Why Rubrik Uses AI Gateways and Policies to Secure Agentic AI

AI agents change the security scenario because they do more than answer questions. Unlike chatbots, AI agents take action. They can search records, call tools, update systems, and act through identities that already have access to production environments. Once that happens, a model mistake is no longer just a bad response on a screen. It can become a deleted dataset, an unauthorized change, or a policy violation that hits live systems before anyone notices.

That was the focus when Twain Taylor, editor at Software Plaza, spoke to Filip Verloy, CTO of Rubrik X, about how Rubrik is trying to govern AI agents as they move from experiments into real enterprise use.

Rubrik’s take is that software that can react on its own needs to be kept in check by a control layer outside itself. That’s because these systems are built on big language models, and big language models are basically leagues away from traditional software. They can take a reasonable instruction and just run wild with it. Let’s look into this some more.

Why older controls just aren’t cutting it

Chatbots can cause problems by giving wrong information, exposing internal data, or misleading users. AI agents are riskier because they can take actions inside real systems, such as changing tickets, querying databases, or modifying files. That makes their behavior harder to predict, since the same instruction can lead to different outcomes depending on context, connected tools, and how the AI interprets the request.

The examples of agents deleting emails or wiping a database show how a single bad action can become a serious operational issue. Shadow AI makes this worse because teams can build and deploy agents quickly, often faster than security and governance teams can control them.

Traditional security is still important. Permissioning, logging, and keeping track of user identities all matter, but rule-based security just doesn’t cut it when the system isn’t completely predictable. You might get away with making an allow list or a deny list to catch any obviously dodgy behaviour, but that’s not going to do much when an AI agent is causing trouble through a path that technically looks okay.

Prompt instructions aren’t anywhere near enough

It’s tempting to think you can just treat prompts as a form of policy, and for a while, that might even work when you’re testing. But once you hook the system up to real tools and real data in a live production environment, that just doesn’t hold water. 

Prompts can help guide behaviour, but that’s not the same as actually enforcing the rules. If your goal is to keep an AI agent from causing trouble by, say, deleting records, modifying production data, or stepping outside its approved use case, then you need something more than just prompts to keep it under control.

Rubrik puts a gateway between the agent and the action

The AI gateway becomes the enforcement point

Rubrik Agent Cloud puts its AI gateway in the middle of the action, where the agent meets the model and the tools it wants to use. Before an action is sent to a live system, this AI gateway provides the entire organization with a central location where it can assess what will happen next and determine whether it is acceptable.

This matters because most firms are not going to build all their agents with a single security setup. Different teams are going to use different platforms all over the place. Rubrik’s pitch is that their customers can keep using Microsoft Copilot Studio, AWS Bedrock, or Google Vertex AI platforms without having to rebuild everything from scratch. The governance layer can be managed through the gateway.

Policies can block or just watch

The system offers a watch and block option. That’s handy because not every organisation is ready to start strictly enforcing its policies across every single agent workflow just yet. Some teams may want to monitor the situation first, collecting alerts as they go along and getting a sense of where the agents are starting to stray from policy. 

Others may want to block off any action that’s just too destructive, like deleting records or using a super-sensitive tool in production.

That split is actually pretty reflective of how enterprise rollouts usually go. You start by trying to understand the shape of the problem. Then you go in with the blocking measures once you know what can’t be allowed.

Restore is crucial when prevention fails

Rubrik can actually rewind and restore deleted or modified data if a bad action slipped through in time. And that changes everything. The security model here isn’t just about stopping agent mistakes from happening. It’s also about limiting the damage when prevention fails.

You don’t need perfect control to reduce the risk. You need better control, better visibility, and a way to get back to square one when the system still manages to make a bad decision.

Why this approach fits enterprise AI rollouts

Rubrik’s argument is that AI agents need centralized guardrails even when they are built in decentralized ways. That is the practical reality for large organizations. Different teams will keep using different platforms. They will keep building agents around local business needs. Governance has to work across that sprawl.

An AI gateway gives the company a place to enforce policy. A judge model gives a way to assess actions in context. Identity visibility helps security teams understand who or what is actually performing those actions. Recovery closes the gap when something still goes wrong.

Readers who want the product walkthrough, the live examples, and the deeper discussion around policy enforcement and recovery should check out the full webinar.