AI Observability: The Missing Runtime Control Layer for API-Driven Systems
summary
AI systems call production APIs at scale so static compliance and logs miss runtime behavior; an audited system found many approved agents doing unobserved actions and one reported case where an agent effectively fired an employee. The ratio of non‑human to human identities is 1:45 non-human-to-human ratio, control requires a practical 4-step model Discovery → Correlation → Behavioral Context → Runtime Enforcement, and a deployable plan is 30/60/90 inventory→rules→enforce including unique agent identities, short‑lived credentials, human approval thresholds, and enforcement of sensitive‑data and permission limits.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:55AI agents and non-human identities
- 3:20Non-human identities in API security
- 5:08AI agent overreach and hidden actions
- 9:04Over-permissioned AI agents
- 10:29AI agents going off-script
- 11:56Gap in AI security practices
- 13:20Five observability pillars for AI agents
- 15:47Six controls for non-human identities
- 18:5430-60-90 day roadmap
- 20:36Conclusion and future of AI governance
- 21:20Q&A: Key roles for governance
- 22:45Q&A: Deterministic governance
related talks
24mAI Governance for developers: A practical framework for deploying autonomous coding agents safely…
16mAI Agents for Incident Investigation: The Good, The Bad, and The Ugly- 24mAI Governance for developers: A practical framework for deploying autonomous coding agents safely…
26mIf your APIs aren’t agent‑ready, your AI agent is just chat: [...]
14mAI Sprawl: The Hidden Risk Threatening Your Enterprise Now
11mAI took over dev. Prod is next. Here's why it has to be
41mThe Ironies of AI²
21mSecurity in the Age of AI & Copilot