CSX Automation Engine Blocks Unauthorized AI Models During Gate Outages

AI Governance in the Tech Stack - Making AI Safe to Scale - AI Governance as Code with CSX — Ai4

Ai4

Open-source policy engines eliminate shadow AI risks by enforcing automated runtime controls even when primary security gateways fail.

AI-assisted summary of AI Governance in the Tech Stack - Making AI Safe to Scale - AI Governance as Code with CSX — original source. Check the original for full context.

Source published: 2026-08-18

Detailed notes

## Background This YouTube video was presented by Marc Cagulangan, Technical Director at CSX, and published by the Ai4 channel on August 18, 2026. The presentation explores "AI Governance-as-Code," demonstrating how organizations can automate governance and risk management across CI/CD pipelines, runtime environments, and agent workflows using Open Policy Agent (OPA).

## TL;DR Marc Cagulangan outlines an executable approach to AI governance designed to replace static policy documents with automated, code-based policy enforcement engines. He presents a target state architecture featuring eight sequential governance gates—covering inventory, architecture, identity, data, deployment, runtime operations, telemetry, and automated containment—mapped to frameworks like NIST AI RMF. Through a practical hands-on demonstration using Open Policy Agent (OPA) and Rego, Cagulangan illustrates how automated fail-close mechanisms can enforce real-time security, mitigate shadow AI, and maintain compliance even during vendor gateway outages.

## Atmosphere & style The session carries an authoritative, pragmatic, and highly technical tone, blending developer expertise with cybersecurity and IT audit rigors. Cagulangan presents with an open, "no-gatekeeping" approach, utilizing real-world analogies like airport TSA checkpoints to make complex policy architectures accessible. The atmosphere feels pragmatic and solution-oriented, transitioning from high-level enterprise risk considerations to real-time VS Code demonstrations that ground AI safety directly in operational reality.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=4s) Static policy documents fail to keep pace with rapid AI and automation scaling, creating gaps between policy, execution, and auditability. - [00:04](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=4s) Operationalizing AI governance as an enforceable policy engine moves organizations toward automated, living governance embedded in CI/CD pipelines and runtime environments. - [01:51](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=111s) Organizations face critical management challenges from 'shadow AI' and a lack of centralized, real-time metrics across the AI agent lifecycle. - [01:51](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=111s) Automating governance delivers scalable speed, continuous runtime protection, safe agentic autonomy, and lower operating costs by reducing manual audit overhead. - [03:00](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=180s) Open Policy Agent (OPA) serves as a CNCF-graduated, open-source rules engine using the declarative Rego language to evaluate compliance dynamically across the AI lifecycle. - [03:00](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=180s) Major technology and financial industry leaders (e.g., Anthropic, Netflix, Google, Capital One) rely on OPA or similar policy frameworks as de facto enforcement engines. - [06:25](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=385s) The target architecture defines eight sequential governance gates: Inventory, Build & Architecture, Identity & Tools, Data Governance, Approve & Deploy, Runtime Operations, Observability & Telemetry, and Contain & Respond. - [06:25](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=385s) Governance policies managed entirely as code are version-controlled, peer-reviewed, tested in CI/CD pipelines, and fully auditable. - [07:44](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=464s) OPA provides architectural flexibility across three key patterns: a redundant defense-in-depth fail-close backup, a unified single pane of glass, and a rapid stop-gap engine for early POCs. - [13:32](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=812s) In fail-close execution scenarios, OPA can block unauthorized foundation models or agent actions during primary gateway service outages. - [16:00](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=960s) OPA policies mapped to frameworks like NIST AI RMF decouple central decisioning (allow/deny) from downstream REST API execution across tech stack components. - [17:47](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=1067s) Effective AI governance aligns technical safety directly with corporate business imperatives, ensuring resilient operations and measurable return on investment.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=4s) Introduction and Vision: AI Governance as Code

Marc Cagulangan, Technical Director at CSX specializing in AI governance, IT, cybersecurity, and risk management, introduces himself and sets the agenda for the session. Blending his background in software development, IT audit, cybersecurity, and AI governance, Cagulangan approaches the challenge from multiple angles: a developer focused on delivering value, an auditor concerned with compliance and burden of proof, a security practitioner mitigating threats, and an executive-facing leader responsible for runtime safety. He emphasizes that the talk will be completely open and transparent—promising "no gatekeeping"—and will demonstrate a proof-of-concept (POC) built on Open Policy Agent (OPA) to operationalize AI governance as an enforceable policy.

- **Speaker background:** Transitioned across software development, IT audit, cybersecurity, and AI governance. - **Core goal:** Move away from static policy documents toward an enforceable, automated "AI Governance-as-Code" policy engine. - **Audience takeaway:** Full visibility into the open-source coding project to enable attendees to build their own OPA-based policy engines.

