Enterprise AI has entered a new era. Organizations are rapidly moving beyond assistants that answer questions to autonomous agents capable of reasoning, invoking tools, accessing enterprise applications, coordinating with other agents, and completing multi-step business workflows with minimal human intervention.

This shift represents a fundamental change in how software operates. Traditional applications execute predefined logic written by developers. AI agents, however, dynamically determine how to achieve an objective. They decide which tools to use, which APIs to call, what information to retrieve, and how to sequence actions based on context. That flexibility unlocks enormous business value, but it also introduces a new class of security risks.

Much of today’s AI security discussion focuses on prompt injection, model vulnerabilities, and data leakage. These are important concerns, but they represent only part of the challenge. Once an AI agent has successfully authenticated and begins acting autonomously, traditional security controls provide very little visibility into whether it continues to operate safely.

This is where enterprises need to adopt a new security mindset: runtime trust.

Authentication establishes identity, not trust

Enterprise security has traditionally relied on three foundational questions: Who are you, what can you access, and what actions are you authorized to perform. Identity providers, multi-factor authentication (MFA), role-based access control, and zero trust architectures answer these questions effectively for human users and conventional applications, and NIST’s zero trust guidance remains a solid reference point for how those principles are meant to work (NIST SP 800-207).

AI agents introduce a different problem. An AI agent may legitimately authenticate using an enterprise identity, receive valid API credentials, and be granted access to systems like Microsoft 365, ServiceNow, Salesforce, or GitHub. From an identity perspective, everything appears correct. The real challenge begins after authentication: During execution, the agent continuously reasons, interprets objectives, invokes tools, retrieves information, and adapts its behavior based on new context, and security teams must determine whether those actions remain aligned with the user’s intent and organizational policy. Authentication verifies who an AI agent is. Runtime trust continuously verifies what it is doing.

Enterprise AI is becoming an autonomous workforce

Modern AI agents increasingly interact with large language models (LLMs), Model Context Protocol (MCP) servers, retrieval-augmented generation (RAG) systems, vector databases, enterprise APIs, SaaS platforms, and internal knowledge repositories, as well as other AI agents. This interconnected ecosystem enables sophisticated automation but dramatically expands the attack surface: A single compromised tool, poisoned knowledge source, overly permissive API, or manipulated prompt can influence downstream decisions across an entire workflow, and unlike traditional software, these risks evolve during execution rather than being fixed at deployment.

That expanding surface is exactly what a handful of runtime threats exploit.

Goal drift happens when an agent begins with a legitimate objective but gradually deviates from the user’s original intent while attempting to optimize outcomes. An agent tasked with preparing a customer report, for instance, might autonomously retrieve unrelated confidential information because it incorrectly determines that additional context would improve the response.

Excessive tool invocation is what happens when autonomous agents with access to numerous enterprise tools call unnecessary APIs, modify configurations, access sensitive repositories, or perform administrative actions simply because the model believes those actions are useful, absent any runtime controls to stop it.

Memory poisoning exploits the persistent memory that improves personalization: Attackers can intentionally insert misleading instructions into long-term memory or retrieval systems, causing future decisions to be influenced by malicious or outdated information.

Context manipulation takes advantage of how heavily LLMs depend on context: If attackers influence retrieved documents, system prompts, conversation history, or external data sources, they can indirectly steer autonomous behavior without ever compromising the underlying model. MITRE’s ATLAS framework catalogs this kind of adversarial behavior against AI systems in useful detail.

Multi-agent amplification emerges as organizations deploy specialized AI agents that collaborate: If one agent behaves incorrectly, downstream agents may trust and amplify those actions, creating cascading failures across enterprise workflows.

Introducing runtime trust

Runtime trust extends security beyond authentication by continuously validating AI behavior throughout execution. Rather than assuming authenticated agents remain trustworthy indefinitely, it continuously evaluates whether autonomous decisions remain aligned with organizational policy. A runtime trust architecture rests on several complementary capabilities.

