24.09.2026

The Agent Security Blueprint Is Shared. The Operating Model Is Yours.

Twelve vendors have agreed on a reference architecture for AI agent governance. That settles the architecture question. It does not decide who owns your agents, their limits, or their off switch.

What is the Blueprint Alliance, and what does it change for AI agent governance?

The Blueprint Alliance is a multi-vendor coalition that published an open reference architecture for securing AI agents on September 22, 2026. Enterprises now have a shared model built on four questions and six principles. It does not change who has to run that model internally.
AI agent governance is the operating discipline that decides which agents may exist, what each one may do, and who can stop it. Until now, every vendor answered those questions in its own vocabulary.
At Oktane on September 22, 2026, Okta announced the Blueprint Alliance with AWS, CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler as founding members. Gartner predicts that an average global Fortune 500 enterprise will have over 150,000 agents in use by 2028, up from fewer than 15 in 2025, while only 13% of organizations think they have the right agent governance in place.
Both the forecast and the Alliance's interoperability commitments are still forward-looking. The architecture question is now shared; the operating question still belongs to each organization.

Key takeaways

  • The Blueprint Alliance, announced on September 22, 2026, gives AI agent governance a common reference architecture built on four questions and six principles.
  • A reference architecture defines what good looks like, but it does not assign owners, set risk tiers or prove that containment works.
  • The Alliance is a vendor coalition operated by Okta, so its principles are best checked against NIST, OWASP and the OpenID Foundation.
  • Most organizations can start on the blueprint's first question, finding their agents, with data they already collect.
  • Organizations with a working operating model approve new agents faster, because each agent inherits a tested control pattern instead of a bespoke review.

What does the Blueprint Alliance actually settle?

It settles the vocabulary. The architecture organizes AI agent governance around four questions: where are my agents, what can they do, what are they doing, and how do I respond.
Six principles. Every agent is a distinct security identity, and access is scoped to the task rather than standing. Delegation is traceable end-to-end, runtime behavior is monitored, containment is instant and reversible, and governance adapts as agents change.
Open interfaces. Founding members committed to test interoperability across MCP, OCSF, the Shared Signals Framework (SSF) and the Continuous Access Evaluation Profile (CAEP), so that one vendor's threat signal can trigger action in another vendor's control plane. The OpenID Foundation approved SSF 1.0 and CAEP 1.0 as Final Specifications in September 2025, a vendor-independent base.
This is real progress, and the critique that follows is not an argument against the Alliance. IAM, cloud and security teams can finally describe an agent in the same terms. A common vocabulary is the precondition for governance, not a substitute for it.

Where does a reference architecture stop?

A reference architecture stops where decisions begin. It defines the capabilities a governed agent estate needs, but it cannot name an agent's owner, set your risk tiers or prove that a kill switch works.

Where are my agents?
  • Blueprint defines: discovery, registration, posture management
  • You decide: who owns each agent and its risk tier
  • Evidence: an inventory built from grants and logs
What can they do?
  • Blueprint defines: task-scoped access, traceable delegation, access reviews
  • You decide: which actions require human approval in each tier
  • Evidence: no standing privileges left on top-tier agents
What are they doing?
  • Blueprint defines: inline runtime authorization and monitoring
  • You decide: which behavior counts as out of scope
  • Evidence: alerts that reach a named owner
How do I respond?
  • Blueprint defines: containment, token revocation, staged recovery
  • You decide: who may stop an agent, and who approves its return
  • Evidence: a timed containment-and-restore drill
"Evidence that it works" is where most programs stall, because each entry assigns a decision to a person. Cyera described the default in August 2026: "The moment they go live, they inherit the access of the person who launched them." The gap is rarely missing technology; it is missing ownership.

Is a vendor coalition the same as a security standard?

No. The Blueprint Alliance is a coalition of vendors, and its website is operated by Okta. That does not make the architecture wrong, but its principles should be checked against independent anchors before they become policy.
The NIST NCCoE concept paper on software and AI agent identity and authorization, published February 5, 2026, explores applying existing identity standards to AI agents. The OWASP Top 10 for Agentic Applications for 2026 lists identity and privilege abuse as ASI03. Both point the same way as the Alliance.
The supporting numbers deserve the same care. The Alliance website says 92% of organizations use autonomous agents and only 34% secure them like human users, while the underlying Okta AI Agents at Work 2026 survey of 292 executives found that 92% of executives reported widespread or moderate agent use and 34% said the same controls always apply. Both are self-reports, not measured deployments.
As of September 2026, the blueprint is not a certification. The question is not whether the blueprint is right. The better question is whether you could show an auditor that you follow it.

How do you turn the blueprint into an AI agent governance operating model?

