# Research memo: AI-agent governance toolkits and products

**As of 15 September 2026.** This review emphasizes controls designed specifically for autonomous agents, agent identities, MCP/tool use, or agent runtimes. It distinguishes **governance/enforcement** from products that only trace or evaluate agents.

## Executive findings

1. **The market has split into five overlapping control planes:**
   - Cloud-native agent platforms: AWS, Google Cloud, Microsoft.
   - Identity/authorization: Ping, Okta, Descope, Oasis, Cerbos, Permit.
   - MCP/tool gateways: Docker, Stacklok ToolHive, Lasso.
   - AI runtime security: Cisco, Palo Alto Networks, Check Point/Lakera, Holistic AI.
   - Lifecycle risk/evaluation: IBM, Salesforce, Credo AI, LangSmith, Phoenix, AgentOps.

2. **No vendor clearly demonstrates every required governance layer.** The strongest broad suites are AWS AgentCore, Google’s Gemini Enterprise Agent Platform, Cisco’s combined identity/access/behavior offering, and Docker’s MCP Enterprise Gateway when governance scope is primarily tool use.

3. **Identity is becoming an agent-specific primitive rather than a reused service account.** Microsoft now models blueprints, agent identities, agent users, sponsors, lifecycle, Conditional Access, and risky-agent detection. Google supports agents acting as themselves or on behalf of users. Descope issues short-lived, audience- and scope-limited credentials and preserves delegation chains.

4. **Tool-call interception is the emerging enforcement point.** AWS evaluates requests before Gateway tool access; Docker applies policy to each MCP call; Cerbos authorizes tools at the MCP server; Check Point/Lakera inspects tool calls, responses, and descriptions; Agent Control evaluates inputs and outputs in the agent loop.

5. **Runtime isolation is much less common than runtime filtering.** ToolHive and Docker explicitly isolate containerized MCP servers. AWS provides a managed agent runtime and infrastructure boundary. Most “runtime security” vendors inspect prompts, actions, or traffic but do not sandbox agent execution.

6. **Human approval remains a gap.** Permit’s Access Request MCP is a concrete approval building block; Ping has custodians, certifications, and access-request workflows. Most products offer blocking, alerts, or policy checks rather than configurable multi-party approval, separation of duties, or transaction thresholds.

7. **Incident response is usually underdeveloped.** Holistic AI explicitly advertises kill switches, quarantine, privilege revocation, rerouting, and rollback. Other products mostly provide blocking, revocation, alerts, SIEM export, or investigation logs—not a complete agent incident-response lifecycle.

8. **Observability is not governance by itself.** Phoenix, AgentOps, and LangSmith provide valuable traces and evaluations, but they do not independently establish agent identity, authorize actions, isolate execution, or guarantee pre-action enforcement.

---

## Capability comparison

Legend: **●** explicit capability; **◐** partial, adjacent, or integration-dependent; **—** not evidenced in reviewed public material.  
Columns: **ID** identity/inventory; **POL** authorization/policy; **TOOL** pre-tool/action control; **ISO** runtime isolation; **AUD** observability/audit; **HITL** approval/human oversight; **RISK** testing/evaluation/risk; **COMP** compliance mapping/evidence; **IR** containment/incident response.