---

[01:51](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=111s) The Operational Challenge and Business Value of Automated Governance

Organizations face significant operational hurdles in AI management, chief among them being "shadow AI"—the principle that "you can't govern what you can't see." Beyond basic visibility, there is a systemic lack of centralized, real-time, and integrated metrics spanning the entire AI agent lifecycle. While emerging vendor solutions attempt to tackle isolated parts of the lifecycle, Cagulangan argues that a unified governance framework is essential to achieve both compliance and speed.

Automating governance delivers tangible business value across several dimensions: - **Scalable Governance:** Allows governance velocity to match the rapid pace of AI adoption. - **Runtime Protection:** Ensures AI models and agents remain governed post-deployment, not just during pre-deployment checks. - **Agentic Autonomy:** Enables autonomous AI agents to operate within strict guardrails without sacrificing organizational accountability. - **Lower Operating Costs:** Reduces administrative overhead through automated controls rather than manual audit checks.

---

[03:00](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=180s) Open Policy Agent (OPA) as the Universal Policy Engine

Open Policy Agent (OPA) is an open-source, Cloud Native Computing Foundation (CNCF) graduated project that functions as a real-time, centralized rules engine. OPA utilizes **Rego**, a specialized declarative policy language, to codify business, legal, and technical requirements into computable conditions that can be evaluated dynamically. Rather than replacing existing tools, OPA sits centrally across the AI development lifecycle to execute governance gate checks at each phase.

To demystify OPA, Cagulangan provides a real-world airport security analogy:

Industry heavyweights—including Anthropic (using Responsible Scaling Policies), Netflix, Google, Capital One, and Goldman Sachs—already rely on OPA or similar policy frameworks as de facto enforcement engines.

---

[06:25](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=385s) The Target State Architecture: 8 Sequential Governance Gates

The core of the presentation is the target state architecture for the AI development lifecycle. It establishes eight sequential governance gates that every AI agent and solution must traverse. Policies are managed entirely as code—version-controlled, peer-reviewed, tested in CI/CD pipelines, and fully auditable.

``` +-----------------------------------------------------------------+ | AI LIFECYCLE GOVERNANCE PIPELINE | +-----------------------------------------------------------------+ | [Gate 1: Inventory] --> [Gate 2: Build] --> [Gate 3: Identity] | | | | | [Gate 6: Runtime] <-- [Gate 5: Deploy] <-- [Gate 4: Data] | | | | | v | | [Gate 7: Telemetry] --> [Gate 8: Contain & Respond] | +-----------------------------------------------------------------+ ```

Detailed Gate Specifications

- **Gate 1: Inventory & Profile (Blue) — *"What are we building?"*** Verifies AI agent registration in enterprise registries, evaluates AI profile identifiers, assesses business context, and logs risk classifications in systems of record (e.g., ServiceNow AI Control Tower, Credo AI). - **Gate 2: Build & Architecture (Purple) — *"Can it be built?"*** Evaluates stack metadata for architectural viability, dependency security, approved cloud services, and sanctioned data sources. - **Gate 3: Identity & Tools — *"Who is doing the work?"*** Validates agent identity, role-based access control (RBAC), sanctioned foundation models, approved tool integrations, and Model Context Protocol (MCP) servers (e.g., Microsoft Entra, Okta, Palantir Foundry). - **Gate 4: Data Governance (Yellow) — *"What data can it access?"*** Enforces data classification, anonymization, hygiene, and data pipeline version control (e.g., Microsoft Purview). - **Gate 5: Approve & Deploy (Red) — *"Can it be deployed?"*** Verifies staging environments, MLflow registration, formal sign-offs, and automated security test harness results prior to production release. - **Gate 6: Runtime Operations (Orange) — *"Can it safely operate?"*** Monitors active requests to enforce response thresholds, API rate limits, behavioral boundaries, and sanctioned model versions (e.g., Kong API Gateway, Zscaler AI Guard). - **Gate 7: Observability & Telemetry (Black) — *"Is it behaving correctly in production?"*** Provides continuous real-time monitoring for model drift, algorithmic bias, and execution exceptions (e.g., LangSmith, Microsoft Sentinel). - **Gate 8: Contain & Respond (Teal) — *"How do we react to threats?"*** Triggers automated incident response protocols, escalates anomalies, and executes automated kill switches when safety boundaries are breached.

---

[07:44](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=464s) Implementation Strategies: Build vs. Buy and Redundancy

While off-the-shelf commoditized vendor solutions dominate individual points in the stack, OPA provides crucial architectural flexibility through three main deployment patterns: 1. **Redundant Defense-in-Depth:** Serves as a fail-close backup engine that enforces safety controls even if a primary commodity gateway or security vendor experiences an outage. 2. **Single Pane of Glass ("Life360 for AI"):** Aggregates verification state across all eight gates to provide a unified real-time inventory of every AI agent’s compliance posture. 3. **Rapid Stop-Gap Solution:** Acts as a lightweight, custom policy engine during early proof-of-concept (POC) phases to allow fast production deployments without waiting for enterprise procurement cycles.

---

[13:32](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=812s) Real-World Case Study: Mitigating Shadow AI and Gateway Outages

Cagulangan walks through a practical threat scenario involving an unauthorized foundation model (**Kimmy K3**) that has not received legal or security clearance for general availability (GA) deployment.

Incident Execution Flow

1. **Attempted Access:** An AI agent attempts to invoke the blacklisted Kimmy K3 model via RPC. 2. **Gateway Failure:** Simultaneously, the primary AI Gateway service experiences an infrastructure outage. 3. **OPA Fail-Close Intervention:** Acting as a redundant control at Gate 6 (Runtime Operations), OPA intercepts the request. Because the primary gateway is offline and the requested model is unapproved, OPA defaults to a **fail-close** decision. 4. **Automated Escalation:** OPA signals Zscaler to enforce a perimeter firewall rule blocking blacklisted AI traffic, alerts the Security Operations Center (SOC), and triggers an automated AI governance review.

"In this case, the AI agent was essentially quarantined and denied traffic," Cagulangan explains, demonstrating how OPA maintains compliance and mitigates operational, legal, and privacy risks even during vendor outages.

---

[16:00](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=960s) Hands-On Code Walkthrough and Executive Dashboards

Transitioning to VS Code, Cagulangan demonstrates the project structure for the OPA engine.

