IBM Deploys Watsonx Control Plane to Halt Enterprise Agent Sprawl

IBM 部署 Watsonx 控制平面遏制企业智能体无序蔓延 在多云系统中扩展智能体 AI，需要将运行时推理与底层基础模型解耦，同时落实自动化治理护栏。 Sunil Murthy 探讨了企业级 AI 智能体在 AWS、Azure、GCP 和 Salesforce 等异构平台上的快速激增，并对缺乏协同的多供应商无序蔓延所带来的运营风险发出警告。为应对孤立的“自主孤岛”，IBM 推出了一种开放式控制平面架构，将 watsonx Orchestrate 与 watsonx.governance 相结合，用以管理策略、访问权限、性能和 Token 成本套利。在标准化模型上下文协议（MCP）连接能力以及 IBM AI 风险图谱（IBM AI Risk Atlas）的支持下，该平台使机构能够将安全护栏和风险分级直接嵌入智能体目录中。通过零售银行生命周期的演示，Murthy 阐明了合成预部署测试与可审计的遥测技术如何帮助企业安全地从纯粹的实验阶段过渡到受控的自主运行。 企业软件正迅速向智能体系统转型，预测显示在未来 12 至 18 个月内部署的智能体将超过 10 亿个，到 2030 年将突破 22 亿个。 (0:04) 横跨 AWS、Azure、GCP 和 Salesforce 的缺乏协同的多云开发，导致了严重的智能体蔓延以及缺乏集中可见性的脱节“自主孤岛”。 (0:04) 一个有效的企业控制平面必须系统性地解决四大核心支柱：智能体做什么、谁拥有访问权限、性能表现如何以及成本是多少。 (2:19) 智能体注册表必须治理整个依赖生态系统——包括集成工具、企业知识库和动态 Markdown 指令——而不仅局限于代码仓库。 (2:19) 将推理、规划和记忆管理与底层基础模型解耦，使机构能够跨任何智能体或模型供应商进行工作流编排。 (4:23)

As enterprise AI adoption transitions toward autonomous agentic systems, organizations face significant operational risk from multi-cloud and multi-vendor sprawl. To transition from disconnected islands of autonomy to scalable production, enterprises must decouple agent orchestration from underlying foundation models and enforce centralized, continuous governance. The Proliferation and Architectural Risks of Agent Sprawl (0:04) Modern enterprise software is shifting from static artificial intelligence models to autonomous systems of interaction and action, making agentic interfaces the standard enterprise UI. Forecasts cited in the program project agent deployments to exceed 1 billion within the next 12 to 18 months and surpass 2.2 billion by 2030. Many organizations adopt agents inadvertently, as standard enterprise software packages increasingly arrive with bundled agentic features. This uncoordinated rollout generates multi-cloud fragmentation across platforms such as AWS Bedrock, Microsoft Copilot, Google Cloud Platform, and Salesforce Agentforce, resulting in isolated systems that lack central operational oversight. Core Pillars of the Agentic Control Plane (2:19) Countering agent sprawl requires a centralized control plane capable of cross-platform orchestration across multi-cloud and hybrid environments. This control architecture goes beyond isolated code repositories to monitor tools, enterprise knowledge bases, operational skills, and dynamic instructions produced by tools like Claude Code. Orchestration focuses on end-to-end task completion rather than raw execution alone. To maintain operational control, the plane must systematically answer four core questions: what tasks the agents perform through proactive guardrails, who holds access and execution rights, how agents perform across build-time evaluation and runtime telemetry, and the computational and token costs they incur. Decoupled Runtime, Cost Arbitrage, and Open Integration (4:23) IBM's control platform, watsonx Orchestrate, addresses these requirements by separating reasoning, planning, memory management, and execution from individual agent implementations. This decoupled architecture allows organizations to run workflows across proprietary IBM agents and third-party tools from Microsoft, AWS, GCP, SAP Joule, and Salesforce Agentforce. Standardized gateways support Model Context Protocol (MCP) connections, inter-agent communication, and intelligent routing. Sunil Murthy highlights the necessity of cost arbitrage, comparing model selection to vehicle choice: organizations avoid consuming costly frontier model tokens on basic tasks like drafting emails, reserving them strictly for complex reasoning. The ecosystem currently supports over 100 partners, targeting 500 certified partners. End-to-End Governance and Controlled Autonomy (10:27) Governance must function as an integrated lifecycle framework rather than an afterthought, particularly to comply with regulations such as the EU AI Act, GDPR, and Federal Reserve SR 11-7 guidelines. IBM integrates risk management into the asset catalog via the open-source IBM AI Risk Atlas, which benchmarks accuracy, synthetic test outputs, and vulnerability profiles. Working alongside runtime systems, watsonx.governance translates broad policies—such as restrictions against processing personally identifiable information—into enforced guardrails within watsonx Orchestrate. Runtime telemetry feeds auditable evidence back to a central compliance console. Demonstrated Policy Inheritance in Retail Banking (14:12) A retail banking workflow demonstrates how governance policies operate in practice. Administrators establish baseline guardrails that protect against prompt injection, jailbreaking, harmful content, and social bias. Using parent-child inheritance structures, newly onboarded agents automatically inherit these controls from the overarching business use case without manual intervention. In pre-deployment unit testing with synthetic data, an unauthorized agent attempting to submit personal data is blocked until an administrator elevates its permissions. As Murthy emphasizes, moving from experimentation to production scale requires intentionally transitioning from observed agents to controlled autonomy. Scaling enterprise AI requires vendor-agnostic orchestration paired with proactive governance by design. Rather than accepting vendor lock-in, enterprises must maintain visibility across disparate tools and clouds to enforce accountability as agents assume greater operational autonomy.