| Offering | Type / evidence basis | ID | POL | TOOL | ISO | AUD | HITL | RISK | COMP | IR |
|---|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|
| AWS Bedrock AgentCore | Full cloud platform; product docs | ● | ● | ● | ● | ● | — | ● | ◐ | ◐ |
| Google Gemini Enterprise Agent Platform | Full cloud platform; product docs | ● | ● | ● | ● | ● | — | ● | ● | ◐ |
| Microsoft Entra Agent ID | Agent identity/governance platform; product docs | ● | ● | ◐ | — | ● | ◐ | ● | ● | ◐ |
| Ping Agent Governance | Cross-platform agent IGA; vendor claims | ● | ● | ◐ | — | ● | ● | ● | ● | ◐ |
| Cisco Zero Trust for Agentic AI + AI Defense | Broad security suite; vendor claims | ● | ● | ● | — | ● | — | ● | ◐ | ● |
| Palo Alto Prisma AIRS | Broad AI security platform; vendor claims | ● | ◐ | ● | — | ● | — | ● | ◐ | ● |
| Holistic AI Guardian Agents | Runtime governance suite; vendor claims | ● | ● | ● | — | ● | — | ● | ● | ● |
| Check Point AI Agent Security / Lakera | Agent posture + runtime security; public docs | ● | ● | ● | — | ● | — | ● | ◐ | ● |
| IBM watsonx.governance | Lifecycle governance/evaluation; product docs | ● | ◐ | — | — | ● | ◐ | ● | ● | ◐ |
| Salesforce Trust Layer / Agentforce | Platform-native trust layer; product docs | ◐ | ● | ◐ | — | ● | ◐ | ● | ● | ◐ |
| Descope Agentic Identity Hub | Identity and credential control plane; detailed docs | ● | ● | ● | — | ● | ◐ | — | ◐ | ◐ |
| Docker MCP Enterprise Gateway | MCP governance platform; product docs | ● | ● | ● | ● | ● | — | ◐ | ● | ● |
| Stacklok ToolHive | Apache-2.0 core plus enterprise tier; OSS docs | ● | ● | ● | ● | ● | — | ◐ | ◐ | ◐ |
| Lasso MCP Security | MCP security platform plus OSS gateway; vendor/OSS | ● | ● | ● | — | ● | — | ● | ● | ● |
| Cerbos | General authorization adapted to agents/MCP; OSS/commercial | ◐ | ● | ● | — | ● | — | — | ● | ◐ |
| Permit.io | Authorization plus Access Request MCP; commercial/OSS components | ◐ | ● | ● | — | ● | ● | — | ◐ | ◐ |
| Okta Cross App Access | Agent-to-app identity protocol/product | ● | ● | ◐ | — | ● | ◐ | — | ◐ | ◐ |
| Oasis Security | NHI/agent identity posture platform; vendor claims | ● | ● | ◐ | — | ● | — | ● | ● | ● |
| Credo AI Agent Governor | Agent harness controls; **research preview/beta** | ◐ | ● | ● | — | ● | — | ● | ● | ◐ |
| Galileo Agent Control | Open-source runtime guardrail control plane | — | ● | ● | — | ● | — | ● | ◐ | ◐ |
| NVIDIA NeMo Guardrails | Apache-2.0 programmable guardrails | — | ◐ | ● | — | ◐ | — | ● | — | ◐ |
| Phoenix / AgentOps / LangSmith | Observability and evaluation | — | — | — | — | ● | — | ● | ◐ | ◐ |

A “●” records a documented feature, not independent validation of effectiveness, coverage, latency, or production maturity.

---

## Detailed landscape and evidence

### 1. AWS Bedrock AgentCore

The most integrated cloud-native stack reviewed. AgentCore includes managed runtime, Identity, Gateway, Policy, Observability, and Evaluations. Its policy engine intercepts AgentCore Gateway traffic and evaluates requests **before tool access**, using deterministic Cedar policies. Policies can depend on user identity, tool, input parameters, and conversation history; decisions are logged to CloudWatch. AWS also describes automated reasoning checks for overly permissive, overly restrictive, and unsatisfiable generated policies.

**Limits:** Enforcement is strongest when calls traverse AgentCore Gateway. Public material does not present a first-class human approval workflow or broad cross-cloud agent inventory.

Sources:

- [AgentCore product overview](https://aws.amazon.com/bedrock/agentcore/)
- [Policy in AgentCore](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy.html)
- [Policy observability data](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-policy-metrics.html)
- [Identity observability data](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-identity-metrics.html)

### 2. Google Gemini Enterprise Agent Platform

Google documents a centralized govern surface with an **Agent Registry**, agent and MCP topology, agent identity, Agent Gateway, semantic-governance policies, Model Armor, safety controls, security findings, monitoring, and request/response audit trails. Agent Identity supports acting as the agent or on behalf of an end user. Agent Gateway can delegate authorization to IAP, Model Armor, or a custom authorization service.

This is one of the broadest architectures because it spans discovery, delegated identity, gateways, content security, semantic intent policy, monitoring, and cloud runtime.