Intent validation evaluates, before executing sensitive actions, whether proposed behavior still matches the user’s original objective: Is this action necessary? Is it expected? Does it exceed the requested scope? Would a reasonable human perform the same action?

Behavioral monitoring observes tool usage, API activity, reasoning patterns, execution frequency, delegated actions, and abnormal workflows, so unexpected behavior becomes immediately visible rather than remaining hidden inside model reasoning.

Policy enforcement means enterprise policies govern what AI agents can do, not merely what they can access — blocking financial transactions above approval thresholds, preventing privilege modifications, restricting administrative operations, limiting sensitive data retrieval, and requiring approval for high-risk actions. These controls function much like application firewalls for autonomous decision-making.

Least-privilege execution means AI agents receive only the capabilities necessary for the current task. Instead of granting permanent access to dozens of enterprise tools, organizations should dynamically issue short-lived permissions based on runtime context, an approach that OWASP’s guidance for agentic applications increasingly emphasizes (OWASP GenAI Security Project).

Human oversight recognizes that not every decision should be autonomous — high-impact operations, including financial approvals, identity changes, regulatory actions, or customer-impacting decisions, should require explicit human confirmation before execution.

Protecting the enterprise AI ecosystem

Runtime trust also extends beyond individual agents. As MCP adoption accelerates, enterprises should verify trusted servers, authenticated tools, approved capabilities, monitored interactions, and policy enforcement. RAG knowledge repositories require document integrity, source validation, access control, retrieval auditing, and poisoning detection. Persistent AI memory should implement lifecycle management, expiration policies, integrity verification, access logging, and sensitive data protection.

Building operational visibility

One of the biggest challenges in enterprise AI is observability. Security teams need visibility into why an agent selected particular tools, which data influenced its decisions, how it reached its conclusions, what actions it executed, whether policies were triggered, and which safeguards prevented unsafe behavior. Runtime logging, audit trails, and behavioral analytics are becoming essential components of enterprise AI operations, not optional add-ons.

A practical roadmap

Organizations do not need to rebuild existing security programs. Instead, they should extend them by incorporating runtime trust into existing governance processes. Practical first steps include inventorying AI agents and their capabilities, applying least-privilege access to tools and APIs, classifying high-risk autonomous actions, implementing runtime policy enforcement, monitoring behavioral anomalies continuously, protecting memory and RAG data sources, requiring human approval for critical operations, and integrating AI runtime telemetry into existing SOC workflows.

Looking ahead

Enterprise AI will continue evolving toward increasingly autonomous systems capable of collaborating, planning, and executing complex business processes. Security strategies must evolve alongside them. The question is no longer whether an AI agent successfully authenticated. The more important question is whether it continues to behave safely throughout its entire lifecycle. Organizations that adopt continuous runtime governance today will be significantly better positioned to deploy autonomous AI responsibly, reduce operational risk, and build the confidence necessary for large-scale enterprise AI adoption.

The future of AI security will not be defined solely by stronger models or better authentication. It will be defined by our ability to establish, measure, and continuously verify trust while intelligent systems are making decisions in real time.

Ravindra Annam is a cyber security architect.

Welcome to the VentureBeat community!

Our guest posting program is where technical experts share insights and provide neutral, non-vested deep dives on AI, data infrastructure, cybersecurity and other cutting-edge technologies shaping the future of enterprise.

Read more from our guest post program — and check out our guidelines if you’re interested in contributing an article of your own!

For someone who has a degree in journalism and a master’s in English, I should read more than I actually do.

But movies are my thing, and apps like Letterboxd encourage me to broaden my cinematic horizons. That said, there’s one app that’s lifted me out of my years-long reading slump — and no, it’s not Goodreads.

Hidden cameras keep turning up in sneaky spots, tucked inside pen, clock, chargers, or picture frames in hotel rooms and rentals. This is why researchers at KAIST built a fix that costs less than a nice lunch. Their new tool, called SweepLED, turns any smartphone into a reliable hidden camera detector using an attachable LED case that costs under $7 to build.

