Customers
CLS completes major infrastructure modernization milestone with Kyndryl
Press release
Oct 15, 2026
As instances of AI agents behaving in unpredictable, unexpected and unwanted ways continue to dominate headlines, organizations are sharpening their focus on governance and control.
In a matter of weeks, what appeared to be an exceptional attack on Hugging Face has become part of a broader pattern, with reports spotlighting agents meddling with government portals, leaking user data and tampering with third-party systems. Alarmingly, these publicly reported cases may represent just a fraction of incidents, with many discovered long after unintended behavior began.
They also demonstrate how capable AI agents have become. Now able to generate code, call APIs and execute complex workflows, AI agents can have a tremendous impact on an enterprise’s IT estate. But the risk they introduce is real. Unauthorized or unforeseen behavior can have downstream effects on finances, operations, reputation, and a company’s fundamental ability to compete.
Given the stakes, more companies are treating “misalignment” — when agents diverge from their intended execution — as an urgent challenge. At the same time, more technology leaders, including Kyndryl, are developing innovative ways to make trust foundational to AI deployment, such that potential value of AI agents outweighs risk.
The demand for tools that tip the scale toward value is evidenced by Nvidia’s announcement of its standard-setting Open Agent Safety Platform, and all the companies now utilizing the associated capabilities. The platform serves as a powerful reminder of how valuable open-source technologies can be in meeting the challenges posed by multi-agent systems and frontier AI models.
To manage risk from multiple angles, organizations should adopt the most comprehensive approach possible. Bringing together complementary capabilities may provide a stronger architecture than any one approach alone. What matters most is how these capabilities are implemented, and that enterprises keep refining their approaches as agentic systems evolve.
Embedding governance with policy as code
Because Kyndryl runs mission-critical systems in highly regulated environments, we were quick to recognize agentic AI’s potential to transform businesses — as well as the nonnegotiable need for visibility into and control over technology with unprecedented autonomy.
Our focus on helping customers safely and responsibly adopt AI led to the development of our policy as code capability, which turns an organization’s rules into machine-readable policies. A policy engine evaluates each agent request considering full enterprise context and then approves, denies or escalates it.
The systems an agent acts on enforce the engine’s decisions, stopping agents from taking unauthorized actions like deleting a critical database, for instance, or authorizing payments beyond a defined threshold. Because policy logic is managed separately from the systems that enforce it, a rule changed once applies everywhere.
Critically, each decision is logged with the policy clause that allowed it as well as who approved it, keeping agents fully traceable, auditable and explainable.
Where policy as code delivers value
We help customers turn AI investments into business value at our AI Innovation Labs — now in Dallas, Liverpool and Luxembourg. Through one engagement, a leading European financial institution used policy as code to reduce its AnaCredit report preparation from several weeks to just a few hours.
The capability has also been a differentiator for companies like EGYM, a global leader in digital fitness solutions. EGYM chose policy as code to govern an AI agent that supports credit evaluations for equipment financing. The agentic solution is expected to shorten approvals and speed up customer onboarding, while final credit decisions remain subject to human review.
Other applications demonstrate the capability’s broader potential — for example simplifying the trade name license application process and strengthening supply chain compliance with real-time screening of supplier data against regulatory requirements. In each example, strong AI governance is an enabler of scale.
Building a strong foundation of trust
As we continue to evolve this capability, technical controls that constrain agents inside isolated sandboxes — like those provided by Nvidia’s platform — can offer additional protection.
Organizations’ own assessments of their governance maturity reveal how much work remains: Our People Readiness Report found that just 23% of organizations think their governance is ready to support AI. And just 41% of organizations are confident in the AI guardrails they have put in place.
Policy as code and open-source tools will be essential to the stack that enables enterprises to keep every agent decision governed, every action contained, and all evidence collected in a single record.
No matter how technically sophisticated controls become, success depends on how they are implemented. Organizations will need to configure tools for their unique environment and continuously address security gaps to stay ahead of threats.
Agentic governance is an ongoing effort, requiring organizations to adapt as technology and risks evolve, and to collaborate across the enterprise to implement sufficient controls and maintain appropriate oversight. With innovative approaches, leaders can establish trust through governance that is as dynamic and effective as the agents themselves.
