An AI agent can delete a file, change a record, or run code with no malware detected, no compromised account, and no apparent rule violation. Organizations need three things to manage that: visibility, control, and a way back.

Consider this scenario: A developer asks an AI coding agent to clean up an outdated project folder. The agent removes files that appear unused. A production workflow then fails, because one deleted configuration file was still needed downstream. The agent did what it was asked, but lacked the business context to see the consequence.

The questions arrive immediately. Which agent acted, and who invoked it? Which model, tools, and credentials did it use? What data did it access? Why was the action allowed? Can the damage be reversed without rolling back unrelated work?

Enterprise AI risk often begins with good intentions. An employee submits a customer contract to an AI assistant for a summary. A developer shares proprietary code with a coding tool. A finance colleague uploads a spreadsheet to build a report faster.

The exposure may be larger than the intent. Sensitive data can reach services that security, privacy, legal, or procurement teams have never reviewed. Employees may not know which model processes the data, where it is hosted, or whether prompts and files are retained. This is shadow AI: business use without enough visibility or governance.

Generative AI produces answers. Agents also take action. Connected to applications, APIs, and enterprise data, they can query a CRM, update a ticket, execute code, change records, or trigger a business process.

Agents arrive through many doors. A developer installs a coding assistant. A business team builds an agent in Copilot Studio. An innovation team builds on Amazon Bedrock. An employee connects a local AI client to a Model Context Protocol (MCP) server with access to files or repositories. Each step looks reasonable alone. Together they create a set of AI tools that IT and security may not see.

Harm also comes from legitimate agents, through ambiguous instructions, flawed reasoning, excessive permissions, or unsafe tool connections.

These risks add up. Agentic AI keeps the copy-and-paste risk and adds access, autonomy, and operational impact.

1. Sensitive information goes to an unapproved AI service. Nothing malicious happens, but nothing records what was processed externally. Policy and training need visibility to be enforced.
2. The AI tools in use are invisible. IT may know the platforms it bought, but not the local agents, browser services, or MCP servers in use. Control starts with knowing an agent exists.
3. An agent uses an unapproved model, tool, or service. Models differ in hosting, retention, and contractual protections, so an approved enterprise service and a public one are not interchangeable. An approved agent can still rely on an unapproved model or MCP server behind the scenes.
4. A legitimate agent overreaches. An agent correcting a few invoices needs scoped access. Yet agents often run on broad user permissions, service accounts, or shared credentials, which widens the damage a mistake can cause.
5. Detection arrives without recovery. Responders need to know which agent and identity acted, which objects changed, and whether recovery can be selective. Recoverability is part of AI governance.

Traditional controls stay essential: authentication, endpoint security, data protection, API security, and identity governance. But they evaluate single events. Agent risk shows up across a sequence of prompt, model, identity, tool, data, and intended outcome. Each step may be permitted while the combined action is still wrong. The question shifts from whether an API call is allowed to whether the action fits the user, task, agent, data, and business context.

Rubrik Agent Cloud (RAC) is built around three capabilities: monitor, govern, and remediate AI agent activity.

• Monitor. RAC discovers agents automatically, including agents on infrastructure platforms such as Azure and AWS and on platforms such as Microsoft 365 and Agentforce. It shows their behaviors, permissions, and data access in one view, and records activity in an immutable audit trail.
• Govern. RAC lets teams define policies that control destructive or undesired agent actions. Guardrails work in real time: violations are detected and blocked, using enterprise identity systems to enforce access controls.
• Remediate. Agent Remediate integrates with Rubrik Security Cloud for selective rollback, which undoes unwanted or destructive actions to a precise point in time and within a limited scope.

That last capability covers the case where the agent was authorized, the action was permitted, and the outcome was still wrong.

In my conversations with customers, the greatest concern is often what they cannot see. Most organizations do not have a complete picture of which AI services and agents employees are using, what data they access, or what they can do. Rubrik Agent Cloud provides an MDM-like level of visibility across AI tools and agents, creating a full inventory of AI usage, with actionable advice, that allows them to decide what to allow, govern, or restrict.

One of our financial-services customers needed to demonstrate, as part of its DORA obligations, that sensitive information was not leaving the organization through unapproved services. During a root-cause analysis, an engineer tried to upload a log file that inadvertently contained PII to a non-corporate AI assistant. Rubrik Agent Cloud detects the violation and blocks it in real time, so the sensitive data is not exposed.

Blocking every unfamiliar AI service is unlikely to work. It can push use out of sight, especially when approved options are less convenient. A more practical path has five stages:

1. Discover AI tools in use: services, agents, models, MCP servers, tools, endpoints, and platforms.
2. Observe usage, identities, data access, and tool calls. Separate low-risk experimentation from activity that touches sensitive data or critical operations.
3. Govern by risk. Distinguish read, generate, write, execute, and delete. Start with visibility and alerts, then enforce where the risk justifies it.
4. Reduce access. Scope agent access to the task, tool, and data instead of inheriting broad user or service-account permissions.
5. Prepare recovery. Protect workloads where a wrong agent action could disrupt operations, and test recovery before production use.

This is a progression from experimentation to controlled, resilient adoption, not a choice between innovation and governance. 

In my conversations, after obtaining visibility, the most difficult step is deciding where to draw the line between restricting AI to manage risk and allowing enough freedom to experiment and innovate. Rubrik Agent Cloud helps move beyond that binary choice by enabling intent- and outcome-based governance, allowing teams to govern AI agents and tools based on what they are trying to do and the potential impact of their actions, rather than simply allowing or blocking the technology.

Policies and awareness are no longer enough. Organizations need visibility across AI use, control over agent actions, and the ability to reverse unwanted outcomes. The goal is to make AI adoption visible, autonomous actions governable, and the business resilient enough to innovate with confidence.