Why your current hidden camera detector probably isn’t working

Most handheld detectors rely on a pretty basic trick, shine light at something and look for a bright reflection bouncing back. The problem is that glass, metal, and shiny plastic all bounce light back too, which means you’re stuck squinting at chargers and clocks trying to guess whether that glint is a lens or just a coincidence.

SweepLED eliminates the guesswork entirely. Instead of moving the light and the viewing angle together, it keeps the phone’s camera locked in place and sweeps the LED light from different directions instead. That’s crucial because a camera lens has an internal structure, aperture, sensor, and layered glass, so its reflection warps and deforms in a very specific way as the light angle shifts. Ordinary shiny surfaces just don’t do that.

How SweepLED works

SweepLED records the whole light sweep as a short video, then runs it through an AI model trained to spot those telltale lens deformations, flagging exactly where a hidden camera might be hiding. Researchers tested it against 30 everyday objects you’d realistically find in a hotel room or rental, and it caught hidden cameras with about 94% accuracy, all in under five seconds per object.

A recent UCL study found people using consumer hidden camera detectors still missed 59% of devices in testing, so SweepLED’s 94% lab result is a strong sign, with real world testing likely next.

Led by Professor Jun Han at KAIST’s School of Computing, working alongside researchers from the National University of Singapore and Singapore Management University, the project was presented earlier this year at ACM MobiSys 2026. It’s not a shipping product yet, but the underlying idea is simple enough that it could realistically show up in an actual gadget before long.

Sony Music Publishing and Warner Chappell have sued Anthropic in California over song lyrics allegedly taken from pirate archives, naming Dario Amodei and Benjamin Mann personally and seeking up to $150,000 per composition. A Munich court ruled in November 2025 that memorising lyrics inside a model is reproduction and that the text and data mining exception does not cover it.

Sony Music Publishing and Warner Chappell have sued Anthropic in a Northern California court. Dario Amodei and Benjamin Mann are named personally, Business Insider reported.

The language is not restrained. The publishers allege a “brazen campaign of illegally torrenting, scraping, and downloading copyrighted works on a massive scale“.

The works named are familiar. Eye of the Tiger, Hallelujah, September, Livin’ On a Prayer and Great Balls of Fire are among them, alongside Mariah Carey and Taylor Swift compositions.

The route alleged is one Anthropic has been here for before. The complaint points to Library Genesis and Pirate Library Mirror, the same archives behind the $1.5B settlement it reached with authors.

The publishers want a jury and statutory damages. Up to $150,000 for each composition used in training, which is the statutory ceiling for wilful infringement rather than a figure any court has awarded.

Set that against what the last case paid. Authors received about $3,000 a title, split with their publisher, leaving roughly $1,500 each side.

The gap between those two figures is the whole negotiation. One is a number two sides agreed on, the other is an opening demand in a case nobody has answered yet.

A European court has already answered a version of this question, and it was about song lyrics too. The defendant was a different company.

The Regional Court of Munich ruled against OpenAI in November 2025, finding that memorising lyrics inside a model is reproduction, and that outputs reciting them are communication to the public.

It also found the text and data mining exception did not cover it. Permanent memorisation goes beyond transient analysis, and the rightsholder had opted out. The judgment is not final.

Europe’s exception carries a second condition that matters more here. It applies only to works the miner had lawful access to, and a pirate library is never lawful access.

On top of that sits the AI Act. General purpose model providers must keep a copyright policy and publish a summary of their training data, policed by an enforcement unit in Brussels.

Which is the asymmetry worth naming. American rightsholders go to court to find out what was taken from them, and European ones are entitled to be told.