``` /ai-governance-opa │── /policies │ ├── gate1_inventory.rego │ ├── gate2_architecture.rego │ ├── gate3_identity.rego │ ├── gate4_datagov.rego │ ├── gate5_deployment.rego │ ├── gate6_runtime.rego │ ├── gate7_telemetry.rego │ └── gate8_containment.rego └── /configs └── nist_ai_rmf_mapping.json ```

- **Policy Generation:** Policies are written in Rego and mapped directly to the **NIST AI Risk Management Framework (AI RMF)**, allowing developers to customize rules for edge cases. - **Enforcement Decoupling:** OPA handles central *decisioning* (`allow` vs. `deny`), while execution is handled by integrated downstream stack components via REST APIs. - **Telemetry Console:** A dedicated dashboard displays real-time agent population health using visual status indicators: - **Green:** Policy evaluation passed. - **Yellow:** Incomplete API payload; insufficient data to evaluate condition. - **Red:** Explicit policy denial; execution blocked.

---

[17:47](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=1067s) Conclusion: Aligning AI Safety with Corporate Imperatives

Closing the presentation, Cagulangan ties technical governance directly to business strategy. While CEOs demand immediate financial and operational returns on AI investments, those returns cannot be realized without robust safety and governance.

"At CSX, we are envisioning an AI governance program where it is no longer just a security and technology concern—there's a business, safety, and financial imperative," he concludes. The ultimate goal for CSX is to leverage executable AI governance to remain the safest, most efficient, and most resilient railroad in North America while maintaining best-in-class service delivery.

## Notable quotes > [01:51](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=111s) you can't govern what you can't see — Marc Cagulangan

> [13:32](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=812s) In this case, the AI agent was essentially quarantined and denied traffic — Marc Cagulangan

> [17:47](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=1067s) At CSX, we are envisioning an AI governance program where it is no longer just a security and technology concern—there's a business, safety, and financial imperative — Marc Cagulangan

## Mentioned Marc Cagulangan, CSX, Open Policy Agent (OPA), Rego, TSA, Department of Homeland Security (DHS), Anthropic, Netflix, Google, Capital One, Goldman Sachs, ServiceNow AI Control Tower, Credo AI, Microsoft Entra, Okta, Palantir Foundry, Microsoft Purview, MLflow, Kong API Gateway, Zscaler AI Guard, LangSmith, Microsoft Sentinel, NIST AI Risk Management Framework (AI RMF), Kimmy K3

## Video description Marc Cagulangan - Technical Director, CSX

What if your governance policies could execute themselves—directly enforcing control at every layer of your technology stack? As organizations scale AI and automation, traditional governance models struggle to keep pace, creating gaps between policy, execution, and auditability. In this session I will discuss how to embed governance directly into CI/CD pipelines, runtime environments, and agent workflows using a “AI Governance-as Code” approach. Attendees will learn how to translate risk, compliance, and security requirements into enforceable controls that operate in real time across modern AI systems. They will also see how this model improves audit readiness, reduces operational risk, and enables scalable oversight. Join this session to move from static policy documents to living, executable governance that scales with your technology.

[Source](https://www.youtube.com/watch?v=g0zqHEOr2DM)

