October 2026 Summaries

AI agents are portrayed as non-deterministic software programs that access data and systems through APIs, creating governance and security risks because their runtime decisions may be unpredictable and difficult to trace. Using London taxi drivers’ extensive “Knowledge” training as an analogy, the piece argues that organizations must impose controls on agents through established API-management practices such as authentication, access policies, rate limits, logging, auditing, and security controls. It emphasizes that agents should be treated as API consumers rather than as a fundamentally separate technology, while noting that their speed, scale, and autonomous behavior can expand the potential impact of errors. The author advocates self-hosted AI gateways for regulated organizations that need to keep agent traffic, credentials, logs, and policy enforcement within their own infrastructure, presenting this approach as a way to maintain visibility and control over agents interacting with critical systems of record.

AI governance is presented as an architectural capability rather than a software product, requiring organizations to ensure every AI interaction passes through a controlled point where permissions, costs, policies, and records can be consistently applied. The central test is whether an organization can prevent an AI call when necessary and demonstrate afterward what occurred; policies alone are insufficient if they depend on people remembering to follow them. Drawing on the evolution of API governance, the piece argues that organizations should map all AI-call pathways, identify where control and auditability are absent, and address those gaps through deliberate system design. It also notes that differing industry definitions of AI governance, ranging from policy and accountability frameworks to real-time technical controls, reflect complementary aspects of a broader organizational property that is easier and less costly to build into systems early than to retrofit later.