Sunday morning over Launch Complex 39A at Kennedy Space Center looked almost too calm for a rocket that would soon make more than five million pounds of thrust. At 7:26 a.m. EDT on August 30, SpaceX’s Falcon Heavy lit all 27 Merlin engines and carried NASA’s Nancy Grace Roman Space Telescope off the pad through blue Florida sky and a thin scatter of cloud. Weather had sat at 50 percent “go” overnight on cumulus and surface-electric-field rules, then improved to 70 percent in the last hour. Launch manager Denton Gibson polled the room and sent it.

Goddard controllers in Greenbelt, Maryland, began receiving telemetry data around 7 minutes after liftoff, and the side boosters were released about four minutes and 15 minutes later, returning to Cape Canaveral Space Force Station for reuse. The fairing halves eventually split apart. The second-stage engines do their thing, and Roman separates from the parent spacecraft 31 minutes into the mission. An hour and 25 minutes later, the team breathes a sigh of relief as the solar arrays and lower instrument sun screen open and perform properly. Yes, the high-gain antenna and aperture cover must yet be completed, but they will do so in due course.

LEGO Technic NASA Artemis Space Launch System Rocket Building Toy for Boys & Girls – STEM Learning…

• BUILD AN OFFICIAL NASA ROCKET – Kids prepare to explore outer space with the LEGO Technic NASA Artemis Space Launch System Rocket (42221) building…
• 3-STAGE ROCKET SEPARATION – Young builders can turn the hand crank to watch the rocket separate in 3 distinct stages: solid rocket boosters, core…
• STEM BUILDING TOY FOR KIDS – This educational rocket kit was created in collaboration with NASA and ESA to showcase the authentic system that will…

Let’s not overlook Roman’s tremendous scheduling achievement, which saw it launch 9 months early. Originally scheduled to launch in May 2027, the crew pulled it off by finalizing the hardware, staying within budget, and moving the launch date first to late September and then back to late August. NASA Administrator Jared Isaacman couldn’t help but applaud the team on this one; completing a project like this not only ahead of schedule but also on budget is something they want to see more of, especially after all of the work and effort put into making it a reality. How much will all of this development, launch, and five-year operation cost? approximately $4.3 billion.

Roman is a large unit, around the size of a school bus and weighing around 18,000 pounds. Its 2.4-meter primary mirror is the same size as Hubble’s, but it’s composed of a super-lightweight material that weighs only 410 pounds. As for how they came to create this material, it began as surplus optics from the National Reconnaissance Office, which they subsequently modified and silver-coated, making it suitable for use in an astronomy system. The Wide Field Instrument is a 300 megapixel infrared camera made up of 18 separate detectors, each about the size of a saltine cracker. It can capture a large portion of the sky in a single frame, around 1.5 times the apparent size of a full moon. And if you’re wondering how that compares to Hubble, Roman can capture the infrared field 100 to 200 times larger in a single image than Hubble can. The major game changer is Roman’s ability to scan the sky almost 1,000 times faster than its older cousin.

JPL’s Coronagraph is along for the ride, and it’s basically a test bed for some new technology that’ll block out the starlight so the telescope can look at older, colder, and closer in giant planets than other direct imaging work used to be able to spot, with the hope that success in this field will feed into later ideas for spotting Earth-sized worlds. On that basis, all scientific data will be available for everyone to view. As for how much data they expect, the daily downlink is expected to be approximately 1.4 terabytes, which equates to a nice four petabytes each year, plenty for anyone to get their teeth into.

Mission Science for Roman is divided into three distinct roles that all use the same super-sharp infrared view. First, consider how the universe has altered over time. Roman will set out to find tens of thousands of Type Ia supernovae and study the forms and clusters of hundreds of millions of galaxies. With that data, Roman will effectively tighten the rules governing dark energy, the unknown factor that appears to be causing the cosmos to expand even faster, and dark matter, which only manifests itself by bending light and keeping galaxies intact. Recently, there have been suggestions that dark energy may be diminishing with time, and Roman is designed to be able to determine whether this is true with a much bigger sample size.

