New tools

New AI agent governance tools, last 90 days

Products and major features for governing AI agents and AI use, as their vendors announced them. A launch makes the list when governing agents is its main purpose: identity and credentials, permissions, MCP security, AI data loss prevention, shadow AI discovery, spend controls, observability and audit, sandboxing or agent payments. Funding rounds, acquisitions, research papers and model releases are left out.

Vendors can send a launch, with a link to its public announcement, to [email protected]. For every product in the space, launched recently or not, see the tools directory.

How entries are checked

Each entry was checked against the vendor's own announcement, which is listed first under its sources, followed by independent coverage where there is any. The description is ours and covers the governance feature only.

Availability is what the vendor states. An entry is marked generally available only when the vendor says the product is available now, and announced when the announcement gives no availability at all. Entries leave the list 90 days after the vendor announced them. If something here is wrong, write to [email protected] and it gets fixed.

43 launches from 29 vendors, announced between July 24, 2026 and October 22, 2026. Last updated October 22, 2026.

Follow new entries in the launches feed (RSS). The vendor landscape map covers who sells what in each category.

  1. # generally available

    NVIDIA OpenShell Reference Architecture

    NVIDIA Agent sandboxing

    Puts the open source OpenShell runtime and the Sentry watchdog, both part of NVIDIA's Open Agent Safety Platform in September, into one design with NVIDIA hardware: Vera Rubin systems for model inference, Vera CPUs that run agent harnesses and OpenShell, which sets a boundary around each agent, and BlueField-4 DPUs that run Sentry to monitor agents from outside their host. By NVIDIA's account, Sentry quarantines an agent that tries to leave its boundary within milliseconds. The design extends to RTX Spark, DGX Spark and DGX Station systems at the edge and runs on Linux and Kubernetes from Canonical, SUSE and Red Hat, on Windows through Microsoft Execution Containers, and on AWS, Google Cloud and Azure. NVIDIA says the reference architecture is now available.

    Why it matters Enterprises running agents on NVIDIA infrastructure get a published design for where agent boundaries sit and what enforces them, and NVIDIA says security vendors including CrowdStrike, Okta, Palo Alto Networks and Zscaler are integrating support for it.

  2. # generally available

    BeyondTrust AI Agent Security

    BeyondTrust AI security platforms

    Finds AI agents on Windows and macOS endpoints, including frontier AI tools, internally hosted models, shadow AI and short-lived sub-agents, and separates what an agent does from what the person using it does, recording the human owner, device, agent session, skills and MCP activity. Each agent action is checked against policy at runtime before it runs; the product can steer the agent to an approved way to finish the task, or call for just-in-time privilege or human approval when the agent needs more access. BeyondTrust says it is generally available on its Pathfinder Platform for Windows and macOS endpoints.

    Why it matters An agent no longer gets everything the employee is allowed to do: policy can restrict the agent on the endpoint without restricting the person. BeyondTrust's own research, released with the launch, counted about 1.28 million shell commands requested by coding agents from about 132,000 prompts over four weeks.

  3. # announced

    ThreatLocker Zero Trust AI Control

    ThreatLocker AI security platforms

    Controls what AI agents can access, execute and connect to from outside the AI software, including when one request makes an agent act across other applications, scripts and browsers, and ships with recommended policies that teams can adjust. ThreatLocker says it works with its Allowlisting and Web Content Control products, which decide which AI applications and browser-based services are allowed at all.

    Why it matters ThreatLocker customers can put agents under the same deny-by-default model they use for software, with boundaries that hold, by the vendor's account, even if an agent behaves unexpectedly.

  4. # announced

    Microsoft Dynamic Permissions and Dynamic Conditional Access for agents

    Microsoft Agent identity & NHI

    With Dynamic Permissions an agent starts with no authority and gets task-scoped, time-bound access that shrinks or ends with the task, inside an organization-wide limit, and higher-impact actions can require verified human approval. Dynamic Agent Risk scores each agent from identity, data, endpoint, cloud, network and runtime signals, and Dynamic Conditional Access in Entra responds by cutting permissions, blocking writes, narrowing reachable resources or stopping the agent. Microsoft also widened agent discovery to 60 local agent types and gave no availability dates.

