AI Agent Governance Is Now a Product Category

Three enterprise security vendors shipped AI agent controls on the same two-day window: BeyondTrust entered private beta on July 1, Jamf hit general availability on June 30, and Microsoft moved Agent 365 out of preview on July 1. The market is conceding something significant , the coding agent running on a developer's laptop is a first-class security actor, distinct from the human it runs as, and it needs its own privilege surface, its own identity, and its own audit trail. What none of these products address is what the agent actually committed to the codebase.

What Each Vendor Shipped#

BeyondTrust's new Pathfinder module, called AI Agent Security, applies least-privilege rules to AI tools running on endpoints , specifically calling out Claude Code, Microsoft Copilot, Cursor, and OpenAI Codex by name. The module identifies agents across managed and unmanaged devices, blocks unapproved tools, restricts which MCP servers an agent may connect to, and maintains an audit trail of who took an action and what authority was used. It runs across Windows, macOS, Linux, and containers. Marc Maiffret, BeyondTrust's CTO, put the shift plainly: "The most powerful actor on the endpoint is no longer human."

Jamf's AI Governance capability, now generally available within Jamf for Mac, gives IT teams visibility into which AI tools are actively running across managed Mac fleets, policy enforcement controls, and audit-ready reporting. Jamf's pitch is OS-level governance , native rather than bolted on.

Microsoft's Agent 365 exits preview as a control plane for enterprise AI agents, giving admins identity, access, and monitoring controls over agents employees spin up. The underlying infrastructure, documented by Semperis researchers, is Microsoft's Entra Agent ID platform , a new identity type purpose-built for agents, separate from user accounts and traditional service principals. Each agent identity gets its own token, its own policy scope, and its own audit log entry.

Why Three Vendors Shipped the Same Week#

This kind of synchronized launch does not happen by accident. It reflects shared pressure from a shared problem. BeyondTrust's internal research team, Phantom Labs, previously reported that enterprise AI agents are growing by more than 460 percent year on year. Agents are already running across enterprise fleets before governance products exist to manage them. Vendors read the same threat research, talk to the same enterprise security teams, and reach general availability on similar timelines.

The specific threat driving urgency: AI coding agents inherit the full credentials of the developer who launches them. A Tenet Security disclosure from June 29 demonstrated that a single crafted Sentry error event , requiring no breach and no authentication , could inject attacker instructions into error data that Claude Code, Cursor, and Codex then executed as trusted diagnostic output, with no alert firing from EDR, WAF, IAM, or firewall. The agent ran the attacker's code with the developer's full privileges. That exposure is exactly what BeyondTrust and Jamf are building controls to prevent at the endpoint layer.

The Gap These Controls Leave Open#

Privilege controls define what an agent is allowed to do. Action logging records that an agent performed an action at a given time under a given identity. Neither addresses the output.

A coding agent that stays within its approved privilege boundary can still introduce a subtle logic error, a missing bounds check, a dependency pinned to a compromised version, or an API call that leaks data under specific conditions. Those changes end up in a pull request. The endpoint governance layer has no visibility into them. The identity audit trail shows the agent committed code , not whether the code is correct, safe, or consistent with the rest of the codebase.

This is the review gap that endpoint governance does not close.

The Layered Model Engineering Teams Need#

Three distinct controls address three distinct failure modes:

Identity (BeyondTrust / Jamf): Prevents an agent from accessing systems outside its approved scope. Stops credential exfiltration, unauthorized MCP server connections, and unapproved tool execution. The right place to enforce least-privilege before the action happens.

Action logging (Agent 365 / Entra Agent ID): Creates an attribution trail. When an incident occurs, teams can determine which agent identity performed which action under which delegated authority. Entra Agent ID introduces a dedicated identity type with lifecycle management, conditional access policy support, and per-agent token issuance , meaningfully different from folding agent actions into a developer's user account.

Code-diff review: Examines what the agent actually wrote. Security, reliability, code quality, dependency integrity, API surface, and operational correctness all require reviewing the diff against the full context of the codebase , something no identity or endpoint product is scoped to do. Hyrax covers this layer: it reads the entire codebase, runs a 39-tool audit across six agent domains, applies 13 verification steps, and submits the PR. The engineer merges.

What to Configure Now#

Teams running Claude Code, Cursor, Copilot, or Codex on developer endpoints should treat this week's releases as an implementation checklist, not a vendor story. Specific steps worth prioritizing before the end of Q3 2026:

1. Audit which AI tools are running on managed endpoints and which are shadow installs.
2. Evaluate BeyondTrust's Pathfinder module (private beta) if Endpoint Privilege Management is already in your stack; evaluate Jamf AI Governance if Mac is your primary fleet.
3. Enroll agent identities in Entra Agent ID for any agents running in Microsoft 365 tenants, and apply Conditional Access policies at the blueprint level so every derived agent identity inherits the policy automatically.
4. Add a code-diff review step that runs on every push, not just on merge , so agent-authored changes are reviewed before they enter the main branch, not after.

Identity and endpoint controls narrow the attack surface. They do not substitute for understanding what ended up in the repo.

Hyrax is live at hyrax.dev.