The next step is to look for planets, as science believes that microlensing in the galactic bulge could show planets with only a tenth of Earth’s mass, ranging from planets in habitable zones to worlds with orbits similar to the farthest limits of our own solar system. In addition, we’ll learn about rogue planets that are floating through space without their own star. The transit observations and the coronograph add to the mix. The number of new planets is expected to range from a few thousand to more than 100,000. Not to mention the first real attempt to conduct a head count of systems like our own. The same data set will also allow us to see brown dwarfs, elderly stars that have ran out of fuel, and even new moons orbiting our own gas giants.

Finally, there’s everything else Roman will discover throughout these surveys, including black holes, collapsing stars, galaxy mergers, things in our solar system’s beyond reaches, and anything else no one had even considered looking for. Senior project scientist Julie McEnery put it simply: no one has ever looked at the universe with eyes as sharp as Roman’s. NASA’s Science Chief, Nicola Fox, described it this way: while Hubble and Webb can look through a keyhole, Roman kicks the door right down. While Webb provides depth, Roman provides broad coverage as well as quickness, combining the two to get the best of each.
[Source]

Sony spent years turning over-ear canceling into something people actually wear all day, and the WH-1000XM5, priced at $199.99 (was $400), remains the pair that made that habit stick. Eight microphones and a pair of processors hush cabin rumble, subway grind, and open-office chatter so thoroughly that music and calls sit on a darker background than most rivals managed when these launched a few years ago.

Eight listening microphones fitted on the headphones monitor both what happens outside and inside the cups. Combining them with the V1 processor and a QN1 noise chip allows the system to automatically fine-tune noise cancelation for glasses, hair, leaks around the cups, and changes in cabin pressure. First to vanish are the low hum of airline engines and the persistent drone of your office’s HVAC system. Then mid-range office chatter begins to dissipate.

Sale

Sony WH-1000XM5 Premium Noise Cancelling Wireless Headphones, Black

• PREMIUM NOISE CANCELLATION: Two processors control 8 microphones for unprecedented noise cancellation. With Auto NC Optimizer, noise canceling is…
• MAGNIFICENT SOUND: Engineered to perfection with the new Integrated Processor V1.
• CRYSTAL CLEAR HANDS-FREE CALLING: 4 beamforming microphones, precise voice pickup, and advanced audio signal processing.

Even with the noise cancelation turned on, the battery life is 30 hours, and 40 hours when it is turned off. A USB-PD charger will provide three hours of listening for every three minutes of charging, and a full USB-C charge should take roughly three and a half hours, however real-world testers have reported matching or even exceeding those figures when using them at a moderate level.

One thing that has clearly improved is the feel, as soft fit leather pads and a smaller headband reduce clamp pressure, allowing you to wear them for hours without feeling like they’re squeezing your head. The cups now swivel to lie flat, but they no longer fold up into a little ball like they used to, so Sony had to tough up the shell to protect them. If you’ve ever jammed a pair of XM4s into a side pocket of a bag, you’ll understand what we mean.

The sound originates from new 30mm carbon fiber drivers that have been adjusted to be warmer and more even than the previous ones. The bass is still under control, the mids are clean, and if you have an Android phone that supports LDAC, you can get even more resolution out of your music. They also have a system called DSEE Extreme, which aims to restore the quality of compressed streams. The headphones include a full equalizer, 360 Reality Audio support, Adaptive Sound Control, which switches modes automatically based on what you’re doing, Speak-to-Chat, which pauses your music when you start talking, and Quick Attention, which allows you to cover a cup and hear what’s going on in the room.

Long-time testers believe they have made significant improvements in terms of call quality. Four dedicated voice mics, paired with improved processing, do an excellent job of preserving your voice’s natural tone while also eliminating background keyboard clatter and street noise. You may now connect two devices at once, and the touch swipes on the right cup handle allow you to adjust volume, tracks, and calls. A tactile button on the left cup activates and deactivates the noise cancellation and ambient settings.

