Governance Moves From the Policy Binder to the Runtime

The gap patching cannot close

The old security bargain was that a flaw would be found, a patch would be written, and systems would be fixed before attackers caught up. That bargain no longer holds. Median full remediation time for vulnerabilities was 43 days in 2026, and average flaw-remediation time reached 252 days in 2025, up from 171 days five years earlier. Meanwhile AI systems can turn a published fix into a working exploit in hours, so the window between disclosure and attack keeps widening while the fix stays slow and human-gated. m:…8410

The cost of that gap shows up in recovery, not just in breaches. Only 28% of ransomware victims successfully recovered all their data in 2026, and victims whose backups were compromised reported median recovery costs of $3 million, compared with $375,000 when backups survived. The authors of the analysis identify six opportunities for new security products that make patching unnecessary or someone else's job, and for systems that cannot be patched at all, such as industrial control or medical devices, they point to off-device controls like network segmentation or removing access from the open internet. m:…8410

Enforcement before execution

The same timing problem now faces enterprises running autonomous agents, and the answer taking shape is governance at runtime rather than review after the fact. OpenBox draws a sharp line between observability, which shows what agents have already done, and governance, which determines what agents are allowed to do before execution. Enterprise agents that can take consequential actions without step-by-step approval require review processes that occur before the action runs, and OpenBox returns one of five decisions for each operation: ALLOW, CONSTRAIN, REQUIRE_APPROVAL, BLOCK or HALT, with a stricter verdict overriding a looser one. m:…3639

The urgency is grounded in Anthropic's September 2026 threat report, which describes AI autonomy in cyber operations ranging from chat assistance to workflows running with minimal human supervision. Anthropic treats autonomy and harm as separate axes: autonomy multiplies the scale and speed of an operation while reducing operating costs and complexity, and a majority of the cyber operations it described were enabled by AI through direct execution or orchestration. Humans remained heavily involved in target selection, monetisation and review of results, and the report covers operations disrupted between December 2025 and August 2026, though its findings describe cases chosen for publication and do not measure how common the activity is. m:…3639

One gateway for models, money and geography

For public sector organisations the governance question arrives before any model is chosen, and it is practical rather than abstract. Public sector AI projects often stall because governance questions about data location, cost and access remain unanswered, and the organisations making real progress are the ones that solve governance before scaling adoption. Databricks' Unity Gateway is built around that sequence: administrators can control model availability by user, group or team, set spending limits and hard caps by user, team or use case, and use Smart Routing to direct tasks to cost-effective models. m:…5510

Geography is part of the same control plane. Account admins can restrict processing of Databricks-hosted foundation models to specific geographies, which matters because third-party coding agents like Codex and Claude Code can route requests to infrastructure in other countries. The gateway provides day-zero access to frontier and open-source models, supports models from multiple providers, open-source models and external endpoints, and is built into Databricks without separate infrastructure. This suggests the emerging pattern is a single choke point where model choice, budget and data residency are decided together, rather than three separate approvals. m:…5510

Privacy at the prompt layer, resilience by design

Privacy law is pushing in the same direction, toward controls that act on data before a model sees it. GDPR does not ban the use of AI, and seven specific controls cover the majority of GDPR exposure for AI applications, according to the analysis. Tokenization replaces personal values with opaque tokens to allow model reasoning while maintaining privacy, but tokenized data remains personal data if the controller holds the re-identification key, and encryption does not solve clear-text exposure at the moment of model inference. Vendor training on user data should be disabled, Article 22 restricts decisions made solely by automated means with significant effects, and agent tool calls that carry personal data constitute a disclosure under GDPR. m:…2503

The final piece is accepting that agents will fail, and designing the failure. Agentic AI systems fail by continuing to operate and improvising around errors rather than stopping, and catastrophic failures result from chains of incorrect outputs accepted as ground truth in workflows lacking checkpoints. The proposed answer is four control planes: Bounded Authority, Circuit Breaker, Observable Reasoning and Graceful Degradation, with resilience treated as an architectural decision made before code is written or tools are purchased. Bounded Authority means treating each agent as a distinct non-human identity with its own credentials, circuit breakers halt autonomous execution at irreversible boundaries, and observable reasoning logs must capture decision provenance, not just side effects. The implication is that governance, privacy and resilience are converging into one runtime discipline, and the organisations that treat them as separate documents will keep discovering the gap after the action has already happened. m:…0753