Enterprise AI governance is moving from observing what an agent did to proving what it was authorized to do, why a specific action was permitted and whether that authority survived a chain of delegations. The shift was outlined by Sudeep Goswami, chief executive officer of Traefik Labs Inc., and Andreas Prins, who leads sovereignty strategy at SUSE Group, in theCUBE Research's AppDevANGLE podcast. The practical stakes are high: an engineering organization described in that conversation had created roughly 8,000 agents, and management did not know how many existed or what they were doing.
What happened in the podcast discussion
Goswami and Prins framed the problem around agentic systems that are already moving into production in regulated enterprises. Goswami's core argument is that authority must contract as work travels: when one agent hands a task to another, that authority should shrink and not leak out. Prins compared the current moment to the earlier evolution of continuous integration and continuous delivery, when software teams moved from manual releases to automated pipelines and had to codify approvals, security checks, secrets management and release policies directly into the delivery process. His conclusion is that the same thinking now has to be applied to agents and, more importantly, articulated as code.
Traditional enterprise access models were built around humans, applications and predefined service accounts. Agentic systems introduce machine-to-machine chains in which authority moves across orchestrators, subagents, APIs and tools at machine speed, and every step can change the scope of what is authorized. Identity and credentials alone cannot answer the question Goswami posed: whether an agent with certain credentials is allowed to make a specific action right now, given the surrounding context. The comparison used in the discussion is physical access control: a badge may open a building door, but it does not grant permission to approve a financial transaction or reach every system inside the organization.
Governance therefore has to become contextual. Policies must decide what an agent may do based not only on its identity, but also on the task, the environment, the delegation chain and the operational conditions around the request. That moves governance away from post-event reconstruction, which is what logs, traces and dashboards traditionally provide, toward real-time authorization and proof. Defining policies is only half of the work: enterprises also need enforcement where agents actually touch applications and infrastructure, which puts the gateway layer in a more important position.
What this means for business
For companies adopting agents, the immediate consequence is that the evidence trail becomes part of the product decision. Goswami argued that governance systems need to capture both allowed and denied actions, because showing that a guardrail blocked an unauthorized action can matter as much as showing that an authorized task completed. Denials also feed back into policy: repeated attempts to perform blocked actions may reveal poorly designed workflows, overly permissive instructions or gaps in the policy framework. For a small company this may mean a handful of policies and one gateway; for a large regulated enterprise it means policy definition, enforcement and evidence treated as interconnected functions rather than separate security projects.
Two limitations deserve attention before any vendor selection. First, logging alone is not proof: Goswami compared the problem to a vehicle odometer that the owner can modify and also reports, noting that audit logs generated by applications and vendors can be tampered with and there is no third-party way to know when and how. Cryptographic recording of decisions, authorization results and agent actions makes changes detectable, but signing by itself is not enough, because independent verification is still needed to check whether evidence was modified after it was generated. Second, sovereignty is a risk-based decision, not a regional checkbox: Prins said that the more regulated the workload, the more control an organization should have, and Goswami noted that dependence on a third-party SaaS control plane outside the organization's own environment removes guarantees.
The marker to watch is whether governance vendors start shipping independent verification alongside cryptographic logging, rather than treating signed logs as the endpoint. Research cited in the discussion gives a sense of the addressable demand: 47% of respondents operate across a mix of connected and disconnected environments, and 11% deploy generative AI specifically within on-premises and air-gapped infrastructure. If verification tools appear in those environments and buyers begin asking vendors to demonstrate denied actions, not just completed ones, governance will have moved from observability to provable control. Until then, the number of agents created inside an enterprise remains the simplest indicator of how far governance lags behind deployment.