    Why it matters Agent access follows the task and the agent's current risk instead of the standing access of the person it works for.

  5. # generally available

    Evervault Browser Tokens

    Evervault Agent payments

    Gives a browsing agent stand-in values for a card number, CVV or password, generated in the same format as the real ones, so the agent can fill in an ordinary checkout or sign-in form. The browser's traffic runs through Evervault's proxy, which swaps in the real values only for the merchant, payment processor or gateway hosts named when the token was created; any other site receives the stand-in. Tokens expire after a set time, 15 minutes by default, their permissions cannot be widened once created, and Evervault logs each reveal and refusal per session. Evervault says Browser Tokens are available with Chromium-based headless browsers such as Browserbase and can be used today.

    Why it matters The real card details never reach the agent, its logs or the model provider, and a page that tricks the agent into sending them elsewhere gets only the stand-in.

    Pricing Sandbox apps are free for testing. Production apps need the pro plan, from $0.25 per card session covering the card number and CVV, and from $0.05 for non-card data such as passwords.

  6. # announced

    ServiceNow AI Passport

    ServiceNow Agent identity & NHI

    Gives each AI agent a cryptographically signed credential, grounded in ServiceNow CMDB data, GRC policies and workflow approvals, that the agent checks at runtime to confirm its authorized scope, including inside NVIDIA OpenShell. An agent that drifts can be redirected, restricted or shut down, delegated scope narrows at each step, and the credentials follow open specifications so other identity providers and enforcement points can issue and verify them. ServiceNow expects it, with shadow AI detection and AI Cost Management, in Q4 2026.

    Why it matters Third-party agents get a permissions record the enterprise can verify, rather than relying on what the agent claims about itself.

  7. # generally available

    Perplexity SPACE (open source)

    Perplexity Agent sandboxing

    The sandbox platform behind Perplexity Computer, now open source. Each sandbox runs in a small virtual machine with its own operating system, and network access and platform-held credentials are managed outside the sandbox, so agents reach authorized services without those credentials sitting in their workspace. In Perplexity's own testing, 108 attempts produced no escape from the virtual machine to the host; some got around network restrictions, which Perplexity says it fixed.

    Why it matters Teams building their own agents can inspect and adapt a sandbox that has run every Perplexity Computer session since July, at millions of sandbox creations a day by Perplexity's count.

  8. # announced

    Descope Agentic Identity Hub 3.0

    Descope Agent identity & NHI

    Adds an approval workflow in which employees request an agent and the apps, APIs, data and MCP servers it needs, and nothing is provisioned until review, so each agent has a documented purpose, an owner and least-privilege access. It integrates with MCP gateways, including the open source agentgateway, to apply one authentication, authorization and logging layer to internal agents and to clients such as Claude, Cursor and ChatGPT, and lets agents authenticate with keys, certificates, SPIFFE or workload identity federation instead of static secrets.

    Why it matters Each agent gets an owner and a review before it gets access, and Descope evaluates policy on every request, so access can be narrowed or revoked centrally without reissuing credentials.

  1. # generally available

    Runlayer network access policies for Runlayer Agents

    Runlayer Agent sandboxing

    Each agent gets its own allow list or block list for outbound connections from its sandbox, whether they come from a shell command, a package install, a web fetch or the browser, and every connection is tied to the agent that opened it and logged with the run, host and outcome. Private networks, cloud metadata endpoints, raw IP addresses and plain HTTP are blocked for every agent, and an agent whose policy cannot be enforced does not run. Runlayer says the policies are available for Runlayer-hosted agents and self-hosted AWS deployments.

    Why it matters Limiting where an agent can send data limits what a prompt injection can exfiltrate, even when the agent can read sensitive data.

