On November 4, 2026, Sysdig announced the general availability of Sysdig AI Defense for macOS and Windows, runtime security and governance that watches every action an AI agent takes and uses an organization’s policies to decide whether to allow that action, ask the user to confirm it, or block it before it completes. Sysdig says agents now ship code, change infrastructure, and reach production systems at a speed no team can review by hand. The product’s answer is a live decision at the moment of the act, and policies begin in alert mode before a team moves them to enforcement.
The same news window brought two other releases that address the same question: who decides before an agent action completes. Conduktor Agents, announced the same day, start in read-only mode with their own identity and cannot make changes without human approval unless a team explicitly chooses to automate a given task. On November 5, Google Cloud said Agent Substrate 1.0 is generally available on GKE and announced the donation of Agent Substrate, gVisor, and OpenRL to the CNCF, following their Sandbox acceptance the month before, so untrusted agent code can run inside isolation rather than talking directly to the host kernel.
What the kernel sees that the agent log does not
Sysdig’s early insight from AI Defense is blunt: for every action an agent writes in its log, the kernel sees about seven processes doing the work. An agent can also pick up a new skill or connection halfway through a job, so the agent deployed in the morning isn’t always the one running in the afternoon. The agent’s own log shows intent, and the kernel shows what actually ran. When those two stories disagree, the company treats the mismatch as a detection, and founder Loris Degioanni puts the point plainly: an agent’s account of what it did is useful context, but it is not evidence.
That gap is why runtime enforcement matters. Sysdig AI Defense judges each action by what the agent sets out to do, what it actually does, and what its credentials can reach at that moment. Reading a credential to a test environment is noise, but reading the key that administers production is an incident. Teams get a live inventory of agents, harnesses, models, MCP servers, skills, and plugins built from runtime telemetry, and every agent across platforms such as Claude Code, Codex, GitHub Copilot, and Cursor can be traced to an accountable human. Policies can stop unvetted MCP servers, skills, and plugins before they run, and they can block or hold risky credential reads and behavior drift for human review. When a team blocks or holds an action, the investigation already has a live action graph, and the audit record shows which policies applied, when, and who signed off.
Speed is part of the threat model. Sysdig’s Threat Research Team described JADEPUFFER, a ransomware campaign in which an AI agent triaged and fixed its own login failure in 31 seconds. Whether an attacker drives the agent or the agent goes rogue on its own, the window to stop the action is the moment it is happening.
Read-only starts and sandboxed code
Conduktor’s agents address a different surface with the same control pattern. They investigate security, reliability, cost, and governance risks across Kafka environments and deliver evidence-backed recommendations for human approval. Every agent starts read-only, operates with its own identity, and receives only the permissions its task requires. A team approves each change before an agent acts, unless that team chooses to automate the task, and every action stays fully traceable inside the customer’s Console. Ask Conduktor can turn a plain-language question into a scheduled agent task, but the change still waits on a person unless that wait is deliberately removed.
Google’s stack addresses containment. Google calls standard containers that share a host Linux kernel a security risk for agents that generate and run unreviewed code and external packages. gVisor isolates generated code inside a lightweight userspace application kernel. Agent Substrate decouples stateful agent sessions from active compute, snapshots idle agents, and restores them in under 500 milliseconds, and Google claims this lets platform teams run millions of sandboxes at 10x container density. Deployers can run that runtime as a managed capability on GKE, and the CNCF Sandbox donation puts Agent Substrate, gVisor, and OpenRL under neutral governance. Isolation is a Responsible AI control: the sandbox checks untrusted code before it reaches the host kernel.
The Confirm Checkpoint
Allow, confirm, and block are machine-enforced gates. Sandboxes that isolate untrusted agent code are the same class of control. Both are Responsible AI in the sense the HAIA frameworks use the term: machine checking machine, with no named person answering for the individual output. They do real work and they cut the blast radius, yet they are not, by themselves, AI Governance.
AI Governance starts when a named human holds binding authority over the held action. The Named-Human Test sorts a system with one operational question: who can stop the output, and who answers for it through moral, professional, civil, or criminal channels that survive an audit? If the confirm path only records a click, the system stays on the Responsible AI side of that line even while a person is physically present. If the confirm path names who ruled, what evidence they saw, and whether they accepted, modified, or rejected the action, the same runtime stack supports governance. Sysdig’s promise of audit-grade records that show who signed off, and Conduktor’s default that nothing changes until a person approves, only become governance when that signature is a real ruling rather than a habit.
