An AI agent that can act is a different risk from a model that only answers. This hub separates the two questions that matter: what an agent is technically capable of, and what it is actually permitted to do in your process.
The pillar article explains the autonomy levels. The other articles cover tool use, least privilege, separation of duties, emergency stops and human oversight.
Start here
Private-capital firms need a decision-rights register to record which AI agent could act, who checked the output and how a decision can be reconstructed.
October 1, 2026
Research shows AI agents can bypass shutdown mechanisms. Here is how to design an emergency stop enforced outside the model, with containment and tested recovery.
September 16, 2026
IAPP, NIST and the EDPB warn that privacy governance was not built for autonomous AI agents. Here is how to treat agents as manageable identities under the GDPR.
September 24, 2026
A study in Frontiers in Political Science names the democratic authorization gap: governments must be able to demonstrate mandate, responsible officer
September 2, 2026
Hugging Face described how autonomous evaluation agents ran code via Artifactory and dataset loaders. What supply-chain risk means for AI agents.
September 15, 2026
Box binds AI agents to a governance layer with agent and MCP guardrails. What does that mean for demonstrating your legal AI workflows? A practical analysis.
October 7, 2026
DIVD was compromised via two Zammad zero-days and points to an agentic-AI method. What decision-makers must now arrange in vulnerability management.
August 23, 2026
Article 12 of the AI Act and a real agent intrusion at Hugging Face show why logging of autonomous AI actions must be a verifiable agent timeline.
September 7, 2026
Astra raises agentic legal workflows at Harvey and Legora to a higher level. Here you can read what you must be able to reconstruct per matter, document and check.
October 5, 2026
A new IETF Internet-Draft proposes a hash-chained audit trail format for autonomous AI agents. What is provable, what is not, and what should you record separately
September 23, 2026
In September 2026 Microsoft announced the preview of an Entra MCP Firewall that gives central runtime visibility into traffic between agents and external MCP
August 29, 2026
An academic framework from July 2026 separates the technical capability of AI agents from their permitted autonomy. What does that mean for oversight and control?
September 3, 2026
NIST marks AI agents as non-human identities with requirements for identification, authorisation, delegation and logging. What that means for your IAM architecture.
July 31, 2026
Microsoft's External Red Team Alliance and new research show that red teaming of generative AI and AI agents is shifting to an ongoing, ecosystemic process.
October 2, 2026
A US Senate subcommittee examined rogue-AI risks on 30 September 2026. What the METR and Georgetown testimonies mean for liability and containment.
August 28, 2026
New governance frameworks and the CNIL/CIANum note show that separation of duties in agentic AI is a hard safety and accountability requirement.
October 6, 2026
The IAPP argues that AI agents with access to corporate systems raise new security and liability questions. What that means for approval, control and ownership.
October 1, 2026
A Reuters report says the European Commission is questioning OpenAI and Anthropic on cybersecurity after agent incidents.