There is a clear repeating trend in agent deployments: The gateway is the first control teams reach for, but it is the one they are least ready to run. This is because gateways sit on top of identity and attribution layers that are mostly not there.

The first layer of risk is not hypothetical. In June, CISA added a LiteLLM flaw to its Known Exploited Vulnerabilities catalog after attackers were caught abusing it in the wild. The bug ran commands on the host through the gateway itself, and chained with a second flaw it required no credentials. It was one of seven common vulnerabilities and exposures (CVEs) disclosed in that single AI gateway in a month. This is the layer many enterprises reach for first to secure their AI agents.

When considering secure agent architecture, gateway controls should not be the first control. They should be the fifth.

Most models on the maturity of agent security describe the controls a company will need in the future. They tend to miss, from my experience, the more difficult problem of describing the brownfield scenario: In what order should these controls be layered in conjunction with an identity and access management system that is already in place?

If the control plane is unaware of which agent is acting, who delegated the work, what task the agent is to perform, and what credentials are being used, then the context is incomplete. A gateway may block clear policy violations, but will struggle to distinguish a justified action from one that is technically permissible but operationally inappropriate.

The pattern of failure is clear when sequencing these controls for agent production deployments: Enforcement is taken early, while the identity and attribution context it depends on has yet to be developed. Agent security functions as a dependency chain, with each control depending on context generated upstream.

The wrong starting point

Think about routing agent traffic via a new runtime gateway. A finance-reconciliation agent tries to alter a record in production. The gateway authenticates the user token and checks the API call. What it can’t observe is that the request is agent-initiated, that the agent is executing a more limited function, or that the request is part of a tool chain invoked by an untrusted artifact.

The credential is valid. The API call is permissible. The action contradicts the purpose of the delegation. The gateway is there, but its set of supports seems absent, so a costly control is applied to a very small part of the whole picture.

Limiting an agent’s privileges to those of the human principal is useful so the agent does not exceed the person it serves. However, having a privilege ceiling does not create separate attribution. Twenty agents might operate under a single person’s permissions and still need unique identities, audit logs, behavior profiles, and revocation paths.

Dependency-gated deployment

I call this process dependency-gated deployment. Upstream exit tests must be satisfied before any downstream control is considered operationally complete. Concurrent development of downstream controls is permissible.

Here are the six gates, and the proof that they work:

The six dependency gates for the agent security controls. Each control is contextualized by the gates above it. From the author’s analysis of production agent deployments.

Start with the agents you can actually name

To begin, recognize the production agents in open-source frameworks, cloud offerings, SaaS services, and developer tools. For each, record the owner, responsibility, lifecycle stage, allowed tools, data domains, and sources of credentials.

Bypass this step, and the organization will lose the first hour of incident response while they figure out what should have been obvious. The inventory identifies the asset that every control thereafter governs.

An agent needs its own identity, but it cannot lose the human behind it

An agent should not be buried in a developer token, a shared service account, or a human session. Simply knowing the caller is an agent is not sufficient. The control plane requires additional delegation context: Who delegated the work, what specific task the agent was instructed to execute, and which resources the agent needs the authority to access. Identity specifies which actor placed the call. Delegation is the answer to whose authority it acts, and for what reason.

Once that connection is cut off, the downstream logs attribute the reconciliation agent to the employee whose token it borrowed, and every action it takes is attributed to someone who did not start it.

Shrink authority before you inspect behavior

Once an agent can be identified, capabilities should be limited. Access restrictions should be time-bound to the task and limited to the tools and resources required to perform the task. This can be implemented using identity access management (IAM) features such as workload identity, token exchange, conditional access, and time-bound entitlements which the organization already possesses.

