The autonomy problem no one talks about

Enterprises are handing AI agents more freedom every quarter. Agents now plan, decide, and act across systems without a human approving each step. That shift raises a question that belongs at the center of every architecture review: When an agent tries to do something it was never authorized to do, what actually stops it?

These are your agents, running on your models, touching your data in your infrastructure. The responsibility for their actions sits with you. That responsibility can’t be met in hindsight, and it can’t be met with abstract policies that live on paper but not in practice. Agents need rules in the context of the moment, because they don’t exercise overriding judgment about their own actions.

Consider a simple rule: Never open the car door. Followed literally, an agent could never get in or out of the car at all. But change the context — a crash, a fire, someone hurt and needing to escape — and the rule you actually want is the opposite. Context in the moment is everything. We’re asking agents to do intelligent things; that requires intelligent rules.

Why guardrails around the agent aren’t enough

The instinct is to add guardrails: instructions, policies, and monitoring layered above the model. Those mechanisms matter, but they share a structural limit. The car-door rule is plausible right up until the moment you actually have to decide whether to open the door.

Controls at the agent layer are only as reliable as the agent’s output is predictable. Autonomy is precisely the property that makes that output hard to predict. Governance that depends on reviewing an action before it happens cannot keep pace with a system that acts in milliseconds, across many systems at once.

Governance has to become executable. And it has to be enforced where agents actually do their work: at the operational data layer, in the context, and exactly at the moment it is happening.

The data layer is the enforcement point

Agents create value by touching data. They query it, retrieve it, transform it, and increasingly act on it. A policy that says an agent should not reach a certain class of data is meaningful only if the system can deny that access at the moment the agent requests it.

Similarly, a principle that AI must be auditable is meaningful only if the organization can reconstruct what the agent did, what data it touched, which user it acted for, and what resulted. When governance lives at the data layer, it holds regardless of how the agent was built or how it behaves. The control is a property of the database itself, not a promise made by the agent.

Agent behavior is probabilistic. Governance cannot be

The enterprise should not rely on a model choosing to follow policy. The policy has to be enforced by the system. That is the difference between hoping an actor stays in bounds and constructing bounds it cannot cross to begin with.

The controls that make this real are ones many enterprises already run at the data layer:

• Role- and attribute-based access control
• Row- and column-level security
• Classification and masking
• Policy as code
• Complete audit trails

What agents change is not the mechanism, but who the mechanism has to recognize. Identity management has to treat the agent as a principal in its own right, with its own identity and a purpose declared when the session opens. Once purpose is bound to identity, the policy engine can evaluate it the same way it evaluates role or department today. The record of what happened can capture not just who acted and what they touched, but what they declared they were there to do.

Nine controls under three imperatives

In practice, this resolves into nine controls, grouped under three imperatives.

Enforce it

• Role- and attribute-based access control enforced at query time, for agents as well as users
• Dynamic column masking driven by the same policy path
• Agent identity as a first-class principal, with declared purpose bound at session start and the acting user preserved

See it and prove it

• Classification and tagging that drives policy
• Session-level audit logging that records which agent acted, for which user, and under what declared purpose
• Lineage across pipelines, so a result can be traced back to the request that produced it

Unify and harden

• Centralized, portable policy management
• Encryption at rest and in transit
• Consistent enforcement across on-prem, cloud, and sovereign or air-gapped environments

“Declared purpose is what makes the difference,” says Priyanka Jain, VP of product management for data & AI governance at EDB. “It becomes an attribute the access layer already understands, evaluated in the same policy path as role and row-level security. The enforcement mechanism does not change. What changes is that the agent’s purpose is part of what it evaluates, and part of what the record proves afterward.”

A digital leash, not a locked door

The goal is not to stop agents from doing useful work. It is to define how far an agent can go, what it can touch, what it can change, what requires escalation, and how the organization can reconstruct events if something goes wrong.

Governed this way, agents are identified, scoped, monitored, and auditable. The enterprise can adopt them faster, because security, risk, and leadership teams trust the operating model underneath. That trust is what lets you move aggressively on AI rather than cautiously around it.

Open, sovereign, and enforceable at the source

Built on open source Postgres, this open foundation keeps enterprises in control of where their data lives, who can reach it, and under what policy — without ceding governance to a layer they don’t own or can’t inspect. For regulated industries, that combination of data sovereignty and source-level enforcement isn’t a nice-to-have; it’s the precondition for putting agents into production at all.