中文简报

CSX自动化引擎在网关中断期间拦截未授权AI模型开源策略引擎通过在主安全网关失效时执行自动化运行时控制，消除影子AI风险。 Marc Cagulangan概述了一种可执行的AI治理方案，旨在通过基于代码的自动化策略执行引擎取代静态策略文档。他提出了一个包含八个连续治理关口的目标状态架构——涵盖资产清单、架构、身份、数据、部署、运行时运维、遥测和自动化遏制——并与NIST AI RMF等框架相映射。通过使用Open Policy Agent（OPA）和Rego的实操演示，Cagulangan阐述了自动化故障关闭机制如何在供应商网关中断期间依然实施实时安全防护、缓解影子AI风险并维持合规性。 CSX 技术总监 Marc Cagulangan 提出“AI 治理即代码”（AI Governance-as-Code）理念，主张告别静态策略文档，将治理机制直接嵌入 CI/CD 流水线与运行时环境中。 (0:04) 面对“影子 AI”以及全生命周期实时指标缺失等挑战，基于代码的自动化治理能够提供持续的运行时保护，并在保障自主智能体安全运行的同时降低人工审计成本。 (1:51) 该方案基于 CNCF 毕业的开源规则引擎 Open Policy Agent（OPA），使用声明式 Rego 语言对 AI 开发与运行时的合规性进行动态评估，Anthropic、Netflix 等行业巨头亦采用类似架构。 (3:00) 目标架构定义了资产盘点、构建架构、身份工具、数据治理、审批部署、运行时操作、可观测遥测以及遏制响应共八道连续的治理关卡，所有策略均实现版本控制并映射至 NIST AI RMF。 (6:25) 通过未获批模型调用的实战案例表明，OPA 可充当纵深防御与故障闭锁（fail-close）机制，即使主流网关宕机也能自动隔离违规智能体并触发阻断与告警。 (13:32)

Reading summary

Marc Cagulangan, Technical Director at CSX, argues that scaling artificial intelligence safely requires replacing static policy documents with an automated "AI Governance-as-Code" framework. By using Open Policy Agent (OPA) as a centralized rules engine, organizations can enforce compliance, manage risk, and maintain runtime safety across the entire AI lifecycle without slowing development. Overcoming Shadow AI and Fragmented Vendor Tools (1:51) Organizations adopting AI face significant operational hurdles, most notably "shadow AI"—which Cagulangan summarizes with the principle that "you can't govern what you can't see." Beyond visibility gaps, enterprises lack centralized, real-time metrics spanning the full AI agent lifecycle. While emerging vendor tools address isolated lifecycle stages, Cagulangan contends that fragmented point solutions cannot deliver both compliance and deployment speed. Automating governance through a unified framework addresses these gaps while lowering administrative audit costs. A centralized engine enables governance velocity to match rapid AI adoption, provides a "Single Pane of Glass" (which Cagulangan likens to "Life360 for AI") to track every agent's compliance posture, and establishes strict guardrails so autonomous agents can operate with organizational accountability. It can also serve as a lightweight stop-gap during proof-of-concept phases, allowing teams to deploy safely without waiting for lengthy enterprise procurement cycles. Codifying Rules with Open Policy Agent (3:00) To operationalize this framework, Cagulangan demonstrates a proof-of-concept built on Open Policy Agent (OPA), an open-source, Cloud Native Computing Foundation (CNCF) graduated project. OPA uses a declarative language called Rego to translate business, legal, and technical requirements into computable conditions mapped directly to the NIST AI Risk Management Framework (AI RMF). In this architecture, policies are managed entirely as code—version-controlled, peer-reviewed, and tested within CI/CD pipelines. Rather than replacing existing security tools, OPA decouples central policy decisioning from execution. OPA evaluates incoming API payloads to render an allow or deny decision, while integrated downstream stack components enforce the outcome via REST APIs. An executive telemetry console tracks population health in real time, flagging passed evaluations in green, incomplete API payloads in yellow, and blocked executions in red. Cagulangan compares this layered oversight to airport security, where distinct checkpoints—from ID verification and baggage screening to federal air marshals—collectively secure the system. Enforcing Controls Across Eight Lifecycle Gates (6:25) Cagulangan's target state architecture structures governance into eight sequential gates that every AI solution must pass. The pre-deployment phase begins at Gate 1 (Inventory & Profile), which logs risk classifications and business context in registries like ServiceNow AI Control Tower or Credo AI, followed by Gate 2 (Build & Architecture), which checks stack metadata, dependencies, and cloud services. Gate 3 (Identity & Tools) validates role-based access controls, sanctioned models, and Model Context Protocol (MCP) servers using tools like Microsoft Entra, Okta, or Palantir Foundry. Gate 4 (Data Governance) enforces data hygiene and classification via platforms like Microsoft Purview, while Gate 5 (Approve & Deploy) verifies MLflow registration and security test results before production release. Post-deployment governance shifts to active protection. Gate 6 (Runtime Operations) monitors active requests, rate limits, and behavioral boundaries alongside tools like Kong API Gateway and Zscaler AI Guard. Gate 7 (Observability & Telemetry) uses platforms such as LangSmith and Microsoft Sentinel to watch for model drift, bias, and execution exceptions. Finally, Gate 8 (Contain & Respond) triggers automated incident response protocols and kill switches when an agent breaches safety boundaries. Fail-Close Redundancy During Infrastructure Outages (13:32) Beyond unifying visibility, OPA provides defense-in-depth by acting as a fail-close backup engine when primary vendor gateways fail. Cagulangan illustrates this redundancy through a threat scenario involving "Kimmy K3," an unauthorized foundation model lacking legal or security clearance for general availability. In the simulation, an AI agent attempts to invoke the blacklisted Kimmy K3 model via RPC just as the primary AI Gateway suffers an infrastructure outage. Operating as a redundant control at Gate 6, OPA intercepts the request and defaults to a fail-close decision because the primary gateway is offline and the model is unapproved. OPA then signals Zscaler to block the traffic at the perimeter firewall, alerts the Security Operations Center, and triggers a governance review—effectively quarantining the agent and preventing legal or privacy exposure during a vendor outage. Cagulangan concludes that while executives demand rapid financial and operational returns from AI, those gains depend on robust runtime safety. At CSX, AI governance is treated not merely as a technology or security concern, but as a core business, safety, and financial imperative designed to help the company remain the safest, most efficient, and most resilient railroad in North America.

