Gartner serves the number. 60% of generative AI proofs of concept were silently abandoned in 2024. The stated culprit: governance gaps. Not model accuracy. Not inference cost. Governance.
Now watch what happened after that data point entered enterprise planning cycles. ServiceNow shipped an "AI Control Tower." Microsoft open-sourced an Agent Governance Toolkit. Citrix bolted MCP capabilities onto NetScaler. CrowdStrike stood up Falcon Guardian as a fresh security product category. MintMCP launched a two-layer governance model wrapped inside a three-tier guardrail system.
Strip away the branding and the same skeleton appears in every release: connectivity, security and governance, observability. Three layers. Every vendor, intentionally or accidentally, has now publicly declared runtime enforcement a mandatory layer of AI agent infrastructure. That convergence is the story—not any single product launch.
I have spent the last two years tracking AI agents as economic actors rather than chatbots: autonomous programs that hold keys, move assets, rebalance portfolios, and negotiate with other programs. My working projection is that algorithmically driven agents will account for roughly 40% of on-chain volume before 2028. If that trajectory holds, someone must define what is executing, what it is allowed to touch, and who is accountable when a prompt injection drains a treasury. Runtime enforcement is where those questions get answered.
Here is the part the security press releases gloss over. Runtime enforcement is not primarily a cryptographic breakthrough or an alignment miracle. It is a power arrangement disguised as a security feature. And the crypto industry has seen this movie before. We called it the centralized sequencer.
From Optional Add-On to Mandatory Layer
The background context matters. During the 2023-2024 agent hype cycle, enterprises rushed to prove that large language models could do useful work. They built chatbots, copilots, and internal research tools. Then the pilots hit production reality: agents are exposed to prompt injection, jailbreaks, data exfiltration, and tool-calling abuse. The OWASP agentic AI risk list became the industry's shared vocabulary, cataloging ten distinct failure classes. Microsoft's Agent Governance Toolkit gained attention precisely because it claims deterministic mitigation of all ten OWASP agentic risks, not probabilistic mitigation. That phrase—"deterministic"—deserves scrutiny.
Meanwhile, the infrastructure underneath agents standardized faster than anyone expected. Model Context Protocol, or MCP, emerged as a common language for connecting agents to tools and data. Anthropic opened it. The ecosystem adopted it. And once you have a standard protocol for tool access, you have a natural chokepoint for policy enforcement. You can intercept every function call an agent makes. That is the architectural insight behind the three-layer stack: the proxy sitting between the agent and its tools becomes the enforcement point.
The Emerging Governance Stack, Forensically Examined
Let me break down what these vendors actually built, because the marketing language hides the engineering choices.
Microsoft's Agent Governance Toolkit targets the runtime boundary: policy evaluation happens at the moment an agent attempts to call a tool. The stated performance envelope is sub-millisecond, and the fail-closed semantics matter enormously. A fail-closed gateway denies action when it cannot make a determination. That is the opposite of how most AI systems operate. Models are probabilistic by nature; a governance layer with deterministic, fail-closed behavior is an attempt to bolt certainty onto a stochastic engine. It is philosophically awkward, but it is also exactly what a compliance officer wants to hear.
ServiceNow positions its AI Gateway as the intake and control plane for agent fleets. The framing is managerial rather than adversarial: a unified catalog for tool intake, real-time access policy at the moment of function calling, and operational visibility. This is not a security product in the traditional sense. It is an enterprise IT governance product retrofitted for agents, which makes it potentially more commercially dangerous to pure-play startups than any penetration test could be.
Citrix, through NetScaler, treats MCP gateways as just another workload to route and secure. That is a deeply underappreciated competitive move. NetScaler has spent two decades inside enterprise network infrastructure. If an enterprise already runs NetScaler, adding MCP gateway capabilities is an incremental purchase, not a new vendor relationship. Single-channel architecture, centralized identity, tool-level rate limiting.
CrowdStrike's Falcon Guardian takes the most security-native angle. Its claim—99% prompt attack detection accuracy at 100ms latency, fused with endpoint telemetry—is a direct appeal to security operations centers. CrowdStrike already sits on enterprise endpoints. It is telling customers: you already trust us with your machines; trust us with your agents.
MintMCP offers the most interesting technical design for builders who want portability. Its guardrail stack layers managed detection for prompt injection and personally identifiable information, declarative pattern matching as an explicit policy layer, and a JavaScript sandbox as the final backstop for untrusted code execution. The key architectural choice: these guardrails live outside the managed hosting environment, which means governance follows the agent across clouds rather than being trapped inside one vendor's runtime. That design acknowledges a truth that enterprise vendors prefer to ignore.
Every enterprise will eventually run heterogeneous agent fleets, not a single vendor's ecosystem.