随着企业级人工智能从基础模型迈向自主行动系统，各组织正面临多云与多供应商环境下的智能体无序蔓延风险；IBM主张通过解耦的运行时编排与闭环治理架构，将割裂的“自主孤岛”转化为具备合规性与成本可控的可扩展系统。 智能体野蛮生长与企业多云蔓延风险 (0:04) 现代企业软件架构正全面转向以智能体系统为核心，对话与代理界面正在演变为新的企业UI。行业预测显示，未来12至18个月内全球部署的智能体数量将突破10亿个，到2030年更将超过22亿个。即使企业未主动开发定制智能体，第三方企业软件套件所内置的代理能力也在推动其被动采用。 这种未经协调的快速扩散引发了严重的多云与多供应商蔓延。当前企业的智能体散落于AWS Bedrock、Microsoft Copilot、Google Cloud Platform以及Salesforce Agentforce等碎片化平台中。由于缺乏统一的架构标准，企业内部形成了彼此孤立的“自主孤岛”，导致中央可见性、标准化资产注册表和端到端运营控制力全面丧失。 智能体控制平面的四大核心支柱 (2:19) 为应对蔓延风险，企业必须建立能够跨混合云与多云环境进行编排的中央控制平面。受治理的注册表不仅要跟踪孤立代码库，还必须全面掌握智能体所依赖的工具集成、企业知识库、操作技能，以及由Claude Code等编码工具在CI/CD流程中生成的动态Markdown指令文件，使编排聚焦于高级任务的达成而非单纯代码执行。 根据IBM的定义，一个有效的控制平面必须能够解答企业级运营的四个关键问题：其一，智能体的具体行为与操作边界（策略与护栏）；其二，各主体的访问与执行权限；其三，涵盖构建期评估与运行时遥测的实际表现；其四，包括Token消耗和计算开销在内的实际财务成本与投资回报。 解耦运行时操作系统与智能模型路由 (4:23) IBM通过watsonx Orchestrate构建了包含运行时操作系统、评估与可观测性平面以及受治理资产目录的三层控制架构。该平台将底层的推理、规划、内存管理和执行层与具体智能体解耦，支持跨IBM原生智能体以及微软、AWS、GCP和Salesforce等外部智能体运行工作流，并采用贯穿构建期与运行时的“评估优先”方法。 控制平面集成了标准化网关，支持模型上下文协议（MCP）和智能体间通信协议。发言人Sunil Murthy以“去杂货店无需开法拉利”为喻，强调了模型成本套利的重要性。网关通过智能路由避免在撰写日常邮件等简单任务中消耗昂贵的前沿模型Token，从而将高算力模型保留给复杂推理任务。目前IBM的智能体生态已涵盖超100家合作伙伴，并计划扩展至500家认证伙伴。 闭环治理架构与风险评级集成 (10:27) 在欧盟人工智能法案（EU AI Act）、通用数据保护条例（GDPR）以及美联储SR 11-7监管指引等合规压力下，治理必须贯穿智能体全生命周期。watsonx.governance通过“业务接入-风险分层-策略执行-遥测审计”四个阶段，将合规策略转化为运行时控制。例如，当策略禁止处理个人身份信息（PII）时，编排层会在运行时强制阻断违规操作，并将遥测数据自动回传至审计控制台，形成端到端闭环。 为了在前置环节防范风险，平台将开源的IBM AI Risk Atlas直接内嵌至资产目录中。系统结合传统机器学习、生成式AI与自主智能体的风险库，在智能体部署前输出透明的风险评分、历史准确性表现、合成验证结果及漏洞画像，使开发团队能够基于量化指标决定发布权限。 零售银行实践：父子继承与受控自主权 (14:12) 在零售银行客户支持工作流的现场演示中，管理员利用watsonx.governance配置了针对有害内容、提示词注入、越狱、社会偏见及仇恨言论的组织级护栏。基于父子继承模型，新接入该业务场景的智能体无需手动配置，即可自动继承顶层的基线护栏与合规阈值。 在部署前的合成数据单元测试中，当缺乏高级权限的银行智能体试图处理包含客户隐私数据的申请时，系统护栏自动拦截了提交操作；管理员随后调整其自主权等级，该智能体才获得读取并更新特定记录的授权。Sunil Murthy指出，企业部署必须遵循从“纯粹实验”到“受监控运行”，再到“受控自主权”的渐进演进，而实现问责的前提是具备全面的系统可见性。 要实现从无序蔓延到规模化受控的转变，企业必须采取不锁定单一供应商的中立架构，将解耦的推理编排与自动化的合规审计证据链相结合；但如何在异构多云平台与频繁迭代的第三方工具间持续保持实时的策略同步与细粒度权限控制，仍是推进这一架构面临的现实挑战。

## Background 本内容由 Ai4 频道于 2026 年 8 月 16 日在 YouTube 平台发布，主讲人为 IBM 生成式 AI 领域 CTO 兼 Watsonx 技术负责人 Sunil Murthy。视频简介指出，随着企业跨团队、工具、模型和多云构建 AI 智能体，最大的挑战已非创建智能体本身，而是在不丧失可见性、控制力和问责制的前提下实现规模化扩展，本场演讲探讨了如何将编排与治理深度融合以打通策略意图与运行时控制。 ## TL;DR 演讲深入剖析了企业在多云环境下因智能体野蛮生长（Agent Sprawl）而面临的自治孤岛与治理失控风险，指出资产纳管必须延伸至工具、知识库及 CI/CD 流程中的相关文件。IBM 提出了集统一控制平面 watsonx Orchestrate 与全生命周期治理平台 watsonx.governance 于一体的解决方案，通过模型套利网关、评估先行机制以及基于 AI Atlas 风险目录的端到端证据闭环来打破孤岛。最后，现场通过零售银行贷款场景演示了从防护栏继承到“受控自治”的具体落地路径，强调跨厂商生态编排才是实现可信规模化智能体的关键支撑。 ## Atmosphere & style 整场演讲呈现出严谨务实且高度面向企业级架构的技术布道风格，主讲人以清晰从容的语调将前瞻性行业预测与深厚的企业 IT 落地经验娓娓道来。通过“开法拉利去买菜”等生动贴切的比喻与直观的银行用例实操，将晦涩的合规治理与复杂的运行时编排拆解得层次分明。现场氛围专注而具启发性，既直面企业在多云智能体时代的管控阵痛，又给出了条理清晰、切实可行的工程化落地蓝图。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=kJL2KLQIONY&t=4s) 智能体数量预计在未来几年呈爆发式增长，企业面临的最大挑战从“如何构建智能体”转向“如何在跨多云、多平台野蛮生长（Agent Sprawl）中保持控制与能见度”。 - [00:04](https://www.youtube.com/watch?v=kJL2KLQIONY&t=4s) 缺乏中央注册表和控制层会导致各平台（如 AWS、Microsoft、Salesforce 等）沦为相互孤立的自治孤岛，企业将失去全局治理能力。 - [00:04](https://www.youtube.com/watch?v=kJL2KLQIONY&t=4s) 资产治理不仅局限于智能体本身，还必须覆盖其依赖的工具、知识库、集成端点及开发阶段生成的 Markdown 文件与 CI/CD 流程。 - [03:27](https://www.youtube.com/watch?v=kJL2KLQIONY&t=207s) 合格的智能体控制平面必须回答四大核心问题：智能体在做什么（策略与防护栏）、谁有权访问（安全权限）、表现如何（可观测性）以及成本是多少（投入产出比）。 - [03:27](https://www.youtube.com/watch?v=kJL2KLQIONY&t=207s) IBM watsonx Orchestrate 实现了智能体具体实现与上层记忆、推理规划和执行层的解耦，并践行“评估先行”（Evaluation-first）原则。 - [03:27](https://www.youtube.com/watch?v=kJL2KLQIONY&t=207s) 控制平面内建模型网关进行“成本套利”，避免将高成本前沿大模型浪费在轻量日常任务上，并原生支持 MCP 与 Agent-to-Agent 协议。 - [03:27](https://www.youtube.com/watch?v=kJL2KLQIONY&t=207s) IBM 凭借企业级 IT 经验充当混合多云的中立中枢，支持企业在防火墙后搭建私有受治理智能体目录以适应混合云架构。 - [09:11](https://www.youtube.com/watch?v=kJL2KLQIONY&t=551s) 集成 AI Atlas 风险目录可在上线前提供开箱即用的风险评分，使合规要求前置化以应对 EU AI Act、GDPR 等监管标准。 - [09:11](https://www.youtube.com/watch?v=kJL2KLQIONY&t=551s) watsonx.governance 与 Orchestrate 联动打造“从摇篮到退役”的端到端闭环治理，践行“设计即证据”（Evidence by design），将运行时遥测回传至合规控制台。 - [14:12](https://www.youtube.com/watch?v=kJL2KLQIONY&t=852s) 用例层级可定义防护栏并通过父子关系自动继承至所有子智能体，实时拦截有害内容、越狱攻击及偏见语言。 - [14:12](https://www.youtube.com/watch?v=kJL2KLQIONY&t=852s) 企业智能体演进路径包含“实验探索”、“观察监控”到“受控自治”（Controlled Autonomy）三个阶梯，需在精细授权下逐步释放自主权。 - [18:18](https://www.youtube.com/watch?v=kJL2KLQIONY&t=1098s) 企业真实业务通常跨越多厂商环境，唯有具备跨生态编排与全资产证据收集能力的治理中枢才能确保长期可问责性。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=kJL2KLQIONY&t=4s) 智能体野蛮生长与企业面临的治理失控 在现代软件开发中，软件的构成组件正全面转向以智能体（Agent）为核心。业界统计数据预测，未来一年到一年半内全球智能体数量将突破 10 亿大关，到 2030 年更有望攀升至 22 亿。有些人可能会辩称自己所在的企业“根本没有在构建任何智能体”，但现实情况是，各类现成企业软件已经在深度捆绑智能体——随着人工智能逐渐演变成全新的人机交互界面（UI），“交互系统”（Systems of Interaction）与“行动系统”（Systems of Action）正在全面智能化。 ```mermaid flowchart TD accTitle: 孤立的智能体孤岛与统一控制层的对比 subgraph Silos["缺乏统一控制的智能体孤岛"] A1["AWS Bedrock 智能体"] A2["Microsoft Copilot 智能体"] A3["GCP 智能体"] A4["Salesforce Agentforce"] end subgraph Problem["企业面临的风险"] P1["无统一注册表"] P2["缺乏全局可见性"] P3["失控的自治孤岛"] end subgraph Solution["统一控制平面 (watsonx Orchestrate)"] S1["集中式资产注册表"] S2["跨平台与混合云编排"] S3["全局可观测性与治理"] end Silos --> Problem Problem -.->|"亟需转向"| Solution ``` 伴随智能体在各大公有云和平台（如 AWS Bedrock、Microsoft Copilot、GCP 以及 Salesforce Agentforce 等）上的野蛮生长（Agent Sprawl），企业遭遇的核心痛点在于缺乏统一的控制层与能见度层。没有中央注册表与统一治理手段，各平台便演变成互不相通的“自治孤岛”（Islands of autonomy），使企业彻底丧失对全局 AI 运行情况的掌控。 - **资产治理范围**：企业不能仅局限于治理智能体本身，还必须纳管智能体依赖的工具（Tools）、集成端点、知识库（Knowledge bases）、各类技能（Skills），以及像 Claude Code 这类智能体工具在开发阶段所生成的 Markdown 文件，并将其全部纳入 CI/CD 流程中。 - **任务导向编排**：跨平台编排的重心应当放在“端到端任务的达成”（Task completion），而非单一智能体孤立的执行过程。 --- ### [03:27](https://www.youtube.com/watch?v=kJL2KLQIONY&t=207s) 智能体控制平面的四大核心支柱与 watsonx Orchestrate 架构 一个合格的企业级智能体控制平面必须能够解答四个根本问题： 1. **智能体在做什么？（What）** —— 涉及策略规范与防护栏（Policies and Guardrails）。 2. **谁有权限访问或触发执行？（Who）** —— 涉及安全访问控制与权限分配。 3. **运行表现与性能如何？（How）** —— 涉及全生命周期的可观测性（Observability）。 4. **运行成本是多少？（Cost）** —— 关乎业务成效与投入产出比（Time to Value）。 ```mermaid flowchart LR accTitle: watsonx Orchestrate 智能体操作系统架构 subgraph OS["执行操作系统 (OS)"] direction TB M["内存管理"] R["推理与规划"] E["执行层"] end subgraph Control["控制平面"] direction TB O["构建与运行时可观测"] EV["评估先行机制"] OP["持续优化"] end subgraph Gateway["网关与资产"] direction TB GC["受治理目录"] GW["模型套利网关"] MCP["MCP / A2A 协议连接"] end OS --- Control Control --- Gateway ``` IBM 针对上述痛点推出了企业级智能体控制平面 **watsonx Orchestrate**。该平台将底层智能体的具体实现（不论来自 IBM、微软 Copilot、AWS Bedrock、GCP 还是 Salesforce）与上层的记忆管理、推理规划及执行层进行完全解耦。同时，平台倡导“评估先行”（Evaluation-first）原则，在智能体开发及部署前即完成严格的基准测试，并在运行时提供端到端的可观测性、评估与动态优化能力。 