Enterprise Governance and Security Controls for Autonomous AI Agents

Imagine software that can execute multi-step workflows independently, without requiring a human to guide every action. These autonomous AI agents are rapidly moving into enterprise operations. While they promise massive efficiency gains, they also introduce significant security, compliance, and operational risks.

Back in November, three tech giants, Microsoft, Nvidia, and Anthropic, announced a strategic partnership to integrate Anthropic's Claude models into Microsoft Foundry, an Azure-hosted service running on Nvidia's GB300 Blackwell Ultra hardware. Because these agents operate with high autonomy, companies are setting up strict safety guardrails.

This partnership is supported by a massive $30 billion compute deal between Anthropic and Microsoft. To power these workloads, Nvidia is supplying up to one gigawatt of power through its Grace Blackwell and Vera Rubin architectures. Additionally, Nvidia is investing up to $10 billion and Microsoft up to $5 billion directly in Anthropic to accelerate R&D.

Managing How AI Acts and What It Costs

To ensure autonomous agents follow strict corporate guardrails, Anthropic employs Constitutional AI during model training. This instills a foundational set of rules from day one, preventing harmful outputs or policy violations before they happen.

Beyond behavior, managing these agents involves keeping a close eye on operational costs. In Microsoft Foundry, pricing for Claude models is based on token consumption, calculated per one million tokens:

Claude Haiku 4.5: $1.00 for inputs, $5.00 for outputs.
Claude Sonnet 4.5: $3.00 for inputs, $15.00 for outputs.
Claude Opus 4.1: $15.00 for inputs, $75.00 for outputs.

At the infrastructure level, companies secure these systems using Nvidia's Secure Agent Workspace. This architecture isolates each AI agent in its own virtual environment, locking down its API keys, network access, and identity credentials. If an agent is compromised or runs into an error, the risk is contained inside that sandbox, preventing lateral movement across the corporate network.

Giving AI an Identity and Finding Weak Spots

Connecting autonomous tools with legacy systems remains a significant bottleneck. In fact, 78% of enterprise executives report that legacy integration is their primary barrier to AI adoption. These agents require deep access to internal documentation and communication channels to be effective. For instance, Microsoft's Scout assistant, currently available to select GitHub Copilot subscribers, operates in the background to read emails, schedule calendar events, and scan shared folders without waiting for user prompts.

To prevent unauthorized access, companies must establish distinct machine identities. Under the Agent 365 framework, which launched on May 1, 2026, every active agent is assigned a unique digital identity managed by Microsoft Entra. This creates a clear audit trail of the agent's actions. However, there is a catch: if an organization has poorly configured folder permissions, a smart agent can easily locate and access sensitive directories. Businesses must audit and clean up their data access policies before deploying these agents.

To govern active agents, developers use the Agent Control Specification. This framework monitors agent actions across five core stages: input validation, reasoning, memory access, tool utilization, and output generation. To enforce these steps, teams use ASSERT, a testing tool that translates plain-English security policies into automated tests.

Sandboxing provides another layer of security. Nvidia's open-source OpenShell utility runs within GitHub Copilot to intercept agent requests for internet access or file modification, blocking credential theft and unauthorized access.

At the same time, companies are deploying offensive AI agent teams to find their own system vulnerabilities. A system called MDASH (Multi-Model Agentic Scanning Harness) uses over 100 specialized AI agents to scan codebases for security flaws. The MDASH workflow runs through five distinct steps:

Code preparation: Structuring the codebase for scanning.
Scanning: Deploying auditor agents to identify potential vulnerabilities.
Conflict resolution: Using debate agents to resolve disagreements about potential bugs.
Deduplication: Filtering out redundant findings.
Verification: Running automated tests to confirm active vulnerabilities.

When evaluated on CyberGym, a platform featuring over 1,500 real-world security scenarios, MDASH achieved a 96.55% success rate. In May 2026, it identified 16 zero-day vulnerabilities in Windows, four of which were classified as high-severity. MDASH is currently in limited release and integrates directly with Microsoft Defender.

As these automated tools become more popular, we should expect hackers to start using them too. This is why keeping a constant, automated eye on computer networks is more important than ever.