At a CISO roundtable hosted by Anthropic's chief information security officer, Rubrik GM of AI Dev Rishi posed a straightforward question to the room: Had everyone written down their AI governance and security policies? About 14 hands went up. His follow-up — how anyone actually enforces those policies — drew a markedly different reaction.

"And everybody chuckled," Rishi recalled during a VB Transform 2026 fireside chat in Menlo Park. "It was like the dirty secret in the room that everyone has these policies, but no way to actually make them real."

The gap between having policies and enforcing them is precisely the space Rubrik is targeting. Rishi revealed that the company's founder and CTO has been aggressively pushing to enable the company's AI agents in what is known as YOLO mode — a configuration that strips permission prompts from agent workflows and lets agents act autonomously. For a publicly traded data security firm whose core business is backing up critical enterprise data, that admission carries weight.

In Rubrik's implementation, a second AI system evaluates every agent action in real time against organizational policy, replacing the human who would otherwise click approve. Rubrik is testing the approach on itself first. Rishi framed autonomy as a question of judgment rather than capability. "If you ask the agent to act autonomously, it will," he said. "It's a question that you have internally. Should it?"

From security theater to AI arbitration

Rubrik arrived at this approach through painful experience. When Claude Code and Cowork pilots launched internally, the company mandated that every command run in ask mode, meaning the employee who issued it bore the liability. Developer pushback was intense, filling a single Slack thread 120 messages deep.

"The developers basically are pushing back, and they're like, this is like the iTunes service agreement. I'm just hitting check, check, check, check, check, check, check," Rishi recounted. "There's no way that I can actually read through this. And it becomes security theater."

The frustration is widespread. Citing Rubrik Zero Labs research, Rishi noted that roughly 80% of respondents find themselves in the same bind. The findings come from "The State of the Agent," an April report based on a survey of more than 1,600 IT and security leaders, which concluded that monitoring and approving agent actions consumes more time than the agents themselves save.

Rubrik's answer is SAGE, or the Semantic AI Governance Engine. SAGE functions as the arbitration layer within Rubrik Agent Cloud, monitoring every agent action, interpreting the semantic intent behind it, and ruling the action permissible or not against policies authored in natural language. "We took what people said was human in the loop, a good idea, and we replaced it with AI in the loop," Rishi said, describing how he pitches the concept to security leaders he characterized as skittish about non-deterministic systems.

The shift matters because enterprise agents are moving beyond chat and code suggestions into systems of record, ticketing queues, repositories, and communications tools. In that setting, governance stops being a documentation exercise and becomes an execution problem: the control has to operate at the moment an agent attempts to use a tool.

Security approval, not cost, constrains AI ROI

Rishi's background spans some of the most influential organizations in AI and machine learning. Before joining Rubrik, he co-founded and led Predibase, a generative AI infrastructure startup that Rubrik agreed to acquire in June 2025. Prior to that, he headed ML product at Google on the team that became Vertex AI and served as Kaggle's first product manager during its growth from roughly one million to ten million users. He holds bachelor's and master's degrees in computer science from Harvard.

During his first three and a half months at Rubrik, Rishi conducted 200 customer conversations with IT and security leaders across a Global 2000-style customer base, asking open-ended questions about cost, latency, performance, and orchestration.

"Pretty consistently, what I heard through all of those conversations was that all of those are pretty secondary," he said. "The main challenge is actually, how do I get this approved from a security and risk standpoint? I'm concerned about all the different things that could go wrong. Actually, I felt like that was one of the biggest things constraining ROI."

VentureBeat Pulse research presented earlier that day on the Transform stage corroborated what Rishi kept hearing. The data showed that 66% of enterprises — two-thirds — already permit or are actively building toward production deployment with zero human review, yet only 5% fully trust the automated evaluations that would underpin that decision.

That trust gap is the commercial opening for agent governance products, but it also sets a high bar. If automated review becomes the mechanism that allows agents to bypass human approval, enterprises need evidence that the review layer is both fast enough for production workflows and reliable enough for security teams to defend.

One AI reading what the rulebook cannot

Rubrik's own internal policies demonstrated why written rules fall short as enforcement mechanisms. One rule stipulated that agents must respect Rubrik's customer data use policy — a directive that sounds enforceable until someone attempts to operationalize it.

"Rubrik's customer data use policy is like a three-page document of legal text," Rishi said. "I have no idea how to write that in there as a rule." When asked on stage how a team of AI infrastructure specialists took on a problem traditionally owned by security engineers, Rishi replied: "with a lot of naivety and innocence, honestly."

The team's core wager was that language-proficient models could effectively police other models. SAGE emerged as the result. The case for placing a model in the judgment seat centers on precision. A rule prohibiting agents from editing revenue fields in Salesforce, for instance, fails under conventional tooling because Salesforce does not distinguish which fields constitute revenue. Administrators are therefore forced to approve every Salesforce action manually. SAGE reads intent instead, leveraging organizational context to differentiate a benign data lookup from the kind of edit a policy prohibits.