精炼阅读摘要

CSX人工智能治理技术总监Marc Cagulangan提出，企业应将静态的合规文件转变为“策略即代码”（AI Governance-as-Code）体系，利用开源规则引擎Open Policy Agent（OPA）在AI全生命周期设立可执行的自动化检查关卡。影子AI隐患与自动化治理价值 (1:51) 在企业加速引入人工智能的背景下，“影子AI”使得组织面临无法管控不可见资产的运营瓶颈。当前企业普遍欠缺覆盖AI智能体全生命周期的集中、实时且集成化的指标度量，不同商业产品往往只能割裂地解决局部环节。Cagulangan指出，自动化治理不仅能使治理节奏匹配业务落地的速度，还能在部署后持续提供运行时防护，让自主型智能体在严格的护栏内工作，并以自动化控制替代人工审计流程，降低企业的行政开支与合规负担。采用OPA引擎与类比机场安检架构 (3:00) Open Policy Agent（OPA）属于云原生计算基金会（CNCF）的毕业项目，能够使用声明式策略语言Rego把商业、法律和技术合规要求编译为动态可执行的判定逻辑。Cagulangan将OPA的运行逻辑类比为机场安检体系：登记与身份核实相当于出示护照，数据清洗与治理相当于行李安检，角色权限校验对应登机牌核对，运行时护栏好比监控与空中乘警，而全面的风险管理则类似于宏观指挥中心。包括Anthropic、Netflix、Google、Capital One和Goldman Sachs在内的机构已采用类似框架作为事实上的策略执行引擎。覆盖AI全流程的八道顺序管控关卡 (6:25) CSX的目标架构将AI生命周期划分为八个必须依次通过的代码化治理关卡，策略均支持版本控制与持续集成测试：关卡1（资产与画像）核验智能体在企业目录中的注册信息与风险评级；关卡2（构建与架构）评估技术栈元数据、依赖库安全及授权云服务；关卡3（身份与工具）确认RBAC权限、核准的模型与工具集成；关卡4（数据治理）把控数据分类与匿名化；关卡5（批准与部署）核查预发布环境与测试集；关卡6（运行时操作）监管API速率与行为边界；关卡7（可观测性）监测模型漂移与偏差；关卡8（遏制与响应）负责在越界时触发自动化阻断与应急隔离。实施模式与黑名单模型阻断案例 (7:44) 针对自建与采购的技术选型，OPA提供了多重落地形态：它既可作为主网关宕机时的“故障闭合”（Fail-Close）纵深防御备份，也能充当汇总八道关卡状态的“单一玻璃视窗”，或在采购完成前充当轻量级应急引擎。在演示案例中，某智能体试图调用未通过法务与安全审批的黑名单模型“Kimmy K3”，同时主AI网关发生故障；作为关卡6备份的OPA随即触发故障闭合，拦截RPC请求，并调度Zscaler执行防火墙封锁，同时向安全运营中心（SOC）发出警报并启动审计，成功遏制了未经许可的调用风险。代码实现映射与状态监控看板 (16:00) 在代码实践中，各关卡的Rego策略文件被直接映射至NIST人工智能风险管理框架（NIST AI RMF），企业可根据边缘场景修改规则。架构将核心“决策判定”（通过或拒绝）与底层API执行解耦，下游组件仅接收决策结果并执行动作。在配套的监控控制台上，智能体状态通过三色指示灯呈现：绿色代表通过评估；黄色代表API载荷数据不全而无法做出判断；红色则代表触发明确的策略违规并执行阻断拦截。 Cagulangan总结称，AI治理不仅是技术与安全层面的合规动作，更是直接关乎商业变现与运营底线的企业核心任务；通过代码化与自动化机制，组织能够在确保安全护栏完备的前提下释放AI投资价值。