  2. # generally available

    American Express Intent Intelligence framework

    American Express Agent payments

    A Create Intent API records what a customer told an agent to buy, such as the merchant and a maximum budget, and the customer authenticates and signs off before the agent transacts. The resulting Intent ID and Proof of Intent Token scope the payment credential the agent uses at checkout in place of the card number, and serve as controls for authorization, fraud checks and disputes. Amex says the framework is available through its Agentic Commerce Experiences (ACE) Developer Kit; on October 16 it told Digital Commerce 360 that no integrations are live yet.

    Why it matters The issuer gets the customer's approved limits before the agent buys, so authorization and dispute decisions can check the purchase against them.

  3. # announced

    Project Beacon (Goodfire and Baseten)

    Goodfire AI security platforms

    Monitors for open models served on Baseten's inference platform that flag agent behaviors such as prompt injection, sensitive data exposure, cyber misuse and reward hacking in real time. Goodfire says Baseten customers will choose which monitors run and whether a flag is logged, sent for further review, refused or re-routed.

    Why it matters Teams serving open models on Baseten can add behavior monitoring without running a second model to review every output.

  4. # generally available

    Kong Token Vault

    Kong Agent identity & NHI

    Agents authenticate to Kong and never hold downstream credentials: Kong Identity decides what each agent may reach, and Token Vault adds the needed credential to authorized traffic. Access can be revoked centrally, and Kong logs which identity reached which resource.

    Why it matters An agent that holds no stored credentials has none to leak if it is prompt-injected or compromised.

  5. # announced

    Kong AI Registry

    Kong MCP security & gateways

    A catalog in which agents, MCP servers and other AI resources move through register, approve and publish steps before agents can discover them, with owner, version, approval status, risk and policies on each entry. Separate registries can show different resources to different audiences. Kong says it will be generally available at Kong AI Summit 2026.

    Why it matters An approval step before discovery gives security teams a checkpoint on which MCP servers agents can find at all.

  6. # announced

    Kong Advanced AI Observability

    Kong Agent observability

    Groups the model calls, tool and MCP invocations, and policy and guardrail decisions in an agent session into one trace, with token use and cost per request and per session. Kong describes it as coming soon to Kong Konnect.

    Why it matters A session-level trace shows what an agent did across a whole task, which single-request gateway logs do not.

  7. # announced

    OneTrust CORIE and AI Control Plane

    OneTrust AI governance & compliance

    Turns an organization's policies into rules enforced at each agent tool call, allowing an action, stopping it or sending it for human review, and records the agent, request, purpose, outcome and governing policy. OneTrust's AI Control Plane applies this at runtime as a control layer between agents and enterprise systems; an MCP Gateway that lets developers build these controls into their own agents is set for private preview this fall.

    Why it matters Privacy and AI governance teams can enforce policy where agents act, not only in assessments written before deployment.

  8. # generally available

    NVIDIA Open Agent Safety Platform (OpenShell and Sentry)

    NVIDIA Agent sandboxing

    OpenShell is an open-source runtime that sandboxes agents with kernel-level file and process controls, checks outbound traffic against policy, and keeps real API keys outside the agent. Sentry is a reference design that runs a policy watchdog on BlueField-4 DPUs, apart from the agent's host, and can quarantine an agent that leaves its boundary.

    Why it matters Enforcement on separate hardware, by NVIDIA's account, keeps working even if the agent's host is compromised.

  9. # announced

    Noma agent security and governance for employee endpoints

    Noma Security AI security platforms

    Uses existing EDR or MDM data to inventory agents, MCP servers and skills on employee laptops, labels each as approved, needing review or blocked, and applies tool- and action-level policy tied to the person behind the agent. Its runtime layer can alert, block, mask data or route an action to a human.

    Why it matters Coding agents on laptops come under the same policies Noma applies to SaaS and in-house agents.

  10. # generally available

    Purview data security on the network with Entra Global Secure Access

    Microsoft Data flow & AI-DLP

    Entra Global Secure Access enforces Purview classification and data policies at the network layer, for people and for agent traffic acting on a user's behalf, and can block sensitive files or text from reaching risky destinations such as unsanctioned AI tools.

    Why it matters Agent traffic falls under the same data policies as employee uploads, without a separate AI-specific DLP product.