Agentic systems will keep getting more capable and more autonomous. That is a reason to be deliberate about where control lives, not a reason to slow down. The enterprises that enforce governance at the data layer can move fast on AI, because the thing protecting their data is more than just wishful thinking.

For a deeper look at the full framework, including how to implement these controls in your own stack, see EDB’s white paper Governing Agentic AI at Enterprise Speed. And if you’re still weighing how to approach AI agent security or database access control, the data layer is the right place to start.

Max Romanenko is Chief Technology Officer at EDB.

The AI Stage Gets Its Headliners

San Francisco is about to become the epicenter of the AI world again. From October 13–15, TechCrunch Disrupt 2026 returns to Moscone Center, and this year’s AI Stage — presented by Google for Startups — just locked in two of the biggest names in the game.

Anthropic and OpenAI are both sending senior executives to the stage. That’s not just a feather in the conference’s cap. It signals something bigger: the conversation has shifted from demo-day theatrics to the messy, unglamorous work of actually deploying AI inside real companies.

And honestly? It’s about time.

What Anthropic Sees After the Enterprise Deal Closes

Most enterprise AI panels are all about the pre-sales pitch. This one starts where the others end — after the contract is signed and Claude is running in production.

Cat de Jong, Head of Applied AI at Anthropic, works directly with the enterprises putting Claude to work across critical workflows. She sees patterns that never make it into press releases. Where deployments take off immediately. Where they stall. What separates organizations extracting real value from the ones still running pilots eighteen months in.

It’s a rare behind-the-curtain look at applied AI inside the world’s most closely watched AI company. If you’re building on top of frontier models, this session could save you from learning the hard way.

OpenAI’s Head of Productivity on the GTM Engineer Revolution

Here’s a wild fact: two years ago, the phrase “GTM engineering” didn’t exist. Today it’s one of the fastest-growing roles in tech, with independent practitioners building million-dollar businesses around it.

Tara Seshan, Head of Productivity at OpenAI, will trace how AI collapsed the traditional go-to-market stack and created an entirely new discipline in its place. The session promises to walk away with a practical understanding of what AI-native GTM actually looks like — and how it’s changing the way companies grow.

For founders still running outbound playbooks written in 2019, this one’s essential.

Security Sessions That Cut Through the Hype

AI is making autonomous decisions inside the most sensitive enterprise systems on Earth — at a speed and scale traditional security frameworks were never designed to handle. Two sessions on the AI Stage tackle this head-on.

The Agent Security Problem Nobody Is Talking About

Agentic AI is powerful, but it was never built to be secure. Ric Smith, President of Product & Technology at Okta, will get technical about what agent security actually requires at the infrastructure level. He’ll also explain why application-level permission models are fundamentally flawed — a claim that should ruffle some feathers in the boardroom.

Securing the AI Enterprise in 2026

This infrastructure-level session brings together Chet Kapoor from AWS, Katie Moussouris of Luta Security, and Wendy Nather from 1Password. Expect a candid breakdown of observability, governance, and the architectural principles that separate deployments enterprises can trust from ones they can’t afford to touch.

If your CTO has been losing sleep over AI sprawl, this is the session to send them to.

More Sessions Worth Your Time

The AI Stage roster goes deeper than the headliners. Here’s what else is on deck:

• The Video Intelligence Race: Dean Leitersdorf from Decart and Amit Jain from Luma AI discuss real-time inference and physical reasoning — what happens when generation crosses into genuine intelligence.
• Rewriting SaaS: Arvind Jain (Glean), Barr Moses (Monte Carlo), Cathy Gao (Sapphire Ventures), and Aaron Jacobson (NEA) debate whether the SaaS playbook is dead or just evolving. Pricing AI products sustainably when models are commoditizing is the core question.
• The GTM Engineer: Kareem Amin, Co-founder and CEO of Clay, goes deeper into how AI created tech’s next big job category — and what it means for growth teams.
• Enterprise assumptions: Arsalan Tavakoli from Databricks challenges what you think you know about enterprise AI security requirements in 2026.

Pricing, Tickets, and the Bottom Line

Disrupt 2026 isn’t just about the AI Stage. You’ll be surrounded by 10,000+ startup, tech, and VC leaders, with access to every other stage, Startup Battlefield, the exhibition floor, and enough networking opportunities to fill your calendar for months.

One practical note: the current pricing window is closing, and you can save up to $200 if you grab your ticket before it’s gone. If you’re planning to attend, don’t sleep on it.