**Limits:** Human approvals and case-management-style incident response are not prominent in the reviewed documentation.

Source: [Govern your agents](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern)

### 3. Microsoft Entra Agent ID

Microsoft provides the most developed agent-specific identity data model reviewed: **agent identity blueprint, blueprint principal, agent identity, and agent user**. Agents can have unique access, human sponsors, entitlement and lifecycle governance, Conditional Access, risk detection, network controls, and dedicated sign-in/audit logs. OAuth 2.0, MCP, and A2A are supported; third-party agents can integrate through an SDK sidecar or workload federation.

**Limits:** Entra governs identity and access rather than sandboxing execution. It does not by itself semantically validate every tool parameter or evaluate whether an action matches the user’s intent.

Sources:

- [What is Microsoft Entra Agent ID?](https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id)
- [Governing agent identities](https://learn.microsoft.com/en-us/entra/id-governance/agent-id-governance-overview)
- [Agent sign-in and audit logs](https://learn.microsoft.com/en-us/entra/agent-id/sign-in-audit-logs-agents)

### 4. Ping Agent Governance

Ping claims cross-platform discovery across Azure AI Foundry, Copilot Studio, AWS Bedrock/AgentCore, Google Vertex, Salesforce Agentforce, and custom platforms. It maps agents to tools, knowledge bases, permissions, and accountable human custodians; supports certifications, just-in-time requests, temporal constraints, behavior normalization, anomaly detection, and unified audit trails.

This is a strong **cross-platform IGA proposition**, especially for ownership and access lifecycle.

**Caution:** Evidence is a vendor product page rather than public implementation documentation. Tool-call interception, runtime isolation, and demonstrated automated containment are less clear than its identity-governance features.

Source: [Ping Agent Governance](https://www.pingidentity.com/en/product/agent-governance.html)

### 5. Cisco Zero Trust for Agentic AI and AI Defense

Cisco combines agent discovery and owner mapping, standardized identities, short-lived tool-specific permissions, network-level behavior inspection, AI application inventory, model assessment, and runtime guardrails. It explicitly connects identity context to behavior and says unsafe actions and data exfiltration can be blocked in real time.

**Limits:** Public descriptions are architectural and product-level; implementation details for approval logic, policy language, and supported agent frameworks are limited. Runtime inspection is not equivalent to process isolation.

Sources:

- [Zero Trust for Agentic AI](https://www.cisco.com/site/us/en/solutions/artificial-intelligence/security/securing-agentic-ai/index.html)
- [Cisco AI Defense](https://www.cisco.com/site/us/en/products/security/ai-defense/index.html)

### 6. Palo Alto Networks Prisma AIRS

Prisma AIRS positions itself as end-to-end AI security: discover agents, applications, models, and connections; assess applications and agents continuously; control permissions; and enforce AI-specific runtime protections against prompt injection, data leakage, malicious code, and related threats.

**Limits:** The public overview gives fewer details on agent-native identities, approval workflows, deterministic action authorization, and response orchestration. Treat “end-to-end” as a vendor claim pending architecture and integration validation.

Sources:

- [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)
- [AI Runtime Security](https://www.paloaltonetworks.com/ai-security/ai-runtime-security)

### 7. Holistic AI Guardian Agents

Guardian Agents are divided into **Sentinels**, which discover, monitor, risk-score, and create audit trails, and **Operatives**, which block, quarantine, revoke privileges, reroute traffic, activate kill switches, remediate, and roll back. Holistic AI claims cross-cloud enforcement and mappings to the EU AI Act, NIST AI RMF, and ISO/IEC 42001.

It has the clearest published **incident-containment feature set** in the sample.

**Caution:** These are broad vendor claims; public technical evidence for connector coverage, enforcement completeness, latency, and rollback semantics should be tested in procurement.

Source: [Holistic AI Guardian Agents](https://www.holisticai.com/guardian-agents)

### 8. Check Point AI Agent Security / Lakera

The documentation is unusually concrete. It discovers agents, tools, and MCP servers across Bedrock/AgentCore, Google Cloud, Copilot Studio, Agentforce, n8n, and Relevance AI; assigns risk ratings mapped to OWASP and MITRE ATLAS; and inspects prompts, tool calls, tool responses, and tool descriptions. Controls include tool allow/deny lists, dangerous-deviation detection, DLP, prompt-injection defense, custom policies, monitor/enforce modes, dashboards, logs, and monitoring integrations.

**Limits:** It is primarily posture management plus inline AI security, not an agent identity provider, credential broker, approval engine, or isolated runtime.

