Governance

NIST's 27 October design tenets answer how much autonomy an agent should have by handing risk thresholds to the deploying organization. OWASP's AISVS already tests much of the machinery, including when a human must approve an irreversible action. Neither document tells you what your thresholds are, or how much escalation a reviewer can absorb before approval becomes habit.

NIST asked in February whether agent identities should be tied to specific hardware, software, or organizational boundaries. The summary of the 614 responses it received records commenters proposing an anchor bound to the artifact that produced the agent, with the SBOM carried as metadata for access decisions.

NIST's one substantive agent document of October 2026 was joint-agency incident practices for agent misbehavior, aimed at frontier labs and disclaiming compliance use. The benchmark guidance and the identity practice guide are still drafts, and an executive order renamed the program without changing the definitions inside it.

Europe's Tech Sovereignty Package proposes to put open standards and open source at the centre of public sector cloud and AI buying. The Linux Foundation's new survey finds the binding constraint is governance rather than deployment: 31% of European organisations have none, and respondents put the difference at 3.6 times versus 4.6 times in self-reported benefit.

Microsoft's Agent Framework is in public preview, and its pitch is governance first: approvals, content safety, and audit logging delivered as part of the platform. The contrast is Orca, which keeps the guardrail outside the agent.

StreamNative's Orca makes governance a property of the runtime instead of a layer over it. Base Compute's Superfluid gives one laptop a scheduler for several agents. The two edges of the stack the control-plane story left out.

Three open-source tools landed in the first week of October 2026, each aimed at one named symptom of 'agent sprawl': Red Hat's Rossoctl for discovery, Tuskira's gateway for credentials, and LiteLLM's Moyai for cost. The remediation layer is now shipping as modular, self-hostable building blocks rather than a platform you wait for.

Microsoft's Agent Control Specification and CSA's AARM both name the runtime-governance layer, from opposite ends. AARM writes mandatory requirements, including universal pre-execution interception and tamper-evident receipts. ACS writes the interface: lifecycle hooks, normalized verdicts, fail-closed enforcement. What was a gap diagnosis now has two competing specs.

OpenClaw Enterprise launched September 29 as MIT-licensed, self-hostable control-plane software for fleets of persistent agents, built inside OpenAI and donated outward with Red Hat and NVIDIA contributing. The open question is whether the enterprise control plane ends up a product or a protocol.

Docker's Sandbox Kit Spec packages an agent, its tools, and its requested permissions into one signable OCI image, turning 'what may this agent do' from a runtime reconstruction into a diffable artifact.

As AI agents shift from single-turn chatbots to persistent production workloads, a new infrastructure layer is emerging to manage governance, identity, and execution.

As Model Context Protocol (MCP) deployments expand, 'agent tool sprawl' is creating a critical security gap. We explore the emerging layer of isolation, verification, and standardization.

Five enterprise vendors shipped near-identical three-layer agent governance stacks built on MCP, clustered most densely between August 31 and September 8, 2026. The open question is whether bundled governance is plumbing or a moat.

NIST's April 2026 concept note for an AI RMF profile on critical infrastructure imports the vocabulary of functional safety, deterministic behavior, graceful degradation, and fail-safe operation into a framework built for probabilistic systems. Here is what that collision means for OT and ICS operators.

Agentic AI is deploying faster than anyone can govern it. The missing layer is not the model but the control plane around it, and the MCP CVE wave shows what happens when write access ships before that layer exists.

NIST's Center for AI Standards and Innovation launched the AI Agent Standards Initiative in February 2026, the first federal program targeting autonomous-agent governance. Here is what it signals, the compliance gap it exposes, and how organizations should prepare before voluntary guidance hardens into procurement and audit requirements.

An agent is a loop whose branches are decided at runtime by the model, which a fixed control catalog like CMMC cannot enumerate. Access Control and Audit and Accountability break first. The emerging fix moves authorization outside the loop and makes the execution trace the audit artifact.

Three years of LLM security were spent on the input. The next boundary is proving what an agent did after the prompt left the model, which means turning execution traces into audit trails that are complete, tamper-evident, and portable across vendors.

Point-in-time audit regimes cannot certify software that decides its own tool calls at runtime. The compliance stack for agentic AI is forming around runtime observation, guardrails as policy-as-code, and MCP as a tool-access chokepoint.