Agentic AI Governance

19 posts · Jul 2026 – Sep 2026

What this trail covers

This post details the evolution of agentic AI governance from manual review for a few agents to a robust infrastructure problem for hundreds. It emphasizes the need for centralized identity, reusable policy propagation, and cross-environment enforcement to manage agent sprawl. Key takeaways include treating agents as distinct actors, enforcing least-privilege access, using deterministic controls for high-impact actions, capturing full execution paths, and testing failure modes. The goal is to provide a framework for managing agentic AI in production, addressing governance, operational ownership, and integration debt.

All DataRobot trails

Sep 2026You assembled the stack. Who owns go-live?This post identifies the critical gaps of governance and compliance, operational ownership, and integration debt that emerge when moving an AI prototype to production. It highlights that while a pilot proves a concept, it doesn't surface production requirements like credit issuance controls, authorization records, and handling of customer data. It also emphasizes the need for a designated owner for go-live and production maintenance, and the ongoing obligation of managing integration debt as upstream components change.
Sep 2026The unsexy AI: why your forklift matters more than your chatbotThis post extends the agentic AI governance thread by highlighting the critical need for robust governance in industrial AI applications where unplanned downtime carries substantial financial risks. It introduces the concept of specialized agents for specific workflow components (e.g., inventory, technician qualification, diagnosis) and demonstrates their effectiveness in increasing first-time fix rates. The post emphasizes the importance of integrating these agentic systems with existing enterprise infrastructure (SAP, ERPs, on-premises systems) and supporting flexible deployment models (SaaS, private cloud, air-gapped) to ensure practical adoption in manufacturing environments. It also showcases a use case in working capital management where multiple agents were used to detect, quantify, and mitigate supply chain risks, completing the process in 72 hours instead of months.
Sep 2026Adversarial evaluation for Agent Assist: ship agents that survive productionIntroduced automated, multi-turn adversarial evaluation (red-teaming) for DataRobot Agent Assist. This feature subjects agents to prompt injection, scope escalation, unexpected behavior, and persistence attacks. It includes breach detection, automated generation of remediation patches, developer approval workflows, and retesting. Production systems are isolated, with configurable read-only tool opt-ins. Evaluation reports provide pass/fail metrics, breach details, and fix audit trails.
Sep 2026How much guardrail does your AI agent need? What leaders must be able to defendThis post introduces the concept of 'guardrail risk tiering' for AI agents, a system for matching the depth and placement of runtime controls to an agent's data access, tool permissions, action authority, and potential consequences. It outlines a tiered approach (Baseline, Elevated, High Impact) with corresponding recommended guardrail depths, emphasizing the need for deterministic enforcement of hard business constraints outside the model for high-impact actions. The post also details the creation of a governance record to document an agent's risk tier, controls, and rationale, enabling leaders to defend their decisions to boards, auditors, or regulators. This contributes to the ongoing evolution of agent governance by providing a structured framework for risk assessment and control allocation.
Aug 2026Do you need enterprise AI orchestration? A 3-question readiness frameworkThis post introduces a 3-question readiness framework (scale, data sensitivity, autonomy) to determine when enterprise AI orchestration is necessary for agent systems. It elaborates on how AI agents can fail while remaining operational, introducing multi-dimensional operational failure modes beyond traditional monitoring. The framework guides teams to evaluate the speed at which repeated errors can become business problems, the sensitivity of accessed data requiring defensible audit trails, and the agent's ability to create consequential side effects without human checkpoints. It emphasizes proactive orchestration implementation based on these triggers rather than retrofitting controls after release.
Advertisement
Aug 2026Stop managing infrastructure: A new way to deploy AI agents and modelsIntroduces the Workload API, a new system for deploying and managing AI services. Key technical contributions include the Artifact, Workload, and Protons object model for describing and running containerized services, a CLI and REST API for deployment and management, integration with DataRobot's credential store for secrets, support for NVIDIA NIM and Hugging Face model deployments with efficient weight caching, and unified observability and governance features for AI workloads.
Aug 2026Local tracing in the DataRobot CLI: catch issues before productionIntroduced `dr xp`, a DataRobot experimentation CLI plugin that integrates OpenTelemetry for local tracing of agentic applications. This enables developers to visualize request traces, tool calls, latency, token counts, and errors directly in their local development environment, mirroring the platform's post-deployment tracing model. The plugin is bundled with DataRobot agent templates and accessible via the Agent Assist skill.
Jul 2026The first 30 days of agentic AI governance: A practical checklistThis post introduces a practical 30-day checklist for establishing agentic AI governance. It breaks down governance into phases focusing on agent identification and authority, runtime permission enforcement, deterministic controls for high-impact actions, full execution path reconstruction, safe failure mode testing, and owner-based intervention capabilities. It emphasizes the need for clear boundaries, attributable access, policy checks outside the model, comprehensive logging, and rehearsed intervention processes to manage the risks associated with autonomous AI agents.