Source: [AI Agent Security documentation](https://docs.lakera.ai/guard)

### 9. IBM watsonx.governance

IBM’s agent-governance emphasis is lifecycle inventory, risk/compliance workflows, monitoring, and evaluation. Public material describes agentic metrics and governance automation and integrates with broader watsonx/OpenPages governance.

**Limits:** The reviewed evidence is strongest for evaluation and compliance management, not deterministic pre-tool authorization, credential delegation, or isolation. Some announcements describe previews or evolving capabilities and should not be treated as universally GA.

Sources:

- [IBM agent governance announcement](https://www.ibm.com/new/announcements/ibms-answer-to-governing-ai-agents-automation-and-evaluation-with-watsonx-governance)
- [watsonx.governance](https://www.ibm.com/products/watsonx-governance)

### 10. Salesforce Trust Layer / Agentforce

The Trust Layer provides platform-native privacy and security controls, including masking, encryption, zero-data-retention arrangements with model providers, safety controls, and audit data. Salesforce also exposes Trust Layer audit trails and dashboards in Data Cloud.

**Limits:** This is primarily governance within Salesforce’s application and data boundary. It is not a neutral cross-platform agent identity, MCP authorization, isolation, or incident-response product.

Sources:

- [Trusted AI and Trust Layer](https://www.salesforce.com/artificial-intelligence/trusted-ai/)
- [Trust Layer audit trail](https://help.salesforce.com/s/articleView?language=en_US&id=release-notes.rn_einstein_audit_trail_intro.htm&release=248&type=5)
- [Audit dashboards and reports](https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein_audit_dashboards_reports.htm&language=en_US&release=250&type=5)

### 11. Descope Agentic Identity Hub

Descope is a detailed agent identity and credential-brokering control plane. It supports OAuth 2.1 protection for APIs and MCP servers, agent registration, resources/audiences, per-tool scopes, runtime-context policy, credential vaulting, token exchange, short-lived credentials, and audit chains back to the originating user. The recommended pattern prevents long-lived third-party secrets from reaching the agent.

**Limits:** It does not supply an isolated agent runtime or broad behavioral evaluation. Approval is possible through authorization and consent patterns but is not a full operational approval/case-management system.

Source: [Agentic Identity Hub documentation](https://docs.descope.com/agentic-identity-hub)

### 12. Docker MCP Enterprise Gateway

Docker provides one of the clearest MCP governance offerings: identity-provider authentication, group-scoped server/tool catalogs, per-call policy, call-time credential injection, immediate revocation, SIEM-ready structured decision events, private/air-gapped deployment, and isolated execution for containerized MCP servers. Policy can be native or delegated to an existing engine.

**Limits:** It governs MCP reachability and execution rather than the full agent lifecycle. Non-MCP actions or direct API calls must be forced through equivalent controls. Native human approvals and agent-risk evaluation are not central.

Source: [Docker MCP Enterprise Gateway](https://www.docker.com/products/mcp-enterprise-gateway/)

### 13. Stacklok ToolHive

ToolHive is an **Apache-2.0 open-source MCP platform**, not merely a vendor claim. Its runtime launches MCP servers in isolated containers and provides fine-grained permissions, network controls, secrets management, OpenTelemetry/Prometheus telemetry, audit logging, a trusted registry, and a gateway for centralized authentication, authorization, and tool filtering. Kubernetes operation is supported. Stacklok Enterprise adds centralized management, IdP integrations, hardened images, budgets, and a web console.

**Limits:** The open-source core is a building block rather than a complete enterprise governance program. Compliance mappings, human approvals, model/agent evaluations, and formal incident workflows require integration or the commercial tier.

Sources:

- [ToolHive documentation](https://docs.stacklok.com/toolhive/)
- [ToolHive source repository](https://github.com/stacklok/toolhive)

### 14. Lasso MCP Security

Lasso claims MCP discovery, inventory, risk scoring, role-based permissions, DLP, real-time monitoring of tool calls, intent-aware policy, prompt- and memory-poisoning detection, audit trails, compliance reporting, and threat detection/response. It also publishes an open-source MCP gateway.

**Limits:** The commercial product is broader than the open-source gateway; these should not be conflated. Runtime isolation and first-class agent identity lifecycle are not clearly evidenced.

