https://cordum.io/blog AI agent governance, security, and control plane insights from the Cordum team. en-us Thu, 02 Apr 2026 00:00:00 GMT https://cordum.io/blog/claude-code-leak-agent-control-plane-lessons https://cordum.io/blog/claude-code-leak-agent-control-plane-lessons Deep analysis of the Claude Code source leak. What the exposed harness reveals about permissions, context governance, and the controls every AI agent team should implement now. Thu, 02 Apr 2026 00:00:00 GMT Claude Code Leak Agent Control Plane AI Agent Governance AI Agent Security Cordum Team https://cordum.io/blog/ai-agent-security-risks-enterprise-attack-vector https://cordum.io/blog/ai-agent-security-risks-enterprise-attack-vector A data-driven enterprise guide to AI agent security risks with top-source gap analysis, runtime control matrix, policy code, and rollout tradeoffs. Wed, 01 Apr 2026 00:00:00 GMT Security Governance OpenClaw Control Plane SEO Team https://cordum.io/blog/openclaw-security-comparison-cordclaw-vs-nemoclaw https://cordum.io/blog/openclaw-security-comparison-cordclaw-vs-nemoclaw A technical comparison of OpenClaw security options with implementation examples, failure tradeoffs, and deployment recommendations. Wed, 01 Apr 2026 00:00:00 GMT OpenClaw CordClaw NemoClaw Security SEO Team https://cordum.io/blog/how-to-secure-openclaw-agents-in-production https://cordum.io/blog/how-to-secure-openclaw-agents-in-production A complete guide to secure OpenClaw agents in production with deterministic pre-dispatch governance, approval gates, fail-mode controls, and audit evidence. Wed, 01 Apr 2026 00:00:00 GMT OpenClaw CordClaw Security Governance SEO Team https://cordum.io/blog/pre-dispatch-vs-post-hoc-agent-safety https://cordum.io/blog/pre-dispatch-vs-post-hoc-agent-safety A technical comparison of pre-dispatch governance for AI agents and post-hoc safety with real control-plane timing, fail modes, and validation checks. Wed, 01 Apr 2026 00:00:00 GMT Governance Security Control Plane AI Agents SEO Team https://cordum.io/blog/zero-to-governed-cordclaw-setup-tutorial https://cordum.io/blog/zero-to-governed-cordclaw-setup-tutorial Step-by-step AI agent governance platform setup for OpenClaw using CordClaw: install, validate decisions, tune policy profiles, and harden rollout. Wed, 01 Apr 2026 00:00:00 GMT CordClaw OpenClaw Governance Tutorial SEO Team https://cordum.io/blog/agent-orchestration-patterns-cordum-architecture https://cordum.io/blog/agent-orchestration-patterns-cordum-architecture A production guide to AI agent orchestration with code-accurate control-plane architecture, reliability guardrails, and rollout runbooks. Wed, 01 Apr 2026 00:00:00 GMT Orchestration Architecture Reliability AI Agents SEO Team https://cordum.io/blog/building-custom-safety-policies-for-ai-agents https://cordum.io/blog/building-custom-safety-policies-for-ai-agents A production playbook for deterministic AI policy enforcement: rule design, signature verification, simulation, and safe rollout for autonomous agents. Wed, 01 Apr 2026 00:00:00 GMT Policy Security Governance AI Agents SEO Team https://cordum.io/blog/prompt-injection-vs-out-of-process-governance https://cordum.io/blog/prompt-injection-vs-out-of-process-governance A production guide to prompt-injection mitigation for AI agents using out-of-process governance, fail-mode controls, and deterministic action boundaries. Wed, 01 Apr 2026 00:00:00 GMT Security Governance Reliability AI Agents SEO Team https://cordum.io/blog/ai-agent-preferred-worker-routing-hints https://cordum.io/blog/ai-agent-preferred-worker-routing-hints A production guide to `preferred_worker_id` and `preferred_pool` routing behavior in AI agent schedulers, based on Cordum's least-loaded strategy logic and test coverage. Wed, 01 Apr 2026 00:00:00 GMT Scheduling Reliability Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-stale-worker-dispatch-retries https://cordum.io/blog/ai-agent-stale-worker-dispatch-retries A production guide to stale worker handling in AI agent schedulers, using Cordum's `maxDispatchRetries=3`, worker TTL behavior, and retry classification path. Wed, 01 Apr 2026 00:00:00 GMT Scheduling Reliability Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-state-read-fail-closed-dispatch https://cordum.io/blog/ai-agent-state-read-fail-closed-dispatch A production guide to fail-closed scheduler behavior when job-state reads