Who's governing your AI? A trust framework for enterprise agents and models

The growing prevalence of AI and autonomous agents has created a new challenge for enterprises: securing these agents within their infrastructure. Experienced IT leaders recognize that shadow AI poses a significant risk, with 68% of organizations lacking the necessary governance to manage AI or detect shadow AI, according to IBM's 2026 Cost of a Data Breach report. This is a stark contrast to 63% the year prior and 38% requiring IT approval to deploy AI, down from 45%.

DigiCert, a cybersecurity company, has developed an AI governance framework called AI Trust to address this issue. The framework builds upon DigiCert's expertise in public key infrastructure, DNS, and attestation. It focuses on answering five key AI governance questions: identifying the agents employees use, tracking regulated data flowing to them, assessing the credentials held by agents, ensuring immediate stoppage if a compromised agent is detected, and reconstructing incidents with a tamper-evident trail.

One of the main hurdles enterprises face is the unauthorized deployment of agents. Developers and users often deploy agents without proper controls, leading to potential security breaches. DigiCert's solution involves treating agents as workloads rather than extensions of human identity and access management (IAM). This approach emphasizes assigning short-lived credentials and utilizing SPIFFE and SPIRE for workload identity management.

DNS plays a crucial role in DigiCert's AI governance strategy. By publishing agent policy records in DNS, organizations can enforce policies and verify the legitimacy of inbound agents. This approach ensures that agents can only access authorized domains and perform permitted operations. However, managing DNS records at scale remains a challenge, just like in managing email authentication.