为了防范高昂的 Token 计费陷阱，控制平面内建了模型网关以实现“成本套利”（Cost arbitrage）。讲者形象地比喻道：**“你不会开着法拉利去杂货铺买菜”**。企业不应将最昂贵的大模型资源浪费在诸如草拟日常邮件这样的轻量级任务上，而应将其保留给复杂任务规划。网关层支持在后台动态调度不同模型，并原生支持智能体间通信协议（Agent-to-Agent protocol）以及用于工具标准集成的模型上下文协议（Model Context Protocol, MCP）。 - **开放生态承诺**：IBM 坦承自身既非头部的“前沿大模型提供商”（Frontier model provider），也非主导地位的超大规模云基础设施厂商，但凭借对企业级 IT 系统数十年沉淀的深刻理解，IBM 专注于充当连接混合多云的中立中枢。 - **合作伙伴生态圈**：目前已有 100 多家生态伙伴接入，其扩展目标为 500 家伙伴。 - **私有部署能力**：除了 IBM 托管的公共智能体目录外，企业也可以在内网防火墙之后建立属于自己的受治理租户与私有目录，无缝适配混合云与多云架构。 --- ### [09:11](https://www.youtube.com/watch?v=kJL2KLQIONY&t=551s) AI Atlas 风险评估与端到端治理闭环（watsonx.governance） 当智能体在界面中展示时，平台不仅会呈现其历史运行表现（基于真实业务数据或合成数据评测），还会集成 IBM 从传统机器学习、生成式 AI 一直延续到智能体时代所积累的 **AI Atlas 风险目录**，提供开箱即用的风险评分。这解决了传统治理手段滞后的问题，将合规与治理要求前置化。 面对不断严苛的国际监管法规（如欧盟《人工智能法案》EU AI Act、GDPR，以及美联储针对模型风险管理的 SR 11-7 / 现更新为 26-2 等审慎监管标准），企业迫切需要将策略定义与运行时证据紧密打通。IBM 通过 **watsonx.governance** 联动 watsonx Orchestrate，打造了贯穿“从摇篮到退役”（From cradle to retirement）的端到端闭环治理体系： ```mermaid flowchart TD accTitle: 端到端智能体闭环治理流程 subgraph Upstream["需求与用例准入阶段"] U1["用例准入申请"] --> U2["问卷与前置风险评分"] U2 --> U3{"风险等级判定"} U3 -->|"低风险"| U4["直通式自动批准"] U3 -->|"高风险"| U5["人工介入审批与阈值设定"] end subgraph Runtime["运行时与控制平面 (Orchestrate)"] U4 --> R1["策略与防护栏配置"] U5 --> R1 R1 --> R2["继承控制规则并执行"] R2 --> R3["遥测与观测数据采集"] end subgraph Feedback["合规证据与闭环监控 (Governance)"] R3 --> F1["运行时证据回传至统一控制台"] F1 --> F2["持续风险监测与合规合流审计"] F2 -.->|"策略调整/权限变更"| R1 end ``` - **治理不应是事后补丁**：治理必须作为主动式（Proactive）的前置框架，通过结构化问卷实现自动风险分级。 - **证据设计（Evidence by design）**：无论策略定义有多严密（例如规定“任何 AI 资产均严禁触碰敏感个人身份信息 PII”），都必须依托安全端点和智能体运行时将实际执行证据源源不断反馈至中央控制台。 --- ### [14:12](https://www.youtube.com/watch?v=kJL2KLQIONY&t=852s) 银行业务实操演示：从防护栏继承到“受控自治” 现场演示以零售银行客户支持智能体为例，展示了智能体在上线前（Pre-deployment）的受控测试全流程。系统支持以父子继承关系（Parent-child relationship）将用例级别的防护栏直接下发给其包含的所有子智能体： | 治理与控制维度 | 具体实现与演示场景 | |:--- |:--- | | **输入与输出强制拦截** | 实时检测并过滤有害内容（Harmful content）、越狱攻击（Jailbreak）、社会偏见（Social biases）及仇恨/辱骂/亵渎语言。 | | **规则继承机制** | 在用例层级定义防护规则后，任何新建或从外部平台（如 AWS、微软）导入的智能体均强制继承该规则。 | | **单元测试与合成数据验证** | 在准上线阶段注入合成数据进行压力测试，验证智能体行为边界。 | | **受控自治（Controlled Autonomy）** | 当测试到提交贷款申请环节时，由于涉及个人隐私数据且智能体尚未获得授权，系统自动阻断该提交动作；随后管理员在智能体控制面板中按需赋予其“自主读取并更新信息”的精准权限。 | 企业推行智能体应用通常要经历三个演进阶梯：**“实验探索”（Experimentation） $\rightarrow$ “观察监控”（Observed agents） $\rightarrow$ “受控自治”（Controlled autonomy）**。只有在全链路获得清晰的可视性前提下，才能真正落实权责归属与问责制（Accountability）。 --- ### [18:18](https://www.youtube.com/watch?v=kJL2KLQIONY&t=1098s) 跨厂商协同与总结答疑 现场强调，现实的企业业务环境决定了单一客户不可能仅绑定在 IBM 孤立的技术栈上。以 IBM 自身为例，其内部销售智能体日常就需要同时与 Salesforce、内部遗留系统以及各类第三方系统进行高频交互。正因如此，具备跨厂商（Cross-functional / Cross-vendor）编排与全资产证据收集能力的平台才是企业长远发展的刚需。 得益于对多位企业客户真实落地场景的调研，IBM 获得 Gartner 权威报告的高度认可。在演讲尾声，讲者简短解答现场关于技术落地的提问，并邀请有深度技术交流、MCP 协议集成或生态合作意向的观众移步至大会 601 号展台（Booth 601），进一步探讨真实业务场景下的闭环治理实践。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=kJL2KLQIONY&t=4s) 未来一年到一年半内全球智能体数量将突破 10 亿大关，到 2030 年更有望攀升至 22 亿。 — Sunil Murthy > [00:04](https://www.youtube.com/watch?v=kJL2KLQIONY&t=4s) 根本没有在构建任何智能体 — Sunil Murthy > [00:04](https://www.youtube.com/watch?v=kJL2KLQIONY&t=4s) 自治孤岛 — Sunil Murthy > [00:04](https://www.youtube.com/watch?v=kJL2KLQIONY&t=4s) 跨平台编排的重心应当放在“端到端任务的达成”（Task completion），而非单一智能体孤立的执行过程。 — Sunil Murthy > [03:27](https://www.youtube.com/watch?v=kJL2KLQIONY&t=207s) 你不会开着法拉利去杂货铺买菜 — Sunil Murthy > [03:27](https://www.youtube.com/watch?v=kJL2KLQIONY&t=207s) 企业不应将最昂贵的大模型资源浪费在诸如草拟日常邮件这样的轻量级任务上，而应将其保留给复杂任务规划。 — Sunil Murthy > [09:11](https://www.youtube.com/watch?v=kJL2KLQIONY&t=551s) 从摇篮到退役 — Sunil Murthy > [09:11](https://www.youtube.com/watch?v=kJL2KLQIONY&t=551s) 治理不应是事后补丁 — Sunil Murthy > [14:12](https://www.youtube.com/watch?v=kJL2KLQIONY&t=852s) 实验探索 $\rightarrow$ 观察监控 $\rightarrow$ 受控自治 — Sunil Murthy > [18:18](https://www.youtube.com/watch?v=kJL2KLQIONY&t=1098s) 具备跨厂商（Cross-functional / Cross-vendor）编排与全资产证据收集能力的平台才是企业长远发展的刚需。 — Sunil Murthy ## Mentioned Sunil Murthy, IBM, watsonx Orchestrate, watsonx.governance, AI Atlas, AWS Bedrock, Microsoft Copilot, GCP, Salesforce Agentforce, Claude Code, Model Context Protocol (MCP), EU AI Act, GDPR, SR 11-7 / 26-2, Gartner ## Video description Sunil Murthy - Watsonx Technical Lead - IBM Gen AI Field CTO, IBM As companies build AI agents across teams, tools, models, and clouds, the biggest challenge is not creating agents - it is how to scale agentic AI without losing visibility, control and accountability. Traditional GRC governance and agent runtime operations often work in separate worlds, making it hard to connect policies, controls, evidence, and oversight. In this session, we’ll explore why orchestration and governance must come together as enterprises adopt AI agents at scale. Together, these capabilities help organizations connect governance intent to agent runtime controls. he result is a more trusted, measurable, and scalable path to agentic AI adoption. [Source](https://www.youtube.com/watch?v=kJL2KLQIONY)

[0:04] Sunil Murthy: 未来一年到一年半内全球智能体数量将突破 10 亿大关，到 2030 年更有望攀升至 22 亿。 [0:04] Sunil Murthy: 根本没有在构建任何智能体 [0:04] Sunil Murthy: 自治孤岛 [0:04] Sunil Murthy: 跨平台编排的重心应当放在“端到端任务的达成”（Task completion），而非单一智能体孤立的执行过程。 [3:27] Sunil Murthy: 你不会开着法拉利去杂货铺买菜 [3:27] Sunil Murthy: 企业不应将最昂贵的大模型资源浪费在诸如草拟日常邮件这样的轻量级任务上，而应将其保留给复杂任务规划。 [9:11] Sunil Murthy: 从摇篮到退役 [9:11] Sunil Murthy: 治理不应是事后补丁 [14:12] Sunil Murthy: 实验探索 $\rightarrow$ 观察监控 $\rightarrow$ 受控自治 [18:18] Sunil Murthy: 具备跨厂商（Cross-functional / Cross-vendor）编排与全资产证据收集能力的平台才是企业长远发展的刚需。

[0:04] Sunil Murthy: the biggest challenge is not creating agents - it is how to scale agentic AI without losing visibility, control and accountability. [0:04] Sunil Murthy: Traditional GRC governance and agent runtime operations often work in separate worlds, making it hard to connect policies, controls, evidence, and oversight. [0:04] Sunil Murthy: islands of autonomy [2:19] What do the agents do? [2:19] Who has access? [2:19] How are the agents performing? [2:19] How much are the agents costing? [4:23] Sunil Murthy: You don't need to drive a Ferrari for doing every single task. If I'm going to the grocery store... I'm not going to drive a Ferrari. [14:12] Sunil Murthy: You go from experimentation to... observed agents to controlled autonomy. [14:12] Sunil Murthy: You can't drive accountability if you don't have visibility.