fail, using Cordum's `GetState` guard, retry path, and duplicate-dispatch prevention tests. Wed, 01 Apr 2026 00:00:00 GMT Reliability Redis Scheduling AI Agents SEO Team https://cordum.io/blog/ai-agent-dispatch-rollback-consistency https://cordum.io/blog/ai-agent-dispatch-rollback-consistency Prevent duplicate dispatch under at-least-once redelivery using state-before-publish ordering, rollback paths, and lifecycle regression tests. Wed, 01 Apr 2026 00:00:00 GMT Reliability Scheduling NATS AI Agents SEO Team https://cordum.io/blog/ai-agent-no-pool-mapping-retry-policy https://cordum.io/blog/ai-agent-no-pool-mapping-retry-policy A production guide to `no_pool_mapping` handling in AI agent control planes, using Cordum scheduler code paths: retry classification, backoff math, and DLQ terminal semantics. Wed, 01 Apr 2026 00:00:00 GMT Scheduling Reliability Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-error-code-enum-migration https://cordum.io/blog/ai-agent-error-code-enum-migration Migrate legacy string errors to structured enums in AI agent control planes with safer scheduler mapping, test coverage, and failure telemetry. Wed, 01 Apr 2026 00:00:00 GMT Reliability APIs Observability AI Agents SEO Team https://cordum.io/blog/ai-agent-dlq-emission-reliability https://cordum.io/blog/ai-agent-dlq-emission-reliability A production guide to DLQ emission reliability in AI agent control planes, with Cordum's sink-first write path, single 500ms retry policy, and failure telemetry design. Wed, 01 Apr 2026 00:00:00 GMT Reliability DLQ Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-retry-intent-propagation https://cordum.io/blog/ai-agent-retry-intent-propagation A production guide to preserving retry intent across scheduler, bus, and JetStream boundaries with contract-safe error types, delay mapping, and validation checks. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS gRPC AI Agents SEO Team https://cordum.io/blog/ai-agent-run-lock-busy-retry-jitter https://cordum.io/blog/ai-agent-run-lock-busy-retry-jitter A production guide to lock-busy retry strategy in AI agent control planes, with Cordum's fixed 500ms path, queue-level effects, and bounded jitter rollout checks. Wed, 01 Apr 2026 00:00:00 GMT Concurrency Reliability Workflow AI Agents SEO Team https://cordum.io/blog/ai-agent-lock-release-retry-vs-ttl https://cordum.io/blog/ai-agent-lock-release-retry-vs-ttl A production guide to distributed lock release-failure handling for AI agent control planes, comparing retry-on-release and TTL-only recovery paths in Cordum. Wed, 01 Apr 2026 00:00:00 GMT Concurrency Reliability Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-lock-renewal-failure-policy https://cordum.io/blog/ai-agent-lock-renewal-failure-policy A production guide to lock renewal failure policy in AI agent control planes, comparing Cordum scheduler fencing logic with workflow warn-only behavior. Wed, 01 Apr 2026 00:00:00 GMT Concurrency Reliability Workflow AI Agents SEO Team https://cordum.io/blog/ai-agent-distributed-lock-fallback https://cordum.io/blog/ai-agent-distributed-lock-fallback A production guide to distributed lock fallback policy for AI agent control planes, with Cordum's local-only fallback behavior, risk envelope, and runbook checks. Wed, 01 Apr 2026 00:00:00 GMT Concurrency Reliability Workflow AI Agents SEO Team https://cordum.io/blog/ai-agent-lock-token-ownership https://cordum.io/blog/ai-agent-lock-token-ownership Prevent `lock not owned` incidents in distributed AI agent control planes with compare-and-release scripts, renew semantics, and ownership runbooks. Wed, 01 Apr 2026 00:00:00 GMT Concurrency Reliability Redis AI Agents SEO Team https://cordum.io/blog/ai-agent-approval-idempotency-already-approved https://cordum.io/blog/ai-agent-approval-idempotency-already-approved Design retry-safe approval APIs for AI agents with `already_approved` and `already_rejected` semantics, dedup keys, and deterministic runbook checks. Wed, 01 Apr 2026 00:00:00 GMT Approvals Idempotency Reliability AI Agents SEO Team https://cordum.io/blog/ai-agent-approval-policy-snapshot-drift https://cordum.io/blog/ai-agent-approval-policy-snapshot-drift Prevent stale approvals by validating policy snapshots and job hashes at approval time, with clear failure modes and rollout-safe runbook checks. Wed, 01 Apr 2026 00:00:00 GMT Approvals Policy Reliability AI Agents SEO Team