  11. # announced

    Salesforce AI Control Plane (Trusted Enterprise AI Harness)

    Salesforce AI governance & compliance

    A planned shared console to discover and register Salesforce and third-party agents, set their identity and policy, manage lifecycle, observe behavior and control cost. Salesforce says the new capabilities are planned to begin rolling out in early fiscal 2028.

    Why it matters Buyers comparing cross-vendor agent registries can weigh this roadmap against tools that ship today.

  12. # generally available

    Enterprise managed permissions for GitHub Copilot agent operations

    GitHub AI governance & compliance

    Copilot Business and Enterprise admins can set shell commands, file reads and edits, and network domains to blocked, approval required or allowed in the Copilot app, Copilot CLI and VS Code Agent Host sessions. Managed settings override user and workspace settings and saved approvals.

    Why it matters Coding-agent permissions become an enterprise policy that developers cannot loosen locally.

  13. # generally available

    Lasso LEAP

    Lasso Security AI security platforms

    A guardrail engine that checks AI requests and agent actions on ordinary CPUs, with no GPU, and by Lasso's figures decides in under five milliseconds; harder policy calls go to RAPID, a self-hosted model that acts as a judge. It can be deployed wherever the customer's data must stay, including air-gapped networks.

    Why it matters Guardrails that need no GPU can run inline in regulated or isolated environments where hosted inspection is not allowed.

  14. # announced

    CrowdStrike Agentic Identity Provider

    CrowdStrike Agent identity & NHI

    Registers AI agents in one directory, gives each a verifiable identity, and brokers short-lived, task-scoped access instead of standing credentials, keeping each agent linked to the person or workload it acts for.

    Why it matters Agent identity sits with the same vendor that sees endpoint behavior, so both signals can feed one access decision.

  15. # generally available

    Kong AI Gateway 2.0

    Kong MCP security & gateways

    Puts several upstream MCP servers behind one gateway route and, with the MCP ACL plugin, shows each caller only the tools it is authorized to run. Callers can be identified by centrally defined identity principals, which also key model access rules, rate limits and cost attribution.

    Why it matters Teams that already run Kong for APIs can enforce per-caller MCP tool access in that layer instead of adding a separate MCP gateway.

  16. # announced

    CrowdStrike Falcon Guardian

    CrowdStrike AI security platforms

    Uses the Falcon endpoint sensor to inventory known and unapproved AI agents on Windows and macOS, block agents that are not allowed to run, and trace agent activity from prompt and identity through tool calls to system actions. CrowdStrike describes an AI gateway for MCP traffic as a later addition.

    Why it matters Organizations that already run the Falcon sensor can get agent inventory and enforcement on endpoints without deploying another agent.

  17. # generally available

    IAM Unified Access Policies for Gemini Enterprise Agent Platform

    Google MCP security & gateways

    Access policies that Agent Gateway enforces, with Identity-Aware Proxy, on traffic from agent identities to destinations such as MCP servers and other agents.

    Why it matters Which agent may call which tool or agent becomes an IAM policy decision at the gateway rather than logic inside each agent.

  18. # generally available

    AWS Agent Registry

    AWS Shadow-AI discovery

    A private catalog of agents, tools, skills and MCP servers. At general availability it can find AgentCore runtimes and gateways across an AWS Organization on its own and keep the catalog in sync, with cross-account sharing through AWS RAM and customer managed KMS keys.

    Why it matters An inventory that fills itself from the organization shows which agents exist without relying on teams to register them.

  19. # announced

    Hard spend caps for agent workloads in Cloud Billing

    Google LLM gateways & spend

    Admins can set a hard monthly spend cap per project in the Cloud Billing console; when it is reached, the agent's API calls pause while other infrastructure keeps running. Email alerts fire at 50, 80 and 100 percent of the budget, and work can be resumed with one click or overages turned on so usage continues at consumption rates.

    Why it matters A cap that pauses only the agent gives finance a hard stop on agent spend without taking other workloads down.