Goodbye
Here is the sentence that I keep returning to: governance is the settlement layer of the agent economy. In adversarial environments like open networks, settlements are unforgiving. If an autonomous trading agent gets prompt-injected and signs a malicious transaction, the action is irreversible. Runtime enforcement is the only boundary between a model's hallucinated intent and actual economic damage.
Now let me overlay this with the reality of the infrastructure. I have spent time in the agent economy's trenches, building and breaking small autonomous trading systems, running my own experiments with agents that hold testnet keys. Here is the pattern. When I audit the economic security of an AI agent that controls value, I do not only audit the model's system prompt. I audit the enforcement points between the model's output and the action it takes—the getter, the transfer functions. The prompts, the tool invocations, and the network itself.
Did the thought go through a policy-checking container? Was there a sandbox that executed the output? Were the tool imports allowed to be purely dynamic? These are the questions that the enterprises are finally asking themselves. The AI in these systems is not the trust anchor. The trust anchor is the enforcement layer. In code, I trust; in the model, I do not.
But here is a critical problem that the vendors are not surfacing. The new runtime governors speak only to a single kind of agent—one that travels through an MCP-style gateway. What about agents that never call a gateway? In adversarial networks, there is no unified choke point. An agent that controls a wallet on a permissionless blockchain does not need to pass through CrowdStrike's gateway. It can be purely a swarm of base-layer transactions. Enterprises that believe they have solved agent governance with a gateway are really solving the governance problem for the narrow case where the agent happens to be the kind that uses enterprise-sanctioned tools.
The Real Structure of Competition
The commercial battle is not just about detection accuracy, and I believe the market will remember that. The only true competitive edges are as follows.
First, distribution. Microsoft has GitHub stars and Azure. ServiceNow has the CIO relationship. CrowdStrike has the endpoint. NetScaler has the network. Each of these is a pipe into the enterprise. Pure-play vendors are trying to wedge in a new pipe, and that is a fundamentally different sales motion.
Second, openness. Microsoft's toolkit being open source is a genuinely canny move. The GitHub momentum—more than six thousand stars and over a thousand forks—builds a learning moat. Every developer who experiments with the toolkit becomes fluent in Microsoft's policy model. The company understands that in infrastructure, the standard is owned by whoever writes the reference implementation.
Third, vertical depth. A generic governance toolkit is useful. A governance toolkit that understands the specific risk patterns of, say, healthcare claims processing or treasury operations is more useful still. This is where specialist vendors can survive: by out-verticalizing the platform giants in narrow, high-value industries.
What is absent from the current picture is any credible claim about measuring the performance overhead. Yes, Microsoft claims sub-millisecond policy evaluation. Yes, CrowdStrike claims a 100-millisecond end-to-end interception overhead. But none of the vendors have published comparative benchmarks across agent frameworks like LangChain, CrewAI, or AutoGen. The alignment tax—the throughput and latency cost of running every agent action through a governance boundary—is the silent variable in every enterprise deployment. I find it absent from the trade press coverage.
The Fork in the Road
Here is the contrarian thesis. The convergence on a three-layer stack is real, but the industry has not yet answered the question that decides the future: does runtime governance live inside the enterprise perimeter, or does it live on a network layer that no single vendor controls?
The enterprise path is straightforward. Microsoft, ServiceNow, and CrowdStrike will embed governance into their existing platforms and sell it as a feature. There will be certification programs, compliance checklists, and professional services. This path gets agents to production within twelve to eighteen months. The governance will be centralized, auditable, and compatible with every regulator that matters.
The network-native path is more radical, and this is where I am watching the crypto builders, not the enterprise vendors. If autonomous agents are going to transact value across institutional boundaries—settling trades, moving collateral, coordinating multi-party workflows—then runtime governance cannot be a secret policy inside one company's gateway. It must be a verifiable, tamper-evident, mutually agreed rule set. That is precisely what a public blockchain can provide. Policy decisions can be recorded as transparent state transitions. Evidence is not a silent fact; it is something that must be independently verifiable. You do not automatically receive a ledger you can trust.
Consider what happens when two firms deploy adversarial AI agents trading against each other. Each firm's governance layer will try to constrain its own agent. But an external threat is omnipresent. Without a shared, network-level governance substrate, each firm is doing its own pricing of the other's agent behavior. In an adversarial network governed only by private policies, the agents might rationally avoid engaging with each other entirely. In that case, the enterprise governance stack may end up constraining the growth of the agent economy rather than enabling it.
