Cisco Closes Governance Gap with Build-Time Policy Enforcement

Cisco has made significant strides in addressing the gap between AI agent development and deployment by introducing build-time policy enforcement for its Agent Runtime SDK. This move aims to bridge the 85%/5% chasm, where 85% of enterprises are experimenting with AI agents, but only 5% have successfully moved them into production.

The Agent Runtime SDK embeds policy checks at build time across various frameworks like AWS Bedrock AgentCore, Google Vertex Agent Builder, Azure AI Foundry, LangChain, and the Model Context Protocol (MCP). This integration is seen as a shift in treating governance as a distinct infrastructure layer.

Cisco's approach forms a clear progression in the governance stack: governance specifications define the rules, build-time enforcement bakes those rules into the agent's DNA, runtime authority ensures compliance via tools like Akeyless, and finally, a control plane is provided by WSO2. By filling this critical void between abstract policy and active execution, Cisco addresses a significant challenge in AI governance.

However, even with build-time enforcement, agents can still evolve beyond their initial security parameters due to changing environmental inputs or model updates. This issue of runtime drift can lead to unauthorized tool usage, data exfiltration, or unexpected cross-agent interactions. To address this, Cisco has developed DefenseClaw, an open-source framework that provides comprehensive runtime threat detection.

DefenseClaw includes a suite of specialized engines such as the Skill Scanner, MCP Scanner, A2A Scanner, CodeGuard, and AI BoM generator. These tools monitor agent capabilities, check servers for malicious actions, enforce block/allow lists, and track models, memory, and dependencies in real-time.