Sources:

- [Lasso MCP Security](https://www.lasso.security/use-cases/mcp-security)
- [Open-source MCP Gateway](https://github.com/lasso-security/mcp-gateway)

### 15. Cerbos

Cerbos is a general-purpose policy decision point with direct MCP patterns. An MCP server asks Cerbos which tools a principal may use based on RBAC, ABAC, or policy-based access rules. It supports delegated authorization, live policy reloads, structured authorization logs, and records the agent, user, action, and deciding policy.

**Limits:** Cerbos does not discover agents, issue identities, isolate runtimes, evaluate model behavior, or provide content-security detection. It is a strong **authorization building block**, not a complete agent-governance suite.

Source: [Cerbos authorization for MCP servers](https://www.cerbos.dev/features-benefits-and-use-cases/dynamic-authorization-for-MCP-servers)

### 16. Permit.io

Permit supplies fine-grained authorization, policy-as-code, local policy decision points, and agent/MCP integrations. Its Access Request MCP lets an agent request a sensitive permission and delegate the decision to a human under policy control—a concrete answer to agent approval requirements.

**Limits:** It is principally authorization and approval infrastructure. Identity issuance, isolation, behavioral security, evaluation, compliance evidence, and incident management must come from other components.

Sources:

- [AI access control](https://www.permit.io/ai-access-control)
- [Access Request MCP](https://www.permit.io/blog/delegating-ai-permissions-to-human-users-with-permitios-access-request-mcp)

### 17. Okta Cross App Access

Cross App Access is an OAuth extension intended to place agent-to-app authorization under enterprise IdP control rather than embedded tokens and unmanaged consent. It promises central policy, oversight, and auditability and is recommended by Okta for enterprise MCP connections.

**Limits:** It is a protocol and identity-layer capability, not full governance. Adoption by both agent providers and target applications is required. It does not itself inspect semantic tool arguments, sandbox code, or evaluate agent behavior.

Source: [Okta Cross App Access](https://www.okta.com/solutions/cross-app-access/)

### 18. Oasis Security

Oasis applies non-human identity management to agents: discovery of shadow agents and credentials, least privilege, delegated-permission analysis, access isolation, provisioning and rotation, activity attribution, and remediation of excessive access.

**Limits:** It is strongest for NHI posture and credential risk. Agent-loop policy, semantic intent control, runtime isolation, evaluation, and approval workflows are not its principal public differentiators.

Source: [Oasis agentic AI governance](https://www.oasis.security/solutions/ai)

### 19. Credo AI Agent Governor

Agent Governor aims to compile organizational policies, risk appetite, and regulatory requirements into versioned governance-as-code enforced inside the agent harness, with enforcement telemetry.

**Critical maturity qualification:** Credo labels it **“Research Preview,” “Beta Service,” “not generally available,” and without a production SLA**. Its current page says Claude Code is supported and identifies policy audits and several broader capabilities as future work.

Source: [Credo AI Agent Governor](https://credo.ai/agent-governor)

### 20. Galileo Agent Control

Agent Control is an open-source centralized runtime guardrail layer. Its documentation describes configurable controls, selectors, evaluators, actions, blocking of harmful content, prompt injection and PII leakage, policy updates without agent redeployment, and audit-ready traces.

**Limits:** It governs inputs and outputs around the agent loop; it is not an identity system, credential broker, sandbox, entitlement-governance system, or complete compliance platform.

Sources:

- [Agent Control](https://agentcontrol.dev/)
- [Documentation](https://docs.agentcontrol.dev/core/overview)
- [Source repository](https://github.com/agentcontrol/agent-control)

### 21. NVIDIA NeMo Guardrails

NeMo Guardrails is an Apache-2.0 toolkit for programmable input, output, dialog, retrieval, execution, and topical rails. It is useful for constraining agent/model behavior and composing safety checks.

**Limits:** It does not inherently provide enterprise agent identity, access lifecycle, isolation, approvals, SIEM evidence, or incident response. Those must be built around it.