  20. # generally available

    Okta Agent SSO

    Okta Agent identity & NHI

    Brings the Cross App Access standard into core Okta SSO: supported agents are registered in Universal Directory and receive short-lived, identity-governed tokens to enterprise apps in place of stored credentials. It covers only agents that support Cross App Access.

    Why it matters Okta SSO customers can replace long-lived agent API keys for supported apps without a separate purchase.

    Pricing Included in core Okta SSO plans at no additional cost.

  21. # generally available

    Agent Identity auth manager

    Google Agent identity & NHI

    A central credential vault and authentication broker for agents' outbound tool calls, covering three-legged OAuth, two-legged OAuth and API keys. With the Agent Identity APIs it replaces the older IAM Connectors API.

    Why it matters Tool credentials sit in one governed store instead of in each agent's code or configuration.

  22. # generally available

    Rippling MCP Gateway

    Rippling MCP security & gateways

    Before a tool call over a supported MCP connection runs, it checks who is calling and whether admin policy allows that tool, then logs the call. Admins assign tools by group or person from Rippling's employee records, employees have no access until a policy exists, the connected app's own permissions still apply, and access follows role changes and ends at offboarding. Rippling documents its own MCP server and a Slack connector, used from standard MCP clients. It launched alongside Agent Identity Management as part of the Rippling AI Governance suite.

    Why it matters An agent acting for an employee can be held to fewer tools than the employee has, with access tied to HR records that already change when people move teams or leave.

  23. # announced

    Rippling AI Gateway

    Rippling LLM gateways & spend

    Rippling describes a route for employees' and agents' LLM traffic through Rippling, where admins limit which models each person or team can use based on Rippling employee data, set budgets and hard spend caps that block requests at the limit, send routine work to lower-cost models, and log each request with usage and cost by user, team, department, provider and model. It first described the gateway on 2026-08-06 as the routing layer it built for its own LLM traffic. Customers can join a waitlist, and Rippling has given no availability date.

    Why it matters Model access and budgets would follow each person's team and role in Rippling, and a cap stops requests at the limit instead of only reporting spend.

  24. # generally available

    Rippling Agent Identity Management

    Rippling Agent identity & NHI

    Lets admins create AI agents as records in Rippling next to employees and service accounts, give each one an owner and permissions, and provision agents into third-party apps with the access controls they already use in Rippling. An agent acts either on permissions an employee delegates or under its own managed identity, and in both cases admins can see its access, spend and activity and can revoke it from one system. It launched as one of four products in Rippling AI Governance; Rippling said at launch that it was live, while the suite's AI Gateway and Shadow AI Detection were waitlist only.

    Why it matters Rippling customers can give agents that would otherwise run on shared keys, generic service accounts or borrowed employee credentials a named owner, and revoke them from the same system they use to manage employees.

  25. # generally available

    AgentCore payments

    AWS Agent payments

    Lets agents discover and pay for paid APIs, MCP servers and content, with configurable payment limits enforced at the infrastructure layer and payment activity visible in AgentCore Observability.

    Why it matters Limits enforced outside the agent's code put a hard boundary on what an agent can pay out.

  26. # beta

    MCP traffic detection and portal enforcement in Cloudflare Gateway

    Cloudflare Shadow-AI discovery

    Cloudflare Gateway classifies inspected traffic as MCP, shows which users and servers generate it and whether it went through an approved MCP portal, and lets admins block MCP connections that skip the portal. The MCP selector is marked experimental and needs TLS inspection.

    Why it matters Direct MCP connections that bypass an approved portal become visible and blockable at the network layer.

  27. # generally available

    Claude Compliance API: local session transcripts

    Anthropic Agent observability

    Claude Enterprise admins can list and retrieve transcripts of Claude Code and Cowork sessions that run on employees' own machines through the Compliance API. The endpoints launched in beta on 2026-08-11 and left beta for Cowork and Claude Code on 2026-08-26.

    Why it matters Agent sessions on employee laptops can be retained and reviewed in the same compliance export as web and desktop chats.

