For Mrinal Anand, head of AI security and assurance at financial services firm SoFi, the test seemed mundane enough.
Anand was evaluating a newly released frontier model via an unnamed coding agent, using non-sensitive data to convert a Word document to a PDF. Then the agent attempted to upload images to unknown third parties without authorization. SoFi's egress proxy blocked the first attempt. The agent tried again. And again. And the agent kept on trying until it found a place the proxy did not block, Imgur, and then completed the upload.
The only reason Anand caught the unauthorized upload was that he had been monitoring the agent’s reasoning chain and the tool calls as they executed. Had he not been monitoring, he’d likely missed the activity.
Anand delivered his account during a panel last week on AI guardrails and observability in AI infrastructure at the Ai4 conference. His story sets the stage for the AI governance challenges and the guardrails for mitigation, as cited by the four panelists from banking, healthcare, technology services, and security.
More from Ai4 2026:
George V. Hulme
George V. Hulme
Full coverage of Hacker Summer Camp:
Bill Brenner
Chad Wise, senior principal solutions engineer at F5, said taking a non-deterministic AI and trying to make it operate deterministically is "incredibly difficult." He noted that it starts with model selection and testing. "It all goes back to ‘how do I trust this thing, and how do I have an audit trail based on all [of its] interactions."
Allen Badeau, chief AI officer at DigitalNet.ai, described the challenges created when teams try too hard to force agents into more predictable outcomes. ”Putting too many guardrails on some of these things will also artificially impact what your answer is going to be," Badeau said. "You're taking an LLM, and you're trying to put a bunch of guardrails on it to make it deterministic, and all you get is garbage and hallucinations."
Agentic draft and herding the machines
Anand argued that monitoring agentic outputs isn’t enough. His team baselines identity, permissions, and data access, then watches for deviations. When an agent begins accessing data outside its established boundary, that breach triggers the alert. Anand advised alerting on that boundary breach, rather than blocking outright, because blocking every anomaly would stall the business too much.
Badeau also baselines model performance, then compares across multiple models to produce a quantified score against which agentic drift can be measured. He also assigns each agent its own "constitution": the rules the model follows, the actions it may take, the playbooks it adheres to in a security context, and the confidence threshold required before it acts.
And Badeau's organization treats every agent and every application as an insider threat, on the grounds that the security discipline already exists for human identities and executives already understand it.
AI governance begins with asset inventory
Securing agentic AI largely depends on having an accurate, up-to-date inventory. When Anand's team deployed AI security posture management tooling across endpoints, cloud, and runtime, they identified more MCP servers than they expected to be running. Fanny Sie, head of AI and emerging technology at Roche, shared her lessons learned during what she described as an LLM experimental sprawl that occurred at Roche in 2023: inventory everything, categorize [AI] by maturity, then fund [tools] selectively.
Notably, the panel did not converge on enforcement. Badeau monitors and enforces zero-trust rules across agents and blocks anything not explicitly permitted by default. Anand alerts on behavioral deviation and reserves blocking. Sie explained that she permits technical freedom during ideation and tightens controls as an idea solidifies.
While Anand's team instruments pre-execution, execution, and post-execution separately. This way, agentic actions can be mapped back to whether a human or an agent initiated it.
The panel’s governance takeaways:
Inventory: Scan endpoints, cloud, and live runtime to identify undeclared agents and MCP servers. Model attribution, identity management, compliance reporting, and incident response work without a sound inventory.
Manage agentic identities: Agents that inherit user credentials produce audit trails that name the wrong actor. Ensure distinct agent identity, instrumented across the full execution path.
Policy is scoped per agent: discrete permitted actions, operating boundaries, and confidence thresholds before enabling agentic actions all make policy violations detectable.
Zero trust extends to agents as principals. Every agent gets its own identity rather than inheriting the invoking user's identity, so access decisions and audit trails are resolved to the actual actor. Authorization is per-request and scoped.
AI compliance is not AI security: When environments are designed to meet regulations, the system can be compliant and still get hacked or break guardrails.
Anchor on principles, not regulations. Accountability, human-in-the-loop, and defined responsible AI practices survive regulatory change.
Don't blindly prohibit. Blanket restrictions move usage outside the perimeter, where none of the above applies.
The gap needed to close organizational guardrails and agentic AI policy enforcement will only grow as enterprises continue to rush their agentic AI deployments, often by teams that sidestep proper reviews, fail to declare agentic AI use to IT, and run them without an adequate watchful eye.
The controls that close the gap are not extraordinary: agentic identity management, egress controls, monitoring during execution, proper usage defined per agent, and a current inventory. Security teams have been running those controls for years, or at least they should have been. The longer organizations take to heed the panel’s advice, the more challenging it will be to retrofit agentic governance efforts. “Future-proof through principles rather than legislation. That’s accountability, human in the loop, ethics, and [building] responsible AI practice, and [managing to] organizational values,” Roche’s Sie concluded.