With regard to the 2026 Teleport study involving 205 security leaders, the access scope surpasses the predictive capacity of industry, maturity, or self-assurance concerning predicting AI-related incidents. For example, organizations with over-privileged AI reported a 76% incident rate, whereas AI incidents occurred in 17% of organizations under the least privilege. This indicates that access scope in the dependency chain is more important than context-aware runtime enforcement.

The primary principle is monotonic delegation. Every transfer of responsibility must preserve or diminish authority; under no circumstances should it increase authority. For the reconciliation agent, this means an agent who can view one ledger as opposed to one who inherits the employee’s access to all systems the employee can access.

Fix attribution before automating enforcement

Most audit stacks can capture what resource was accessed and which credential allowed access. In the agent deployments I have reviewed, this is the most commonly missed gate. Prior to utilizing an adaptive runtime policy, link any relevant tool invocation to the agent identity, initiating principal, task id, parent action, and outcome. After doing so, examine the telemetry: For one completed task, see if you can track down the initiator, the agent who executed it, the authority under which the action was taken, the tools utilized, and the outcome. In regulated environments, oversight that is not attributed cannot be justified.

Now the gateway earns its keep

The gateway can use registered identities, explicit delegation, scoped credentials, and attributable telemetry to question if this agent is authorized to perform this action, for this principal, within this task, involving this resource. Although the user’s credentials may provision write access to the finance-reconciliation agent, the gateway has situational context and so determines that it is out of scope. This is control’s point of greatest value. The most stringent controls should be applied at irreversible boundaries — payments, access policy changes, deletions, modifications of the production environment, and data exports.

Detection and the kill path come last

Behavioral baselines are developed last because distinguishable and attributable agent activity must be established to set a standard. Then, security teams are able to identify anomalous patterns of tool usage, unexpected cross-domain access, and deviations from their assigned tasks. Containment is more than just the disabling of a single directory object: A proper kill path entails disabling the agent’s identity, invalidation of active and derived credentials, blockage of tool activation, termination of active tasks, and isolation of the workload that contains the agent.

Start without replacing your IAM

Designing a whole new identity program is unnecessary. If the existing identity provider doesn’t treat agents as native object types, begin with an authoritative registry linked to the existing workload identities. Following this, extend agent and task identifiers as trusted execution contexts, implement short-lived credentials to mitigate inherited privileges, and include those identifiers in tool-call logs for subsequent gateway ingestion. The dependency model remains unchanged as vendor support matures.

Control gaps are measurable. In Okta’s 2026 survey, only 34% of executives said their organization always applies the same level of security rigor to its agentic workforce as to its human workforce. The last control from the chain cannot be applied first to close that gap.

What to do in the next 30 days

Begin with 10 production agents. For each one, identify the owner, purpose, approved tools, and credentials. By now, you should have the beginnings of an agent registry and perhaps your first insights on governance.

Test attribution. Find out if IAM and logging can tell each agent apart from the human or service that delegated the task. If this kind of differentiation is not possible, a gateway would be operating without any visibility.

Reconstruct one completed agent task within an action chain, from start to finish, including downstream effects. Wherever the chain breaks is where your deployment falls short.

Adding downstream enforcement ahead of required context breaks agent security. Maturity models describe the destination. A build order gets you there without breaking production along the way.

Nik Kale is a principal engineer specializing in enterprise AI platforms and security.

Welcome to the VentureBeat community!

Our guest posting program is where technical experts share insights and provide neutral, non-vested deep dives on AI, data infrastructure, cybersecurity and other cutting-edge technologies shaping the future of enterprise.

Read more from our guest post program — and check out our guidelines if you’re interested in contributing an article of your own!

• AWS plans to add 2 million Nvidia GPUs between 2027 and 2028
• The expanded deployment follows an earlier commitment exceeding one million chips
• New Vera-based CPUs will support increasingly demanding artificial intelligence workloads

Amazon Web Services and Nvidia have expanded their long-running partnership to add far more computing power for artificial intelligence workloads.

The cloud provider intends to add two million more GPUs across its global infrastructure between 2027 and 2028.