Source: [NeMo Guardrails repository](https://github.com/NVIDIA-NeMo/Guardrails)

### 22. Phoenix, AgentOps, and LangSmith: valuable, but mainly observability/evaluation

- **Phoenix** is open-source OpenTelemetry-based tracing, experimentation, evaluation, and troubleshooting.
- **AgentOps** is an MIT-licensed agent monitoring/evaluation platform with session replay, cost tracking, and framework integrations.
- **LangSmith** provides detailed agent traces, datasets, online/offline evaluations, and debugging.

These systems can provide evidence inputs for governance and incident investigation, but they do not, by themselves, authorize tool calls, issue agent identities, isolate runtimes, or enforce least privilege.

Sources:

- [Phoenix repository](https://github.com/Arize-ai/phoenix)
- [AgentOps repository](https://github.com/AgentOps-AI/agentops)
- [LangSmith platform](https://langchain.com/langsmith-platform)
- [LangSmith evaluation documentation](https://docs.langchain.com/langsmith/evaluation)

---

## Open-source assembly options

A credible open-source-heavy governance stack can be assembled, but no single project supplies the full control plane:

| Governance need | Practical building blocks |
|---|---|
| Agent/MCP workload isolation | [ToolHive](https://github.com/stacklok/toolhive), containers/Kubernetes |
| Fine-grained authorization | [Cerbos](https://github.com/cerbos/cerbos), [OPA](https://www.openpolicyagent.org/), Cedar |
| MCP gateway/control point | [ToolHive](https://github.com/stacklok/toolhive), [Lasso MCP Gateway](https://github.com/lasso-security/mcp-gateway), [Docker MCP Gateway](https://github.com/docker/mcp-gateway) |
| Runtime content/action rails | [Agent Control](https://github.com/agentcontrol/agent-control), [NeMo Guardrails](https://github.com/NVIDIA-NeMo/Guardrails), [Guardrails AI](https://github.com/guardrails-ai/guardrails) |
| Observability/evaluation | [Phoenix](https://github.com/Arize-ai/phoenix), [AgentOps](https://github.com/AgentOps-AI/agentops), OpenTelemetry |
| Human approval | Permit Access Request MCP pattern or a custom workflow engine |
| Compliance/incident workflow | SIEM/GRC/SOAR integration; largely not solved by the OSS agent layer |

A sound architecture needs an **unbypassable mediation point**. Policy libraries embedded only in agent code can be disabled, omitted, or bypassed through direct calls. The stronger designs place enforcement at a gateway, MCP server, sidecar, network boundary, or credential broker and deny direct alternate paths.

## Procurement and validation checklist

Vendor demonstrations should be tested against these questions:

1. Does every agent receive a unique identity, owner, purpose, environment, and lifecycle state?
2. Is end-user delegation preserved, or does the agent collapse to a broad service account?
3. Can policy inspect the exact tool, resource, arguments, amount, data classification, and prior session actions?
4. Is enforcement fail-closed, and can the agent bypass the gateway through direct API or network access?
5. Are credentials short-lived, audience-bound, scope-limited, and hidden from model context?
6. Can high-risk actions require one or more human approvals, with timeout and separation of duties?
7. Are the agent process, tool server, filesystem, network egress, secrets, and code execution isolated?
8. Do logs preserve user → agent → sub-agent → tool causality and both allow and deny decisions?
9. Can sensitive prompt/tool payloads be redacted while retaining forensic usefulness?
10. Are risk and evaluation results release gates, or merely dashboard metrics?
11. Can controls be mapped to actual evidence for the EU AI Act, NIST AI RMF, ISO/IEC 42001, SOC 2, and sector rules?
12. Can responders suspend an identity, revoke tokens, terminate sessions, quarantine a tool/server, preserve evidence, and safely restore service?

## Bottom line

The strongest near-term pattern is **compositional**:

- an agent-aware IdP and credential broker;
- deterministic authorization at an MCP/API gateway;
- isolated execution for agents and tool servers;
- semantic/runtime defenses for prompt injection and intent deviation;
- trace and decision logs with delegation provenance;
- risk/evaluation gates in CI and production;
- explicit human approval for irreversible actions;
- SIEM/SOAR-connected containment and recovery.

Cloud suites reduce integration effort but create platform boundaries. Identity vendors solve accountability and least privilege but not behavioral safety or isolation. AI-security vendors detect and block model/agent threats but often lack durable identity and approval semantics. Observability products provide evidence, not authority. The market is converging, but claims of a single complete “agent governance platform” should still be validated control by control.