  28. # announced

    Temporal policies and rate limiting in Amazon Bedrock AgentCore

    AWS MCP security & gateways

    Temporal policies judge each request against the agent's earlier actions in the session, so rules can enforce step order, tie a tool argument to an earlier output, or require human approval for privileged actions. Gateway rate limits cap requests, tokens or connections per user or group, scoped by OAuth or IAM identity.

    Why it matters Some harmful actions only show up as a sequence, and per-identity limits bound what one agent or user can consume.

  29. # private preview

    Cloudflare WriteGuard for MCP server portals

    Cloudflare MCP security & gateways

    A policy layer for Cloudflare MCP server portals that gives each tool a risk tier and an on or off state, blocks a disabled tool before its handler runs, and adds agent and session attribution to the user's writes in the downstream app. Cloudflare runs it on its own MCP servers today; portal customers get it through a private beta that Cloudflare says will expand toward general availability.

    Why it matters The check runs in the portal, not in the agent client, so it does not rely on client-side controls that Cloudflare notes vary by harness and can be switched off by users.

  30. # beta

    Claude Enterprise inference hooks

    Anthropic Data flow & AI-DLP

    Claude Enterprise organizations can point Claude at their own AI security server; each governed prompt in claude.ai, Cowork and Claude Code waits for that server's allow or deny verdict before inference runs, and denials are recorded in the compliance Activity Feed.

    Why it matters Buyers can apply an existing DLP or AI security policy to Claude traffic at the model call rather than at a network proxy.

  31. # generally available

    SailPoint Agentic Fabric

    SailPoint Agent identity & NHI

    Uses endpoint and browser sensors to find AI agents, credentials and MCP servers, assigns every machine account a human owner through ownership rules, and adds a central kill switch for rogue agents and inline redaction of personal data in prompts before they reach a model. It is sold on its own or inside SailPoint's identity security suites.

    Why it matters SailPoint customers can bring agents into the same ownership and review model they use for human identities.

  32. # private preview

    Drata AI Agent Governance

    Drata AI governance & compliance

    A sensor on managed devices watches AI activity, an MCP proxy checks each agent tool call against plain-language policy and stops violations before they run, and activity is masked on the device before it reaches a tamper-evident evidence feed. It ships first for agents on Anthropic; OpenAI, Vertex AI and Bedrock support is in development.

    Why it matters Agent activity becomes audit evidence in the same system that holds an organization's other compliance evidence.

  33. # generally available

    Varonis Agent Intent-Based Access Control

    Varonis Data flow & AI-DLP

    Compares an agent's reasoning, tool calls and data access with the instruction it was given, across the whole session, and alerts on or blocks actions that drift from it. Varonis Atlas can quarantine the identity behind an agent for a set period.

    Why it matters Role-based access says what an agent can reach; an intent check asks whether a given use of that access fits the task.

  34. # generally available

    Island controls for AI agents (Agentic Endpoint Posture, Agentic Identity, AI Protect)

    Island Shadow-AI discovery

    Inventories agents, skills and MCP servers on endpoints and flags risky configurations, tracks agent identities and grants just-in-time access through Island's MCP gateway, and applies policy to prompts, responses, tool calls and uploads. A fourth module tracks AI usage and cost per person and per agent.

    Why it matters Island customers can govern agents from the browser and endpoint footprint they already use for employee AI use.

  35. # private preview

    AI Governance from Vanta

    Vanta AI governance & compliance

    Starts with an inventory of agents across approved platforms, endpoints and developer machines, linking each to the systems, data and vendor it touches. AI impact assessments aligned to ISO 42001 and the EU AI Act, policy enforcement and continuous monitoring of agent behavior are described as later steps.

    Why it matters The early-access release is an inventory; buyers who need enforcement or assessments should treat those as roadmap.

New to the terms in here? The glossary defines them in plain English, and the incident database records what has actually gone wrong with AI agents so far.

The Permission Layer

Get the briefing by email

At least one email a week on AI agent identity, permissions, security and spend, written for the people who approve agent access. Five-minute read, free.

You confirm by email. Unsubscribe in one click.