[0:04] Well, thank you for taking your valuable  time to listen to this important topic. [0:08] Um, I'm guessing most of you are already working  through agents. So, agents sprawl is something [0:15] that as IBM we see in our enterprise customers.  And this talk is specifically focused on [0:22] how do you get better control of these agents  and and establish a governance framework. So, [0:28] with that, um, I'm one of the AI field CTOs at  IBM. I work with several customers. What we are [0:35] seeing is really the emergence of systems of  interaction, systems of action from based on [0:43] agentic AI and agents in general, right? If you  think about software development, the componentry [0:49] that builds up the software is predominantly now  shifting towards agent. There are some statistics [0:56] that suggest more than a billion agents in the  next 1 year, 1 and 1/2 years. You know, crossing [1:04] to 2.2 billion according to another statistic  by 2030. So, you have agents that are growing [1:11] tremendously. Now, you may ask, "Well, I'm not  building any agents. Are you using any software?" [1:16] Well, guess what? The softwares are bundling  agents for you. So, the reality is the systems [1:22] of interaction where the AI becomes the new UI is  happening as part of the transformation with AI. [1:30] Now, as part of this agents sprawl from a software  perspective, you are going to see agents that are [1:36] being built on let's say AWS bedrock platform  or Microsoft co-pilot platform, you GCP, [1:45] Salesforce agent verse, you name it, right? The  reality is there is no single control layer, [1:53] and I'll get to the definition of this control  layer in a minute, but there's no really, you [1:58] know, an agentic visibility layer for across the  platform. So, there's not a single visible layer, [2:06] there's not a single registry, there's not a  single really control layer for these agents. So, [2:12] you'll have islands of autonomy that you really  would lose control from an overall enterprise. [2:19] So, what we are suggesting is is really quite the  contrary. The contrary is a registry that you can [2:26] actually govern, a registry that tracks all your  AI assets, not just agents, but what do agents [2:33] need? Agents need access to tools, integration,  agent needs access to knowledge bases, [2:40] agents need access to skills. There's a lot of  markdown files that are getting generated perhaps [2:46] by Claude Code and other software development  agentic tool sets. You need to get control of [2:52] those as part of your CI/CD processes. So, one  registry to really provide that visibility, [2:59] observability, which really how the agents are  operating at an enterprise level, that's another, [3:06] you know, critical aspect of this control plane,  and then really this cross-platform orchestration. [3:13] You will have agents across the platforms,  be it both hybrid as well as cloud. How do [3:19] you orchestrate so that the task completion is a  central focus rather than agentic execution. So, [3:27] you need almost like a layer to orchestrate these  agents. So, if you think about a definition of [3:33] a control plane, it really does four things. The  for the agents, right? What do the agents do? So, [3:40] think about policies and guardrails. What do  these agents do? So, what? Who has access to these [3:47] agents? Who can execute these agents? So, the who  question, that the security and access question. [3:54] How are the agents performing? That's more of an  observability question that you need answers to. [3:59] And top-of-the-mind for a lot of you and a lot of  our customers, how much are the agents costing? [4:05] Right? Because ultimately, it's about time to  value and the value delivered is tracking by cost [4:12] and the outcomes that the agents deliver. So, four  things that you need as part of an agentic control [4:17] plane. And what do we do from an IBM perspective  is to really deliver a robust enterprise-focused [4:23] control plane for your agent orchestration  and your agent execution. So, we call this the [4:31] you know, agentic control plane called Watsonx  Orchestrate. It has three major components in [4:37] terms of providing an operating system to execute  your agents. Again, agents could be from IBM, [4:44] agents could be from Microsoft, Copilot or  AWS Bedrock, GCP, Salesforce, doesn't matter. [4:52] The idea is you have memory management, the  reasoning and planning and execution layer, [5:00] which is abstracted or, you know, kind kind of  decoupled from your agents that are executing. So, [5:06] you get the operating system for for agents  where you run your agents. You have the control [5:12] plane. We are talking about observability, but  also evaluation because we are dealing with [5:18] the evaluation-first approach where the agents are  getting evaluated before they get deployed. So, [5:24] you need observability and evaluation and  optimization for these agents while you're [5:29] developing as well as you are uh deploying.  So, observability, evaluation, optimization, [5:36] build time and run time important to uh execute  as part of the control plane. And really, [5:43] the the third element is this notion of governed  catalog. So, you have a governed set of AI assets, [5:50] everything surrounding your agents. So, IBM  agents, partner agents. We work with 100 plus [5:56] partners as part of our partner ecosystem  for agentic systems continuing to grow. [6:02] Our target is to get to 500. So, if you are  a partner in the room, want to work with IBM, [6:07] you're welcome to stop by our booth, which  is booth number 601 to talk more about that. [6:13] Um and and this notion of gateway. So,  when you think about how do you, you know, [6:19] arbitrage cost between different models? You  need a gateway, right? You need agents that can, [6:26] you know, you don't The analogy that I always use  and most of the folks I've heard of perhaps is [6:31] you don't need to drive a Ferrari for doing every  single task. If I'm going to the grocery store, I [6:37] don't I'm not going to drive a Ferrari, right? So,  if you have one car, which is a Ferrari, in this [6:43] case one model, which is your token cost, do you  really want to use it just for email composition? [6:50] Or do you want to restrict that to a complex  task management? So, how do you arbitrage between [6:56] multiple models? You need a gateway. So, you need  when you have an agent that can abstract out tasks [7:02] and can handle multiple models in the back end  so that you can, you know, cost manage it better. [7:08] And you can also have agent-to-agent protocol  through a gateway as well as an MCP pro [7:14] gateway if to manage your MCP connections,  model context protocol for integration, [7:19] you basically need a standardized gateway. That's  what you get as part of the IBM's control plane [7:26] for agents, which is Watson X Orchestrate.  