Puglisi’s proposed definition of AI governance draws the same boundary. Named humans hold binding power to approve, modify, or halt outputs at defined checkpoints, with accountability that survives audit. High-velocity systems still need that checkpoint. The Named-Human Test’s high-velocity carve-out shifts the gate upstream: the accountable person endorses the written policy that authorizes a class of automated actions, and the accountability channels attach to that endorsement, because speed relocates the checkpoint and doesn’t erase it.
What a deployer can write down this week
For each agent platform in use, a deployer can keep a live inventory that names the accountable human for every agent, harness, and high-privilege credential path. For every action class marked confirm or hold, the record can show who confirmed, what evidence that person saw, and whether the ruling was accept, modify, or reject. Teams can track the share of held actions that were changed or stopped, and they can investigate falling intervention rates alongside review quality and incident outcomes before changing automation privileges. For action classes that run too fast for per-item review, an accountable person can endorse the written policy that allows them, with a review date and demotion triggers when the model, prompt, or tool set changes.
Sysdig, Conduktor, and Google Cloud are shipping the runtime and sandbox pieces that make those records possible. The open question for every deployer is this: when runtime holds an agent action, who confirms it, and does the file show a ruling or only a click?
Sources
- Conduktor. (2026, November 4). Conduktor unveils AI agents to bring built-in Kafka expertise to every enterprise team [Press release]. PR Newswire. https://www.prnewswire.com/news-releases/conduktor-unveils-ai-agents-to-bring-built-in-kafka-expertise-to-every-enterprise-team-302928792.html
- Google Cloud. (2026, November 5). Open infrastructure for autonomous agents comes to CNCF. https://cloud.google.com/blog/products/containers-kubernetes/open-infrastructure-for-autonomous-agents-comes-to-cncf
- Puglisi, B. C. (2026, March 14). AI governance has no formal definition. Here is one. https://basilpuglisi.com/ai-governance-has-no-formal-definition-here-is-one/
- Puglisi, B. C. (2026, June). Why agentic AI was always going to fail. https://basilpuglisi.com/why-agentic-ai-was-always-going-to-fail/
- Sysdig. (2026, November 4). Sysdig launches Sysdig AI Defense, bringing runtime security to every action AI agents take [Press release]. https://www.sysdig.com/press-releases/sysdig-launches-sysdig-ai-defense-bringing-runtime-security-to-every-action-ai-agents-take
FAQ
What did Sysdig announce on November 4, 2026?
Sysdig announced the general availability of Sysdig AI Defense for macOS and Windows, runtime security and governance for AI agents. The product sees every action an agent takes and uses organizational policies to allow the action, ask the user to confirm it, or block it before it completes. Policies begin in alert mode and move to enforcement when a team is ready. It also builds a live inventory that can trace each agent to an accountable human and keeps audit records of which policies applied and who signed off.
Why does Sysdig emphasize the kernel instead of the agent log?
Sysdig reports from early AI Defense data that for every action an agent writes in its log, the kernel sees about seven processes doing the work. An agent can also gain a new skill or connection during a job, so its morning configuration may not match its afternoon behavior. The agent log shows intent, and the kernel shows what actually ran, and disagreement between the two is treated as a detection.
What do Conduktor Agents require before they change anything?
Conduktor Agents start in read-only mode, operate with their own identity, and receive only the permissions required for a specific task. They deliver evidence-backed recommendations for human approval and cannot make changes without that approval unless a team explicitly chooses to automate a given task. Every action remains fully traceable inside the customer’s Console.
What did Google Cloud donate to the CNCF, and why does it matter for agents?
On November 5, 2026, Google Cloud announced that Agent Substrate 1.0 is generally available on GKE and that it is donating Agent Substrate, gVisor, and OpenRL to the CNCF following their Sandbox acceptance the month before. gVisor isolates untrusted agent-generated code in a userspace application kernel so it does not talk directly to the host kernel. Agent Substrate snapshots idle agents and restores them in under 500 milliseconds so teams can run large numbers of isolated sandboxes without tying up idle compute.
How do allow, confirm, and block relate to Responsible AI and AI Governance?
Allow, confirm, and block gates, along with sandboxes that isolate untrusted code, are Responsible AI controls: machine checking machine. AI Governance begins when a named human holds binding authority over a held action, records accept, modify, or reject, and remains accountable for that ruling. A confirm click without a real ruling keeps the system on the Responsible AI side of the Named-Human Test.
What should a deployer record for held agent actions?
Name the accountable human for each agent, keep evidence of what the confirmer saw, and log whether each held action was accepted, modified, or rejected. Track how often held actions are changed or stopped. For action classes too fast for per-item review, have an accountable person endorse the written policy that authorizes them and set a review date plus demotion triggers when the model, prompt, or tools change.
AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIgenerated
Leave a Reply