Actions Speak Louder Than Prompts: Governing What AI Agents Actually Do

About this session

Everyone is watching what goes into AI agents. Almost no one is watching what they actually do.The industry obsesses over the inbound boundary — prompt injection, guardrails, model alignment — while the real risk lands on the other side: the commands an agent runs, the data it moves, the credentials it reaches for, the systems it changes. An agent doesn't need to be jailbroken to cause damage; it just needs to be helpful in the wrong direction.Existing controls can't see this. Every tool in the security stack — secrets managers, DLP, identity, endpoint — watches a boundary: a vault checkout, a network egress, a login. Agents do their work, and their damage, in the space between those boundaries, where every action looks routine and the only identity in sight is a trusted human's. Prompts are too fuzzy to be controls; audit trails are precise but after the fact. Neither answers the question that matters: should this action happen, right now, in this context?This talk makes the case for a new layer: understanding each action an agent is about to take — what will run, what it will touch, and why — and evaluating it before it executes. I'll share real patterns of risky agent behavior from enterprise environments that are invisible to today's tooling.Whether you're enabling AI or governing it, you'll leave with a practical framework for the action layer — and the questions your current stack can't answer.