Jul 2026Identity as a lifecycle, not a settingThis post introduces the concept of treating agent identity as a lifecycle rather than a static setting. It advocates for just-in-time (JIT) credential provisioning, scoped to specific tasks, and programmatic revocation upon task completion. This approach aims to eliminate standing privilege for agents, which is crucial given their ephemeral and non-deterministic nature. The post highlights the operational feasibility of JIT access for agents compared to humans and references OpenID Provider Commands for standard lifecycle operations. It emphasizes that authorization must be continuous and evaluated at runtime, with the agent's lifecycle management enabling this.
Jul 2026Govern natively, federate outward, and what breaks across trust domainsThis post extends the agentic AI governance capability by detailing the strategy for federating trust outward to existing identity providers and workload identity systems, rather than attempting to converge them. It emphasizes the authorization server as the control plane for agent identity and externalizing fine-grained authorization into a policy layer. It also introduces the concept of scaling controls with an agent's blast radius and highlights the unsolved problem of cross-trust-domain interactions.
Jul 2026Credentials should never reach the modelIntroduces the concept of credential isolation as a security measure for agentic AI systems. It proposes a 'broker' pattern where a mediating service holds sensitive credentials and enforces access scope for agent requests, preventing raw credentials from entering the model process. This mitigates risks associated with prompt injection leading to credential exfiltration. The post also emphasizes the importance of controlling egress paths and failing closed to ensure the broker pattern is consistently applied.
Jul 2026DataRobot OpenCode: your coding agent, your model choiceIntroduces DataRobot OpenCode, a coding agent that integrates with the DataRobot LLM Gateway. Details installation via DataRobot CLI and selection of models from the gateway. Highlights pre-installed DataRobot agent skills like Agent Assist.
Jul 2026Delegation chains, the confused deputy, and the protocols you actually deployThis post explains the 'confused deputy' problem in agent systems and how it arises from flattening delegation chains instead of preserving them using `sub` and `act` claims in token exchange. It details how the Model Context Protocol (MCP) and Agent-to-Agent (A2A) protocols are the critical surfaces where delegation chains are preserved or destroyed, and advises checking for proper authorization mechanisms and inspectable Agent Cards.
Jul 2026AI agent governance at scale: from 5 agents to a 500-agent workforceThis post expands on the concept of agentic AI governance by detailing the infrastructure required to scale from a few agents to hundreds. It introduces the critical need for centralized agent identity, reusable policy propagation, and cross-environment enforcement. The post outlines specific control areas such as agent registry, identity, policy propagation, permission scope, tool access, component lineage, runtime enforcement, monitoring, audit trails, and review triggers. It highlights how these infrastructure components address the breakdown of manual governance as agent workforces grow and spread across teams, tools, data sources, and environments.
Jul 2026What a first-class agent identity actually is, and whether it is just workload identityThis post defines a first-class agent identity as a stable runtime principal with its own scoped permissions, a clear owner, and an independent kill switch. It contrasts this with common alternatives like shared service accounts, per-user impersonation, and static secrets, highlighting their shortcomings. The post then explores the conditions under which agent identity collapses into workload identity, based on three invariants: a one-to-one mapping between agent and workload, a registry as the source of truth, and identity continuity across restarts. It observes that public platforms like Microsoft Entra Agent ID and AWS Bedrock AgentCore implement a layered approach where agent identity sits above workload identity when these invariants break, typically within a single control plane and trust domain. The takeaway is to audit agents against these invariants to determine the need for an extra identity layer.
Jul 2026Your agents are using your credentials, and that is the problemThis post identifies and elaborates on the critical security and operational risks associated with AI agents inheriting human credentials, leading to privilege escalation, lack of scoping, poor attribution, and difficult revocation. It argues for a shift from a 'passport' model of identity to an 'authority' model where permissions are determined at runtime based on the agent's specific task and context, addressing the non-deterministic nature of agents. It also critiques the structural assumptions of traditional IAM stacks that do not adequately categorize or govern agents.
Jul 2026Your identity stack was built for two kinds of actor. Agents are a third.This post introduces the concept of agents as a third type of actor in identity and access management (IAM) systems, distinct from human users and service accounts. It highlights the structural gap in existing IAM stacks that leads to borrowed credentials and privilege escalation. The core problem identified is the non-determinism of agents, making design-time least privilege insufficient. The post proposes a solution centered on giving each agent a stable, verifiable runtime principal with scoped identity, enabling runtime authorization, auditable delegation chains, and independent revocation. It outlines a roadmap for addressing agent identity, including keeping credentials out of the model, governing authorization natively, and treating identity as a lifecycle with just-in-time, task-scoped credentials.
Jul 2026A decade of open source at DataRobot: from predictive AI to the agent lifecycleIntroduces syftr, an open-source tool for optimizing agent workflow design using multi-objective Bayesian optimization to find Pareto-optimal configurations, significantly reducing search compute and cost. Also introduces Token Pool, a Kubernetes-native API gateway layer that manages multi-tenant inference capacity using inference-native units (token throughput, KV cache, concurrency) and a debt-based fairness mechanism to prevent service degradation under load. The post also discusses the historical evolution of DataRobot's open-source contributions, from predictive AI to agent infrastructure, and outlines the next steps in connecting production telemetry to the optimization layer.