This is where my skepticism about the mandatory layer narrative returns, and I want to articulate it precisely. The current wave of runtime enforcement is a direct response to a real pain point: agents are dangerous, and enterprises need boundaries. But the way the solutions are being architected repeats a pattern I have seen before. In 2017, I spent six months reverse-engineering early ZK-SNARK implementations in Berlin. The prevailing narrative was that zero-knowledge proofs would make everything private and scalable. The deeper problem was that the computational overhead made them impractical for immediate utility, and several teams were polishing a technical object that the market did not yet need. I published a series of pieces arguing that feasibility must precede adoption. The market converged, the technology matured, and I was right about the timing, even if I underestimated the long-term trajectory.
Runtime enforcement is in a similar position today, in one sense. Everyone agrees the layer is mandatory. The tooling is still immature, the benchmarks are missing, and the management of governance policies across heterogeneous multi-agent environments is barely at the drawing-board stage.
The governance of multiple heterogeneous agents is not a solved problem, and I want to emphasize how technically difficult it is to coordinate across agents that were written by different teams, do not share a common internal ontology, and do not trust one another. Enterprise vendors talk about the three layers; they do not talk about the arbitration rules when those layers disagree.
A pattern I am tracking is the re-emergence of a hierarchical model that I thought was discredited: centralized governance as the price of admission for decentralized agents. The enterprise gateway is the bottleneck. Microsoft, ServiceNow, and CrowdStrike are all valuable because they are centralized choke points. The irony is not that the emperor has no clothes. The irony is that the emperor is the gatekeeper who has always been there.
A Market Correction of Expectations
There is an underappreciated risk in the incumbents' approach. When you embed governance into a platform, you inherit all of that platform's historical architecture decisions. A policy engine inside a large enterprise software stack is not necessarily the best environment for sub-millisecond, fail-closed enforcement. The incumbents may be able to sell governance to their existing customers, but they might not be the best vendors to run enforcement at scale when the deployment is genuinely global and mission-critical.
Also, there is a regulatory signal that the vendors cannot escape. The European Union's AI Act is moving toward concrete obligations for general-purpose AI models. In the United States, the public and private sectors are competing to define responsible AI frameworks. In China, algorithm filing requirements are already a fact of life. Each regulatory regime is a sandbar that the governance layer has to pass through. There will be pressure for standardized, portable audit trails. Right now, every vendor's audit log is a proprietary format. That is a compliance time bomb.
The opportunity for a foundational protocol here has not yet been seized. Imagine a standard for recording agent governance decisions as append-only, verifiable logs—not necessarily fully on-chain for every policy check, but anchored to a public ledger for periodic attestation. Imagine a policy language that is portable across Microsoft's toolkit, ServiceNow's control tower, and MintMCP's guardrails. Imagine an open registry of tool permissions that agents can query without asking a centralized vendor.
That is the infrastructure I would rather invest my attention in than another governance dashboard. The final insight I want to leave you with is this: the convergence on the three-layer stack means the industry has settled the question of what agents need. We have not settled who provides it. The next twelve months will determine whether runtime enforcement becomes another enterprise software category or the most important new network primitive since the smart contract.
If you are building in this space, ask where the governance executes, who controls the keys, and whether your enforcement records can survive an audit by a party that does not trust your vendor. The answer decides whether your agent participates in the open economy or only in a walled garden. If you are an investor, ask who you will trust when something goes wrong.
Because code does not lie. People do. And the governance layer is where people will write the rules.
The Discipline of the Supply Schedule
Let me end with a discipline I have maintained since my earliest days in this industry. When I analyze any new infrastructure, I check the supply schedule. Not the token schedule of a chain, but the operational schedule of the platform—who controls rate limits, who sets policy rules, how enforcement capacity scales when usage spikes. That schedule is where power lives.
In the agent economy, the constraint is not the intelligence of the model. It is the clearance rate of the governance layer. An agent submitting actions to a policy engine that can only handle a fraction of its intended throughput will be throttled by that engine, not by its own reasoning. The agents will eventually route around the constraint, and they will do so in ways that the governance vendors did not design for.
Check the supply schedule. It will tell you whether the runtime enforcement layer is a service or a toll booth. It will tell you whether the platform is controlled by those who use it or those who operate it. The current market structure—enterprise gateways sold as mandatory features by incumbents—looks suspiciously like a toll booth that collects governance fees on every agent action, forever, without the network ever collectively auditing its privilege.
A genuinely robust answer is not a toll booth. It is a shared, open, auditable security layer that every agent uses because it is in its self-interest, not because a platform vendor demands it. That is the infinitely more interesting investment thesis. And it is precisely the kind of architecture that will outlive the current incumbents, who are racing to monetize the gaps they have identified in an ecosystem they do not fully control.
The governance race is on. The winners will be the teams that recognize runtime enforcement is not a feature to be sold but a layer to be owned. And in a market where the three-layer stack has already converged, owning the layer requires more than a gateway.
It requires a network. The open question is whether the incumbents can build one, or whether the network will be built by the agents themselves.
I know which side of that trade I am taking.