Securing agents inside the enterprise

Why this conversation

Security used to mean guarding the perimeter and keeping the bad stuff out. An agent with access to internal systems changes that, because it already sits inside and its traffic looks trusted. Spencer Reagan of Airia talked about this with the host on 23 October 2026, the second day of AGNTCon + MCPCon North America in San Jose. He calls Airia an agentic AI orchestration platform that helps discover, secure, optimise and govern agentic interactions, and the part he is proudest of is its MCP gateway and MCP integration. The day’s other conversations are in the article on day two.

A new kind of software

The host brought up Gartner. Spencer says Gartner’s recent critical capabilities report for AI security and governance placed Airia farthest out in the visionary section, and that Forrester, IDC and other analysts have given it the same kind of positive response.

Airia’s mission, as he puts it, is to help organisations, and enterprises in particular, take advantage of agentic workloads. That raises hard problems in security, governance, roles and RBAC: knowing which agentic workloads exist, monitoring and securing each connection an agent has to internal or external resources, and above all facing attack vectors that are new. Those call for new kinds of controls, including generative AI summarisation and analysis controls that check whatever comes back and whatever the agents process.

The host remarked that people are used to predictable software. Spencer agrees: software has been deterministic for four or five decades, and generative AI is not. “It behaves more like some new employees that you brought onto the team than it does traditional software.”

The risk is already inside

The host raised prompts that tell a model to act like somebody else in the company, or to forget everything it has learned. Such attacks, Spencer says, are dangerous for anyone using agents on the internet, and more so inside an enterprise’s infrastructure. With agentic workloads, as the saying goes, the call is coming from inside the house.

He separates two problems. A malicious query or payload can make it to the model, and the model can reach out to tools across your systems. Combined, a model that a bad prompt can take over and that same model’s power to act on internal systems are a dangerous pair, and since the agent is inside the organisation, its traffic is trusted.

Discover, normalise, constrain

Airia starts by discovering every agentic workload. It then normalises the data, so unified guardrail policies can be applied by interaction, by user or by use case, with each agent carrying an identity or at least some attribution. Many policies are as simple as email forwarding rules. A further layer, which Airia calls agent constraints, uses AI to read an agent’s prompt, interactions and tools, work out what it is meant to do, and block the rest. An agent that searches an internal issue tracker and emails alerts should not be able to email outside the company. “But tool calls are so open world these days that you really have to constrain them.” Airia can also limit the parameters a tool call may use, such as the email domains allowed.

The host compared this with the deny rules you can put in Claude Code’s settings JSON file. Similar, Spencer says, but those live on each machine. With 100 developers, a rule has to be set, maintained and changed 100 times. Airia lifts it into its proxy and gateway layers, where IT and admins manage it in one place.

From developers to everyone else

Airia’s customers are large enterprises. Coding agents have led the way, but HR, legal, sales and marketing are starting to use the same tools, knowing even less about the restrictions. The moment an organisation moves from developers to knowledge workers, he says, is when security becomes urgent.

Finance and other regulated industries bring their own rules, and the host described Europe’s scattered regulation. “The laws are barely keeping up with, and the regulations are barely keeping up with the technology.” Where the data, the organisation and the users are makes a different mosaic of rules, and tracking them is part of what Airia offers, so a customer runs into a guardrail as soon as it tries something that is not compliant. To learn more, Spencer points to airia.com, said like area, where you can ask for a demo or start a free trial.

When it comes out

The episode is edited and in the release order. Like every episode it goes out on YouTube first, then on Apple Podcasts, Spotify and Amazon Music.