Detailed notes — zh

## Background 该视频由 YouTube 频道 Ai4 于 2026 年 8 月 18 日发布，内容为北美货运铁路巨头 CSX 技术总监 Marc Cagulangan 的主题演讲。根据页面简介，演讲聚焦于“AI 治理即代码（AI Governance as Code）”理念，探讨如何将风险、合规与安全控制直接嵌入 CI/CD 流水线、运行时环境与智能体工作流中，从而替代传统的静态策略文档，实现自动化、可审计且可扩展的实时 AI 治理。 ## TL;DR Marc Cagulangan 结合开发者、IT 审计师与安全官的多重视角，提出了基于开源 OPA（Open Policy Agent）与 Rego 语言构建的可执行 AI 治理架构。他通过生动的机场安检（TSA）类比，系统性拆解了贯穿 AI 全生命周期的八大顺序治理关卡，覆盖资产盘点、身份鉴权、数据治理、运行时监控及安全熔断等环节。针对 AI 网关失效等极端场景，演讲展示了如何依托“故障关闭（Fail-Close）”与 OPA 冗余控制联动安全设备拦截影子 AI 流量。通过将治理策略转化为自动化代码与可观测度量看板，该方案在大幅降低人工合规开销的同时，为企业稳妥变现 AI 商业价值筑牢了安全防线。 ## Atmosphere & style 整场演讲呈现出专业务实、兼具工程师极客精神与严谨审计思维的分享氛围。讲者以“绝不藏私”的坦诚态度开场，巧妙运用机场安检打比方并幽默调侃云厂商的高可用承诺，使晦涩枯燥的合规与风控议题变得生动直观。演讲节奏明快、落地导向极强，不仅有高维度的商业与合规愿景，更有细致的代码实现与故障拦截演示，让观众切实感受到策略从纸面条文蜕变为活态工程防护的坚实力量。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=4s) Marc Cagulangan 提出“以代码实现 AI 治理（AI Governance as Code）”理念，倡导利用开源 OPA（Open Policy Agent）将合规与安全要求转化为可自动执行的代码策略。 - [01:51](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=111s) 当前 AI 治理的最大痛点在于“影子 AI（Shadow AI）”以及缺乏跨 AI Agent 全生命周期的集中化、实时深度集成监控体系。 - [01:51](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=111s) 将治理直接嵌入技术栈可为企业带来可扩展治理、运行时持续保护、高自主度下的智能体问责以及降低人工审查运营成本等核心商业价值。 - [03:06](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=186s) OPA 结合声明式策略语言 Rego 作为中央决策核心，在 AI 智能体开发和运行生命周期的各阶段自动执行准入策略检查（Gate Checks）。 - [04:07](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=247s) 引入机场 TSA 安检类比 AI 治理：从身份凭据核验、数据行李安检，到 OPA 终审关卡，再到生产环境下的网关可观测性与空警巡视式实时干预。 - [06:25](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=385s) AI 开发生命周期的八大顺序治理关卡（8 Governance Gates）将策略作为代码管理，具备版本控制、同行评审与可审计性，彻底取代纸面审批流程。 - [06:25](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=385s) 自建 OPA 可作为商业现成方案的冗余兜底防线（Defense-in-Depth）、全量智能体轨迹的统一全局视图，或快速上线期的临时防护过渡手段。 - [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) 治理关卡覆盖前期的资产画像（Gate 1）、构建可行性（Gate 2）与智能体身份权限（Gate 3），确保架构合规与访问控制到位。 - [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) 生命周期中段实施严格的数据治理（Gate 4）与部署审批（Gate 5），包括数据脱敏、MLflow 注册与自动化安全测试验证。 - [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) 运行时关卡聚焦操作行为边界（Gate 6）、漂移与偏见的持续遥测（Gate 7），以及包含一键熔断（Kill Switch）在内的遏制响应机制（Gate 8）。 - [13:40](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=820s) 系统设计采用“故障关闭（Fail-Close）”机制，当 AI 网关发生宕机或异常时，OPA 能够联动网络防火墙阻断未授权的 RPC 影子 AI 流量。 - [16:09](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=969s) 开发者可基于 NIST AI RMF 框架快速编写各关卡对应的 Rego 策略代码，并通过红、黄、绿状态控制台实现策略健康度全方位可视化遥测。 - [17:47](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=1067s) 代码化 AI 治理是释放企业 AI 财务回报与运营价值的基石，推动治理从被动静态文档审查演进为全自动、高韧性的生产级活态防护体系。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=4s) 讲师背景与“以代码实现 AI 治理”的核心理念 Marc Cagulangan 现任 CSX 技术总监，专注于 AI 治理、IT 审计、网络安全以及风险管理。他的职业生涯跨越了软件开发、IT 审计、网络安全防护等多个领域，如今全面负责企业的 AI 治理体系构建。