And we we got, you know, quite a bit of demos, [7:32] again, out there in our booth that you can stop by  if you have time. I mentioned partners. Our idea [7:40] of having an agentic control plane for enterprise  is you're not going to be total IBM customer. [7:46] You know, in fact, I would contend because we're  not a major frontier model provider, we're not [7:52] a major cloud provider, but we knew do know a  little a thing or two about enterprise systems. [7:58] So, we have the responsibility to provide you an  enterprise agentic platform that works with what [8:06] you have invested from different enterprises, be  it cloud vendors, hyperscalers, or be it platforms [8:13] like Agent Force from Salesforce or SAP Joule  and others. So, the idea is you can orchestrate [8:19] agents, be it agents from wherever it comes from,  which whichever platform. The idea is to grow this [8:27] outreach. And the again, the vision,  the idea is to have one central place [8:32] so that you can have a governed catalog of all  things assets related to agents. It's about agents [8:40] in terms in terms of catalog, in terms of MCP  servers, in terms of skills that goes alongside [8:46] with agents, and the controls, which really are  policies and guardrails for these agents. So, [8:54] we provide a catalog that's publicly accessible  for all our agents that's managed by IBM, [9:00] but you can take that same concept and make it  your own tenant, your own private governed catalog [9:06] for all your agents behind your firewall.  That's another advantage of an IBM system. [9:11] It works perfectly well in a hybrid multi-cloud  system. You're not wedded to one cloud in this [9:18] approach. So, this is how it looks in terms of  your UI. You get meaningful information of every [9:24] single agent. You get meaningful information  about metrics in terms of how they perform, [9:30] maybe historical performance based on, you  know, be it real data or even, you know, [9:36] synthetic data. you get, you know, this notion of  AI Atlas risk score. IBM is big on AI governance. [9:45] We assess risk based on what is called as a AI  Atlas catalog. We catalog a bunch of risks for [9:52] AI. We've been doing that for since ML, now GenAI  and agentic AI. You can go Google that or Claude [9:59] that or open AI. What's the word nowadays? Open  AI dirt. So, you can you can ask that in terms of, [10:05] you know, what's the IBM AI risk catalog? And  you'll get a response which is a very publicly [10:11] very usable asset for you, which is documented  IBM experience of assessing risk across multiple [10:18] assets in AI. And you have that risk assessment  out of the box for the AI assets in our catalog. [10:27] Speaking of governance, it's not enough to just  talk about agentic control plane. What about the [10:33] governance piece to complement the observability  piece? So, when we talk about agent control plane, [10:41] what's missing is is really the upfront AI  governance piece. So, how do you comply to various [10:47] risk approaches, compliance approaches? There  are a lot of standards, especially if you are [10:53] European Union, you know, aligned. There's a EU AI  Act. There's also, you know, GDPR. There's also, [11:00] you know, various acts like the SR 11-7, which is  now 26-2, which is a, you know, Federal Reserve [11:08] standard. So, when you think about risk and  compliance standards that you need to comply to, [11:14] you need to have a system that can provide the  compliance metrics. You need to have a system [11:18] that provides out of the box risk. You need to  have AI use case onboarding that uses AI agents, [11:26] AI models, different AI assets. So, use case  onboarding, governance for us is a very proactive [11:33] approach for AI. It's not an afterthought. It's  It's a proactive approach. So, how does this [11:40] look like? So, complementing our Agentic Control  Plane, you have AI governance um solution, [11:47] which is Watson x governance. It provides you the  ability to have the ownership of AI in terms of [11:55] the accountability. It provides you visibility of  AI in terms of where the AI assets are executing. [12:02] It also provides you mechanisms to define your  controls. A control could be an enterprise [12:07] control, for example, no AI should use PII. That  could be a control. But, you need to have evidence [12:14] surfaced from run times. Could be security end  points. Could be run the various run times, [12:20] including Agentic operating systems like Watson  x Orchestrate, to be surfaced and integrated with [12:26] the governance plane. Apologies for the small  font. But, the idea here is you go through your [12:33] traverse through end to end, from cradle to all  the way to retirement of an agent or any AI asset. [12:40] So, if you think about somebody requesting an AI  use case, you have definition of AI use case. You [12:47] go through a questionnaire that assesses the risk.  