real audit. Harini Varma Fri, 20 Feb 2026 09:00:00 GMT Compliance EU AI Act https://lunaroccultation.com/blog/prompt-injection-patterns-we-block https://lunaroccultation.com/blog/prompt-injection-patterns-we-block Prompt injection isn't one attack — it's seven. Here are the regex families Sentry ships with by default, what each one actually matches, and where to extend them. Mikael Eyob Sat, 14 Feb 2026 09:00:00 GMT Security SentryDSL https://lunaroccultation.com/blog/twenty-million-dollar-ai-incident https://lunaroccultation.com/blog/twenty-million-dollar-ai-incident A Fortune 500 retailer, a customer service chatbot, and a single prompt injection that cost twenty million dollars in sixty-three days. Four controls that would have prevented it. Harini Varma Fri, 13 Feb 2026 09:00:00 GMT Case Study Security https://lunaroccultation.com/blog/signed-evidence-101 https://lunaroccultation.com/blog/signed-evidence-101 A regulator will ask one question: prove this decision was consistent with your stated policies on the day it happened. The one artifact that answers it. Priya Chandrasekaran Sat, 07 Feb 2026 09:00:00 GMT Architecture Audit