Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The agent that worries you is authorized. It holds a service account you provisioned, calls tools you approved, and reaches destinations someone signed off on. Zero trust asks two questions at every decision point, who is this and what are they allowed to do, and an agent redirected by trusted input answers both correctly every time. For a person those questions fire at a session boundary, where context gets re-checked. An agent on Kubernetes has no such boundary.

The board wants to know which AI agent risk to fund first, and a likelihood score cannot answer it. No incident survey gives base rates for agents on your architecture, and an agent can take a different path on the same input. What a CISO can estimate is what each risk would cost to recover from: the work to detect it, scope it, revoke the authority it used, and prove what happened. Ranked on that cost, unexpected code execution drops toward the bottom.

NIST has published no AI agent authorization standard, and nothing in its February 2026 draft gives an auditor a control to test. What the NCCoE did publish is more useful to a CISO with an audit on the calendar: five areas of interest that read like an assessor’s question list. Together they ask which agent acted, on whose behalf, under what authority, and with what record. A Kubernetes cluster has a primitive it can point to for each area.

Databricks has become the data and AI platform of record for a large and growing share of the enterprise market. Unity Catalog gives teams unified governance over data assets, AI models, and agentic workflows, controlling what exists, who can use it, and what policies apply.

AWS Dogwood brings stateful authorization to AI agents. Learn how it fits with workload identity, AuthZEN, IAM, and the move away from long-lived credentials.