It assess It provides a proactive risk score, [12:53] where you can define is this a straight-through  approved process, approved use case, [12:58] or you need a human intervention for approving the  use case. Um it goes through a bunch of, you know, [13:04] additional controls in terms of the policy and  the risk tiers, where you define the thresholds. [13:11] And then, as I mentioned, that you define the  controls, but you execute this in a control plane, [13:17] in a operating system for agents. In  this example, it's Watson x Orchestrate. [13:22] It's where you operationalize and enforce your AI  assets. You monitor, you report on the telemetry [13:30] as well as observability metrics back into  the control plane. That evidence is now fed [13:38] back to the AI governance control plane. The AI  governance plane, if you will, is the overarching [13:45] AI governance solution providing you a single  console of all your AI assets based on risk, [13:52] based on compliance, based on departments that  are consuming the AI assets and all of these other [14:00] you know relevant information. So, you got  an end-to-end closed loop, if you will, [14:05] agentic governance solution both from execution  as well as governance. So, how does this look? [14:12] This is a demo that hopefully will  play here that you can take a look. [14:18] A quick demo. Again, we have much more details  on the booth here. So, what you're seeing here is [14:25] a bunch of use cases for a retail banking customer  support use case. And you can see some controls [14:31] defined here. You can see the connections  where the agents are deployed. In this case, [14:37] we're showing you agents deployed on Watson  x Orchestrate. Again, as I mentioned, [14:42] we have agents that we can work with deployed  on AWS, Microsoft, and other platforms. [14:48] Once you have this, this is again pre-deployment.  It's not yet in production, right? You have the [14:54] screen showing you Watson x Orchestrate to  actually build out your agent. You know, [14:59] agents need tools, agents need knowledge, agents  need behavior. So, you define all these guardrails [15:06] and you know, remember what can the agent  do, who can access it, how does it perform, [15:11] all of those elements. You define those and this  is an example of defining guardrail or control [15:18] for an agent. So, in this case, we want to make  sure both the input and output are enforced. [15:24] You're tracking harmful content, jailbreak,  social biases, as well as any other hate, [15:30] abuse, profanity language. So, you want to track  those and monitor as part of the guardrail. [15:35] And then you're adding an agent that inherits So,  there's a parent-child relationship, inheritance [15:42] of these guardrails. So, any agent that you  build for this use case inherits these controls, [15:49] and then you can actually, you know, look at  these individual agents where you can import [15:54] these agents here. And again, it goes through  that connection that we already established. [15:59] Bring that agent over. In this case, it's a retail  banking agent and attach it to the use case. [16:05] So, the idea being you have definition of a use  case. You build your agent wherever you want to, [16:12] IBM or non-IBM. Bring that back as evidence into  the governance console. Now, you get a view of the [16:21] that you see, if I can go back here. You get  a You get a view of the metrics of the agent [16:26] that you that's being executed. So, um let me run  this for a couple more minutes here. So, this is [16:34] pre-production. You're testing with synthetic  data. You're basically unit testing it. [16:40] And you know, you want the agent to behave the  way you want to define you want it to define. [16:45] So, if an agent is not you've not given the  authority for an agent to submit the application, [16:51] which includes personal information, then you  want to test it out. So, in this case, the agent [16:56] basically did not let the applicant submit the  application because it will involve personal [17:02] information. But then you can go back in there  and you can say the control at an agent level, [17:07] I want to give the autonomy control to read and  update the information autonomously. So, the [17:15] It's called controlled autonomy, right? For  agents, where you go from experimentation to, [17:21] you know, observed agents to controlled  autonomy. So, you get all these different levers [17:27] for enabling the governed state for agents. So,  the idea again is you get important controls, [17:34] important metrics for you to make decisions, and  you get this production metrics that, you know, [17:41] you continue to monitor as you deploy the agent.  And you can always go back and make edits and [17:47] changes if your risk posture has changed or if you  want to, you know, do any other modifications. So, [17:54] that's the idea. The idea is you have a a very  governed state, and as you scale these agents, [18:00] you get everything that's visible. Once you  have visibility, you can drive accountability, [18:06] right? That's the idea. You can't drive  accountability if you don't have visibility. [18:12] So, that's what we are attempting  to do in the solution. So, with the [18:18] time I have left here, I just want to, you know,  bring this to a wrap. We spoke about agent runtime [18:25] in terms of orchestration from IBM. We need to  complement that with the AI governance with, [18:32] you know, Watson X governance that gives you  that governed state for all your agents and, [18:38] more importantly, all the AI assets, not just  AI agents as in just the agent code, but the MCP [18:46] servers, the skills that you need, as well as, you  know, anything else that's goes alongside with the [18:53] agents. So, evidence by design, that's the runtime  controls that I showed, as well as this notion of [18:59] cross-functional operating model. So, you don't  be restricted to one single vendor. You have the [19:07] you know, kind of the flexibility to work across  the agents across multiple vendors. And this is [19:13] truth right I mean in IBM we use our sales agents  talk to salesforce as well as our internal systems [19:20] as well as a third-party system so it's a  reality and I'm I'm pretty sure most of your [19:25] environments as well so why IBM we were rated  fairly I highly by Gartner not by chance but by [19:34] interviews of you know multiple customers lots  of our customers vouch for the solution to [19:41] be enterprise ready and and really help you as  part of this evolving agentic world and and the [19:48] continuing governance work we may have  time for maybe one or two questions [19:55] we can do one question and then they could ask  you oh we got to stage because I have a question [19:59] anybody has any pressing questions before I  wrap you can always catch us at booth number 601 [20:08] which where we are all out there showcasing  the solution and answer any questions again [20:15] appreciate your time thank you for joining our  session hopefully we'll see you back at the booth