https://cordum.io/blog/ai-agent-approval-lock-contention-409-vs-423 https://cordum.io/blog/ai-agent-approval-lock-contention-409-vs-423 A production guide to approval lock contention handling in AI agent control planes, with Cordum lock constants, HTTP status tradeoffs, and retry-safe runbook checks. Wed, 01 Apr 2026 00:00:00 GMT Approvals Concurrency HTTP AI Agents SEO Team https://cordum.io/blog/ai-agent-idempotency-payload-mismatch https://cordum.io/blog/ai-agent-idempotency-payload-mismatch A production guide to idempotency payload mismatch handling in AI agent control planes, with Cordum run-start behavior, test gaps, and safer validation patterns. Wed, 01 Apr 2026 00:00:00 GMT Idempotency Reliability Workflow AI Agents SEO Team https://cordum.io/blog/ai-agent-workflow-admission-429-vs-503 https://cordum.io/blog/ai-agent-workflow-admission-429-vs-503 A production guide to 429 vs 503 handling for AI agent workflow admission, with Cordum status paths, retry policy tradeoffs, and practical runbook checks. Wed, 01 Apr 2026 00:00:00 GMT Reliability Workflow HTTP AI Agents SEO Team https://cordum.io/blog/ai-agent-workflow-admission-lock-jitter https://cordum.io/blog/ai-agent-workflow-admission-lock-jitter A production guide to workflow admission lock behavior in AI agent control planes, with Cordum lock constants, contention tests, and jitter tradeoffs. Wed, 01 Apr 2026 00:00:00 GMT Reliability Workflow Concurrency AI Agents SEO Team https://cordum.io/blog/ai-agent-workflow-idempotency-reservation https://cordum.io/blog/ai-agent-workflow-idempotency-reservation Prevent poisoned idempotency keys under concurrency rejection with cleanup paths, Redis TTL guardrails, and retry-safe workflow runbooks. Wed, 01 Apr 2026 00:00:00 GMT Idempotency Reliability Workflow AI Agents SEO Team https://cordum.io/blog/ai-agent-worker-pool-draining-timeout https://cordum.io/blog/ai-agent-worker-pool-draining-timeout A production guide to worker pool draining in AI agent control planes, with Cordum API behavior, 10 second drain checks, and timeout-driven inactive transitions. Wed, 01 Apr 2026 00:00:00 GMT Operations Reliability Scheduling AI Agents SEO Team https://cordum.io/blog/ai-agent-grpc-graceful-stop-timeout https://cordum.io/blog/ai-agent-grpc-graceful-stop-timeout A production guide to gRPC GracefulStop timeout handling for AI agent control planes, with Cordum shutdown ordering, forced-stop fallback, and test patterns. Wed, 01 Apr 2026 00:00:00 GMT gRPC Reliability Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-msg-id-dedup-window https://cordum.io/blog/ai-agent-nats-msg-id-dedup-window A production guide to NATS Msg-Id design for AI agent control planes, with Cordum code paths for dedup windows, approval retries, and long-horizon idempotency. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Idempotency AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-jetstream-poison-message-term https://cordum.io/blog/ai-agent-nats-jetstream-poison-message-term A production guide to JetStream poison-message handling in AI agent control planes, with Cordum's DLQ-before-Term ordering and crash-window analysis. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-subject-durability-map https://cordum.io/blog/ai-agent-nats-subject-durability-map A production guide to Core NATS vs JetStream durability boundaries in AI agent control planes, with Cordum's actual subject map and operator tradeoffs. Wed, 01 Apr 2026 00:00:00 GMT Architecture NATS Reliability AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-slow-consumer-guardrails https://cordum.io/blog/ai-agent-nats-slow-consumer-guardrails Set pending limits and callbacks for NATS slow consumers in AI agent control planes, including core-vs-JetStream behavior and alert instrumentation. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-drain-vs-close https://cordum.io/blog/ai-agent-nats-drain-vs-close A production guide to NATS Drain vs Close behavior for AI agent control planes, with Cordum shutdown code paths, publish-path risk boundaries, and safer teardown patterns. