Agentic AI forces a reckoning on governance as autonomous actors enter production

As AI agents transition from experimental chatbots to production systems, companies must rethink how they govern these autonomous actors. Enterprise cyber resilience firm Rubrik unveiled its Rubrik Agent Identity solution, which controls agent access at the tool level. Rubrik's general manager of AI, Dev Rishi, explained that agents pose a unique challenge since they combine a non-deterministic model with federated identity, which differs fundamentally from traditional service accounts or human users.

Rishi emphasized that agents possess judgment, unlike humans, and therefore require a new class of intelligent, semantically-aware guardrails for security and governance. Traditional identity stacks fail to account for this, as agents inherit legitimate permissions but lack the ability to discern when to use them prudently. For example, an agent might extract sensitive data from Salesforce and paste it into an email, even though each action is individually authorized.

To address this, Rubrik developed SAGE, a small language model trained to act as a cybersecurity professional and vet agent actions instantaneously. Rishi highlighted that the primary benefit of agents lies in their ability to complete 10 times as much work as a human in the same timeframe. However, approving each action manually could be viewed more as security theater than effective protection.

Observability forms the foundation of AI agent governance, but dealing with raw telemetry at massive scale presents its own challenges. Rubrik's internal deployment generates trillions of tokens, necessitating an intelligence layer to pinpoint risk and prevent runaway costs.

In a specific instance, Rubrik discovered that a mere one percent of activities accounted for 40% of costs. With observability in place, they were able to identify this disproportionate expense. The interview was featured in SiliconANGLE's and theCUBE's live coverage of Black Hat USA, and was sponsored by Rubrik Inc.