Economic viability depends on keeping the judge small. SAGE operates on a small language model that, according to Rishi, runs at an order of magnitude lower cost and latency than a frontier LLM. "If I told you, don't worry, you're gonna be secure and governed, but I'm gonna double your cost and latency, you would tell me to get out of the room," he said.

When Rishi polled the audience on whether they had worried about token consumption over the past year, roughly half raised their hands. "And I guess the other half is probably just too lazy to raise their hand," he quipped.

SAGE is built as an aggregation of specialized judges using parameter-efficient fine-tuning, enabling Rubrik to create task-specific variants of a base model that share organizational context. One judge monitors for tool-use hallucinations, another suppresses personally identifiable information before it can leave the system, and each operates as an independently enforceable policy. Security and GRC teams have also begun authoring financial rules into the same layer, including one internal policy that bars AI spending on personal projects.

The lethal trifecta

When asked which attack vectors concern him most, Rishi pointed to what security researcher Simon Willison termed the "lethal trifecta" in June 2025. The concept describes an agent that simultaneously holds private data, ingests unvetted external content, and possesses a channel to transmit findings to the outside world.

The core danger, Rishi explained, lies in how individually legitimate permissions can compound when stacked. An agent granted both Salesforce access and email access on an employee's credentials has done nothing inherently wrong — yet.

"A very simple example is that an agent can start pulling data from Salesforce and then decide to accidentally leak and exfiltrate that out via an email," he told the audience. A financial services company Rishi met with that morning reinforced the point, telling him that none of the individual permissions are problematic in isolation and that the agent genuinely requires each one to perform its function. "It should have permission to each of those systems, but it's the combination that ends up becoming really destructive," Rishi said.

Traditional identity and access management never accounted for such combinations because it relied on the human judgment of the credential holder — and agents provide none. "I can tell you the number of times Claude Code has tried to leak some of our sensitive source code to a public GitHub repository is incredibly high," Rishi disclosed. Severing agents from public resources entirely would negate their utility, which returns the challenge to adjudicating intent within context rather than broadly revoking access.

A separate VentureBeat June Pulse survey of 107 qualified enterprise respondents quantified the blast radius of this pattern. VentureBeat research presented on the Transform stage that morning showed that 69% of companies operate credential sharing somewhere within their agent fleet. Organizations with shared credentials experienced security incidents or near-misses at a 63.5% rate (47 of 74), compared with 40.9% (9 of 22) for those where every agent carries its own scoped identity.

The attacks no single turn reveals

Rubrik Agent Cloud reached general availability in February, though not every capability Rishi described is shipping yet. Backtesting is just beginning to roll out. The feature replays an organization's historical agent actions and tool calls against a new policy, revealing where the policy would have intervened and where an action would have passed through undetected, with policy adjustments applicable in real time. Rishi called this historical archive one of the most valuable data assets an enterprise possesses.

Real-time detection and blocking, it turns out, represent the entry point rather than the complete product. Certain attacks never trigger a single-action rule. "No individual turn of the conversation was problematic, but if you took the session as a full trace, that ended up being problematic," Rishi explained. Agent Cloud conducts batch analysis across entire session traces on an hourly or daily basis, surfacing what Rubrik terms "insights" — problems that no individual guardrail managed to catch.

The same Zero Labs report found that 88% of organizations lack the ability to roll back agent actions without disrupting systems — a recovery gap that falls squarely within Rubrik's established area of expertise.

For security teams, rollback is the other half of enforcement. Blocking a bad action is useful only when the system catches it in time; when an agent completes a multi-step workflow before anyone sees the issue, response depends on knowing what changed, which tools were used, and whether the organization can reverse the effects without creating a broader outage.

An unanswered question

A skeptical CISO would raise the question the fireside chat did not address. SAGE is itself a non-deterministic model evaluating other non-deterministic models, and Rishi offered no false positive or false negative rate for the judge. The closest the architecture comes to an answer is auditability: both backtesting and batch insights generate a human-reviewable trail of every decision SAGE rendered and every action that slipped past it. For now, the question of who watches the watcher is answered with a trail of receipts rather than a published benchmark. Until such a benchmark exists, AI-in-the-loop remains an operational wager rather than a quantified control.

Three questions emerge from the session for security teams evaluating their own readiness: How many current production guardrails depend on a human clicking approve, and what happens to that workload as agent counts scale? Does any component of the stack enforce semantic intent, or does it rely entirely on allow and deny lists? And can the team backtest agent behavior against a new policy and unwind a multi-turn session without taking systems offline?

Rishi's timing aligns with measurable market demand. The same VentureBeat research found that 82% of enterprises still cite their primary AI provider's built-in guardrails and cloud controls as their principal agent security layer, while 59% plan to adopt, add, or replace agent security tooling within the next 12 months. Only 12% are considering an agent-identity product, even as credential sharing remains the norm.

Every CISO at that Anthropic roundtable held a policy document but lacked an enforcement mechanism. Rubrik built a product for the space between those two realities. YOLO mode represents the bet that an AI watching other AIs can finally make those policies operational.