The AI Stage at TechCrunch Disrupt 2026 is shaping up to be where the builders get specific. Whether you’re rethinking your pricing model, closing security gaps in your AI stack, or writing a go-to-market playbook that doesn’t exist yet — this is the room to be in.

The quiet failure mode nobody’s naming

Ask a security team a simple question: which agents can reach which systems? Watch the silence. Ask which agent triggered which downstream action three hops ago. More silence.

That silence is the real enterprise AI risk. Not a rogue agent going off-script — but the tangled web of connections between agents that nobody can see clearly enough to govern. Complexity is the insidious shadow lurking inside enterprises right now, and it needs a light shone on it.

The problem: enterprises don’t deploy a single agent and watch it run. They deploy fleets. Each one calling APIs, calling other agents, reaching into applications that were never built with a machine decision-maker in mind. That’s the failure mode that should keep you up at night: a windy, complicated system nobody can fully map.

Why complexity compounds faster than headcount

Add a second agent to a system, and you’ve added one connection. Add a tenth, and you haven’t added ten connections — you’ve potentially added dozens. Because now any agent might call any other, and each of those calls can trigger a call somewhere else.

Complexity doesn’t creep up with agent headcount. It compounds with the number of paths between agents. And nobody’s job is to draw that graph.

A support ticket that used to touch one system might now pass through four agents before a human ever lays eyes on it. Every one of those handoffs is a decision point nobody approved.

Where it actually breaks down

Permissions creep comes first. Somebody builds an agent to summarize support tickets, grants it broad API access because scoping it properly would’ve taken another sprint, and forgets about it. Six months later, that same agent has a path into the payments system. Nobody remembers signing off on that. Nobody did.

Ownership thins out the further the chain runs. Five agents touch one workflow, something breaks at step four, and now you’re asking who’s responsible for a link nobody was ever assigned to own. The org chart stopped at “deploy the agent” and never got to “name the human who answers for it.”

This is a story about governance infrastructure that hasn’t caught up with how agents actually behave: interconnected, cascading, multiplying faster than the processes built to track them.

The checklist trap

The instinct is to treat this like a checklist. Approve the agent. Log the agent. Move on. That’s the wrong instinct.

A checklist checks a single point in time. Complexity runs across a chain. You can’t govern a chain with a stack of one-time approvals any more than you can call a diet successful because you had a vegetable once.

What actually fixes the cluster

Fixing this starts with identity. Every agent needs to exist as its own entity — not a shadow permission borrowed from whoever deployed it. Its own name in the register. Its own scoped authority. A named human sponsor who answers for what it does.

That part is necessary. But it is nowhere near sufficient.

The harder piece is oversight that holds across the entire chain, not just at each individual link. You need to see what an agent did, what it set off downstream, and where that trail ends — in real time, not in a report someone pulls together once a quarter.

Get agent-level identity right and stop there, and you end up with a filing cabinet full of perfectly documented agents operating inside a system nobody can actually explain.

Oversight isn’t enforcement

And oversight by itself only tells you what already happened. Watching a chain isn’t the same as controlling it.

Enforcement is the piece most programs skip: the ability to stop an out-of-policy call before it executes, not just log it for someone to find in a review three weeks later. A dashboard that shows you an agent breached its scope five minutes ago is a monitoring tool. A system that stops the breach from happening in the first place is governance.

Enterprises serious about agent accountability need both. Most have only built the first.

Scale and accountability can grow together

We’re all running at blazing speed to ensure we’re not the ones left behind in the race we’ve found ourselves in. And we’re all too aware that there’s a cost to slowing down.

Every enterprise serious about agentic AI hits the complexity wall eventually. The ones that get past it are the ones who built enough visibility and accountability — so their fleet can keep growing without anyone losing the ability to answer one question: what is this system doing right now, and who’s responsible for it?

But don’t miss the point. Complexity isn’t a reason to pump the brakes. The enterprises getting this right aren’t slowing down. They’re building toward Human-Agent Harmony, where scale and accountability grow together instead of trading off against each other.

The real risk was never a single agent doing exactly what it was built to do. It’s a hundred of them doing exactly that, all at once, interacting in combinations nobody designed for. That kind of multiplication is what keeps enterprise AI stuck running pilots forever instead of running production.

Solve for complexity, and autonomy stops being the villain. It starts being the whole point.

Rory Blundell is CEO at Gravitee. Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.