Start with ownership and evidence, then add controls in order of blast radius. The seven steps below map to the blueprint's four questions, and an existing IAM, platform and security team can execute them without first choosing new tools.
  1. Name one owner for the agent estate Someone must be accountable for the whole inventory, typically the IAM or platform security lead, with a named business owner per agent. Otherwise discovery produces a list that nobody maintains. The step makes agent risk someone's job.
  2. Build the inventory from evidence Pull OAuth grants from your identity provider, workload identities and API keys from your cloud accounts, and registered agents from each agent platform. Self-reporting misses a lot: Okta's AI Agents at Work 2026 survey found that 52% of knowledge workers had used unsanctioned AI tools at work. Measured data shows the scale: Wiz's State of AI in the Cloud 2026 report found Model Context Protocol servers in 80% of the cloud environments it observed. Owner interviews then explain each component's purpose.
  3. Tier agents by blast radius Classify each agent as read-only, able to write to business systems, or able to write to production, payments or customer data. Three tiers are enough to start. Tiering directs review effort, but it removes no risk on its own.
  4. Remove standing access from the top tier Replace long-lived API keys on top-tier agents with task-scoped authorization and short-lived credentials. Scope grants to the action and revoke them on completion. This limits what a compromised agent can do, but it does not detect misuse.
  5. Carry the delegation chain Record the human or process that authorized each action next to the agent identity in tokens and logs, including for sub-agents. OAuth token exchange carries most of this today. Where a platform cannot pass that context, document the gap.
  6. Monitor behavior against the agent's stated purpose Send top-tier agents' tool calls and policy decisions into your production telemetry pipeline; OpenTelemetry keeps this vendor-neutral. Define out-of-scope behavior per agent and route alerts to its owner. Unowned alerts are evidence nobody acts on.
  7. Rehearse containment and restore Time how long it takes to revoke one top-tier agent's tokens, end its sessions and confirm it has stopped. Then restore it through re-attestation and record who approved it. A kill switch that has never been pulled is an assumption, not a control. Signal sharing through SSF and CAEP pays off only after this drill.

What leaders should measure

These metrics describe outcomes. Activity counts, such as policies written, are deliberately excluded because they say little about whether agents are governed.
  • Coverage: the share of production agents with a named owner and a risk tier.
  • Standing privilege: the number of top-tier agents still holding long-lived credentials.
  • Traceability: the share of agent actions whose logs include the delegating human or process.
  • Containment: minutes from detection to a confirmed stop, measured in drills.
  • Recovery: hours from containment to an approved, documented reinstatement.
  • Registration: days from request to approved production use for a low-tier agent.
Rising registration time signals that governance is producing shadow agents. Where capacity for a first baseline is missing, a time-boxed professional services engagement can produce it with the internal team. Report all six metrics together, because each one can be gamed in isolation.

What to review this week

None of these checks requires a new purchase; existing exports are enough.
  1. List OAuth grants and app consents from the last 90 days that request write or offline access, and flag those tied to AI tools.
  2. List every API key or service account an agent uses, and note which never expire.
  3. Confirm that the three agents with the widest data access each have named owners.
  4. Check whether the logs for one of those agents record on whose behalf it acted.
  5. Ask who is authorized to disable that agent tonight, and whether that person knows how.
  6. Time how long it takes to revoke the agent's credentials in a test environment.
Most teams discover that nobody is explicitly authorized to turn an agent off.

Frequently asked questions

Is the Blueprint Alliance a security standard?
No. It is a multi-vendor reference architecture published by a coalition of technology vendors. It builds on open standards such as the Shared Signals Framework and CAEP, but it has no conformance test or certification. Treat it as a model to align against, and check it against NIST and OWASP guidance.

Does following the blueprint require products from Alliance members?
Not necessarily. The four questions and six principles are technology-neutral, and many controls start with data an organization already holds, such as identity provider grants and cloud audit logs. Additional tooling helps at scale, especially for continuous discovery and runtime authorization, and is easier to choose once the inventory exists.

What is an AI agent kill switch?
An AI agent kill switch is a prepared and tested procedure that stops one specific agent quickly without disrupting other systems. It usually combines token revocation, session termination and, where needed, network isolation. The blueprint pairs it with recovery, so a contained agent returns only through re-attestation and a documented approval.

Is agent governance worth it for a company with only a few agents? 
Yes, mainly because it is cheaper now than later. With a handful of agents, an owner list, a tier model and one containment drill take days; with hundreds, the same work becomes an archaeology project. The real number is also usually higher than the official one, because agents built inside SaaS tools rarely appear in project lists.

Where should a company start with AI agent governance? 
Start with the blueprint's first question: where are my agents? Build an evidence-based inventory from identity grants, cloud logs and platform registries, assign an accountable owner to each agent, and tier every agent by blast radius. Every other control depends on knowing which agents exist and who answers for them.

Map and contain your agent estate in two weeks

Alan&Eve delivers Agent Governance as a Foundation Sprint: exactly two weeks, run by two consultants, scoped to agents with write access to production systems or customer data in up to two business domains. In week one, we agree risk tiers and success criteria with your IAM, platform and security leads, then build the inventory from identity grants, cloud audit data and owner interviews, adding a time-boxed, read-only scan with partner tooling such as Wiz where needed.
In week two, we map the gaps against the blueprint's four questions and run a timed containment-and-restore drill on one top-tier agent. You keep an owned and tiered agent inventory, a gap map, a tested runbook and a prioritized roadmap for up to three follow-on sprints. The sprint does not cover product selection, license purchases or model red-teaming.
Plan your Agent Governance Foundation Sprint

Sources

let's go