Rogue agents are forcing a governance reckoning as enterprises hand over the keys

Enterprise AI infrastructure governance is rapidly evolving as autonomous agents transition from experimental to mission-critical roles. Unlike human employees, these agents lack identification, compensation, and ethical guidance, creating a significant governance gap in the private cloud market. Companies are rapidly deploying AI agents to handle sensitive data, APIs, and actions without oversight, prompting concerns from executives like Clayton Donley, vice president and general manager of Broadcom's Identity Management Security Division.

During an interview at VMware Explore 2026, Donley highlighted the urgent need for governance controls to manage these new AI entities. Initially, there was worry over malicious actors exploiting agents, but now the primary risk is agents operating beyond any control or audit. Traditional regulatory frameworks like Sarbanes-Oxley, which require employee access certification, do not extend to agents, highlighting the maturity gap that must be addressed.

Broadcom is tackling this challenge by treating agents as identities, applying decades of distributed application tracing to monitor agent actions and enforce controls. The solution involves three key principles: identity, intervention, and inspection. Enterprises can start by passively monitoring agent traffic and introducing a central control point to enforce policies, ensuring agents cannot circumvent security measures.

This approach allows companies to secure their AI infrastructure without extensive overhauls, addressing the critical need for governance in the rapidly emerging world of autonomous systems.