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-client-cert-rotation https://cordum.io/blog/ai-agent-nats-client-cert-rotation A production guide to NATS client certificate rotation for AI agent control planes, with Cordum runtime details, reconnect timing math, and rollout-safe patterns. Wed, 01 Apr 2026 00:00:00 GMT Security NATS Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-reconnect-observability https://cordum.io/blog/ai-agent-nats-reconnect-observability A production guide to NATS reconnect observability in AI agent control planes, with Cordum callback hooks, metric patterns, and alerting runbooks. Wed, 01 Apr 2026 00:00:00 GMT Observability NATS Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-publish-confirmation-core-vs-jetstream https://cordum.io/blog/ai-agent-nats-publish-confirmation-core-vs-jetstream A production guide to publish confirmation boundaries in NATS, with Cordum's subject routing policy and practical Core-vs-JetStream tradeoffs. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Architecture AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-reconnect-buffer-sizing https://cordum.io/blog/ai-agent-nats-reconnect-buffer-sizing A production guide to NATS reconnect buffer sizing for AI agent control planes, with Cordum publish-path boundaries and outage-focused tuning checks. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-reconnect-jitter-storm-control https://cordum.io/blog/ai-agent-nats-reconnect-jitter-storm-control A production guide to NATS reconnect jitter in AI agent control planes, with Cordum default behavior, failure-shape analysis, and staged rollout tuning. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Resilience AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-cold-start-reconnect https://cordum.io/blog/ai-agent-nats-cold-start-reconnect A production guide to NATS cold-start behavior in AI agent control planes, with Cordum startup code paths, failure modes, and rollout-safe mitigation options. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-auth-precedence https://cordum.io/blog/ai-agent-nats-auth-precedence A production guide to NATS auth precedence for AI agent control planes, with Cordum's exact user/pass > token > nkey resolution logic and rollout checks. Wed, 01 Apr 2026 00:00:00 GMT Security NATS Authentication AI Agents SEO Team https://cordum.io/blog/ai-agent-nats-tls-enforcement https://cordum.io/blog/ai-agent-nats-tls-enforcement A production guide to NATS TLS enforcement for AI agent control planes, with Cordum production guards, override traps, and auth layering tradeoffs. Wed, 01 Apr 2026 00:00:00 GMT Security NATS Operations AI Agents SEO Team https://cordum.io/blog/ai-agent-jetstream-broadcast-semantics https://cordum.io/blog/ai-agent-jetstream-broadcast-semantics A production guide to JetStream broadcast vs queue semantics with Cordum's durable-name strategy, fanout guarantees, and failure tradeoffs. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Scheduler AI Agents SEO Team https://cordum.io/blog/ai-agent-maxackpending-tuning https://cordum.io/blog/ai-agent-maxackpending-tuning A production guide to tuning NATS JetStream MaxAckPending for AI agent schedulers, with concrete Cordum defaults, hard limits, and failure tradeoffs. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Backpressure AI Agents SEO Team https://cordum.io/blog/ai-agent-ackwait-dedup-ttl-alignment https://cordum.io/blog/ai-agent-ackwait-dedup-ttl-alignment A production guide to aligning JetStream AckWait with Redis dedup TTL to reduce post-crash duplicate processing in AI agent control planes. Wed, 01 Apr 2026 00:00:00 GMT Reliability NATS Redis AI Agents SEO Team https://cordum.io/blog/ai-agent-worker-heartbeat-warm-start https://cordum.io/blog/ai-agent-worker-heartbeat-warm-start A production guide to AI agent worker heartbeat warm-start with Redis snapshots, lock-safe writers, and concrete Cordum TTL tradeoffs. Wed, 01 Apr 2026 00:00:00 GMT Reliability Scheduler Heartbeats AI Agents SEO Team https://cordum.io/blog/ai-agent-config-reload-convergence https://cordum.io/blog/ai-agent-config-reload-convergence Implement safe config reload convergence with NATS broadcasts, polling fallback, hash-based apply gating, and scheduler-safe rollout patterns. Wed, 01 Apr 2026 00:00:00 GMT Reliability Configuration Scheduler AI Agents SEO Team https://cordum.io/blog/ai-agent-stuck-job-recovery-pending-replayer https://cordum.io/blog/ai-agent-stuck-job-recovery-pending-replayer A production guide to recovering stuck AI agent jobs with pending replay, timeout reconciler tuning, and concrete Cordum lock and timeout behavior. Wed, 01 Apr 2026 00:00:00 GMT Reliability Queue Recovery Scheduler AI Agents SEO Team