在开场中，Marc 强调他将分享一套可落地的 AI 治理架构与策略——利用开源的 OPA（Open Policy Agent）将治理与合规要求转化为可执行的代码策略。他向现场观众承诺本次演讲“绝不藏私（there will be no gatekeeping here）”，希望参会者都能借此掌握搭建自主 OPA 策略引擎的方法。 ```mermaid flowchart LR accTitle: Multi-disciplinary perspective on AI governance subgraph Roles ["Marc Cagulangan 的多重专业视角"] Dev["💻 软件开发者 注重构建高价值解决方案"] Auditor["📋 IT 审计师 注重合规性与举证责任"] Sec["🛡️ 网络安全从业者 注重威胁、风险与安全控制"] Gov["🏛️ AI 治理总监 注重 Agent 运行时安全与董事会沟通"] end Dev --> Core["🎯 AI Governance as Code 基于 OPA & Rego 的可执行治理体系"] Auditor --> Core Sec --> Core Gov --> Core ``` 作为开发者，他致力于构建能创造实际业务价值的方案；但作为 IT 审计师，他同样极度重视合规性与“举证责任（burden of proof）”；从安全专家的视角出发，他严密审视 AI 带来的新型威胁与风险控制；而作为 AI 治理总监，他的核心诉求是确保智能体（Agent）和模型在生产运行时的安全性，并能清晰地将安全态势汇报给高管团队与董事会。目前，他正在 CSX 内部推进基于 OPA 的 AI 治理 PoC（概念验证），并欢迎同行在会后或通过 LinkedIn 深入探讨落地经验。 --- ### [01:51](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=111s) 影子 AI 挑战与将治理嵌入技术栈的商业价值谈及当前 AI 治理的最大痛点，Marc 直言首当其冲的就是“影子 AI（Shadow AI）”——“你无法治理你看不到的东西（you can't govern what you can't see）”。然而更深层次的危机在于，企业在整个 AI Agent 的全生命周期中，普遍缺乏集中化、实时且深度集成的度量监控体系。在与多家技术供应商交流后，他意识到业界正处于 AI 落地探索的关键转折期。通过将 AI 治理与安全控制直接嵌入技术栈，企业能够释放出显著的商业价值： - **可扩展的治理（Scalable Governance）：** 治理机制的演进速度能够与企业采用 AI 的步伐保持同频。 - **运行时保护（Runtime Protection）：** AI 不仅在部署上线前受到严格审查，在部署后的实际运行阶段依然处于全程治理之下。 - **智能体治理（Agentic Governance）：** 在赋予 AI 智能体更高自主行动权限的同时，丝毫不牺牲审计问责性（accountability）。 - **降低运营成本（Lower Operating Costs）：** 通过自动化控制大幅削减传统人工合规审查带来的行政管理开销。 --- ### [03:06](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=186s) OPA（Open Policy Agent）与 Rego：自动化策略引擎为了打破静态文档与手工审批的滞后局面，Marc 提出了基于 OPA（Open Policy Agent）的核心解决方案。OPA 是云原生计算基金会（CNCF）旗下的开源项目，是一个集中化、实时的策略与规则决策引擎。它采用专用的声明式策略语言 Rego，能够将复杂的业务规范和技术要求直接转化为计算机可计算、可自动评估与审计的规则条件。在实际架构中，OPA 充当中央决策核心，在 AI 智能体开发生命周期的每一个阶段执行准入检查（Gate Checks）。Marc 指出，AI 策略代码化并非空中楼阁，目前业界头部企业已广泛采用：Anthropic 利用其“负责任扩展策略（Responsible Scaling Policy）”进行内部合规审查；Netflix、Google、Capital One 以及高盛（Goldman Sachs）均已将 OPA 作为事实上的策略执行标准工具。 --- ### [04:07](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=247s) 机场安检（TSA）类比：AI Agent 的多重准入检查点为了让大家更直观地理解这套架构，Marc 引入了拉斯维加斯机场 TSA（美国运输安全管理局）安检的生动类比：在现代企业环境中，AI Agent 就好比准备登机的旅客，在登上飞往生产环境的“航班”之前，必须向终审检查官证明自己已经符合一切安全指标。 ```mermaid flowchart TD accTitle: TSA Airport Security Analogy for AI Governance subgraph AirportAnalogy ["TSA 机场安检类比"] ID["🪪 身份证明（驾照） 验证 Agent 注册与权限"] Bag["🧳 行李安检 数据治理与合规清洗"] TSA["👮 TSA 终审道口 (OPA) 全生命周期自动化准入把关"] Flight["✈️ 登机飞行 / 生产运行时 闭路监控 & 空警巡视（可观测性与网关）"] end ID --> Bag --> TSA --> Flight ``` 在真实的技术栈中，每一个安检环节都有对应的工具与系统协同运作： - **身份核验（相当于出示驾照）：** 对应 Agent 注册与身份体系，如 ServiceNow AI Control Tower、Microsoft Entra 以及 Kong 等正在推进的 Agent 身份方案。 - **行李托运检查（相当于违禁品排查）：** 对应数据治理环节，借助 Microsoft Purview 或 HCL 等工具确保数据分类与合规。 - **智能体构建环境：** 涵盖 Microsoft Azure AI Foundry、Palantir 等主流开发平台。 - **终审安检门：** 由 OPA 统一执行准入策略裁决。 - **登机后的机舱监控与联邦空警（Federal Air Marshal）：** 进入生产环境后，依靠 CCTV 般的全天候可观测性（如 Reva、LangSmith）以及 MCP/AI 网关（如 Kong、Zscaler）实施严格的运行时监控与干预。 - **全局治理中枢（相当于国土安全部与 TSA 总部）：** 类似 Credo AI 等平台提供的顶层合规管理。 --- ### [06:25](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=385s) 目标架构：AI 开发生命周期的八大顺序治理关卡 Marc 展示了整场演讲的核心架构蓝图——AI 开发生命周期的八大顺序治理关卡。所有 AI 解决方案在迈向生产环境时，都必须自动通过由 OPA 强制执行的流水线检查点。这一模式彻底取代了以往依靠静态流程文档和人工签字盖章的传统方式，实现了“以代码定义策略（Policy-as-Code）”的闭环。 ```mermaid flowchart LR accTitle: Eight Sequential Governance Gates for AI Lifecycle subgraph Planning ["1. 规划与架构"] G1["Gate 1: 资产盘点 Inventory & Profile"] G2["Gate 2: 构建可行性 Build Viability"] end subgraph Development ["2. 研发与部署"] G3["Gate 3: 智能体身份 Agent Identity & RBAC"] G4["Gate 4: 数据治理 Data Governance"] G5["Gate 5: 审批与发布 Approve & Deploy"] end subgraph Runtime ["3. 运行与安全防护"] G6["Gate 6: 运行时操作 Runtime Operations"] G7["Gate 7: 持续遥测 Continuous Telemetry"] G8["Gate 8: 遏制与响应 Contain & Respond"] end G1 --> G2 --> G3 --> G4 --> G5 --> G6 --> G7 --> G8 ``` 所有策略均作为代码进行管理，具备完整的版本控制、同行评审（Peer Review）、发布前测试以及全生命周期可审计特性。针对企业“自研（Build）还是采购（Buy）”的考量，Marc 提出了 OPA 的三大自研与组合应用场景： 1. **深度防御与冗余备份（Redundant Defense-in-Depth）：** 商业现成软件（COTS）虽然成熟且无需重复造轮子，但在发生系统故障或遇到企业特有的边缘情况时，自建 OPA 能够提供额外的兜底防线。 2. **全局统一视图（Single Pane of Glass）：** 充当掌握所有 AI Agent 实时轨迹的“数字家庭定位器”，Marc 形象地将其称为“AI 智能体的 Life360”。 3. **PoC 快速过渡方案（Stop Gap）：** 在 AI 采纳初期，面对快速上线的合规压力，OPA 可以迅速作为轻量级的过渡防线建立安全保障。 --- ### [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) 逐层拆解八大治理关卡：从资产盘点到安全熔断 Marc 逐一剖析了八大治理关卡的核心职能、核心提问、评估指标以及相关生态工具： ```mermaid flowchart TD accTitle: Detailed breakdown of the 8 AI Governance Gates subgraph PrepPhase ["准备与设计阶段"] G1["Gate 1 (蓝): 资产盘点 核心问题: 我们在构建什么? 评估: 注册状态、业务上下文、风险分级、系统记录"] G2["Gate 2 (紫): 架构构建 核心问题: 架构是否具备可行性? 评估: 兼容性、依赖项、核准服务、数据源"] end subgraph ImplPhase ["实施与准入阶段"] G3["Gate 3 (灰): 智能体准入 核心问题: 谁在执行任务? 评估: RBAC、核准模型、工具集、MCP 集成"] G4["Gate 4 (黄): 数据治理 核心问题: 允许访问哪些数据? 评估: 数据分类、匿名化、数据卫生、版本控制"] G5["Gate 5 (红): 审批与部署 核心问题: 能否获准上线? 评估: 预发布签名、MLflow 注册、模型版本、安全测试"] end subgraph OpsPhase ["运维与防御阶段"] G6["Gate 6 (橙): 运行时操作 核心问题: 能否安全运行? 评估: 行为边界、速率限制、响应阈值、核准模型使用"] G7["Gate 7 (黑): 持续可观测 核心问题: 生产行为是否正常? 评估: 漂移检测、偏见监控、异常追踪"] G8["Gate 8 (青): 遏制与响应 核心问题: 出现风险如何处置? 评估: 模型风险触发器、自动化应急响应、Kill Switch 熔断"] end G1 --> G2 --> G3 --> G4 --> G5 --> G6 --> G7 --> G8 ``` - **Gate 1：资产盘点与画像（Inventory and Profile - 蓝色）** - **核心问题：** “我们在构建什么？（What are we building?）” - **评估内容：** 强制要求所有 AI Agent 进行治理注册，评估 AI 画像标识符、业务上下文背景、风险分级以及记录系统（System of Record）。 - **生态工具：** Credo AI、Trustible、ServiceNow AI Control Tower。 - **Gate 2：构建可行性（Build - 紫色）** - **核心问题：** “它是否具备构建可行性？（Can it be built?）” - **评估内容：** 证明架构合理性，评估技术栈元数据的兼容性、依赖关系、核准服务清单与数据源接入规范。 - **Gate 3：智能体身份与权限（Agent Profile - 对应主体）** - **核心问题：** “谁在执行工作任务？（Who is doing the work?）” - **评估内容：** 验证 Agent 自身合法性，涵盖基于角色的访问控制（RBAC）、核准使用的基础模型、授权工具集以及 MCP（模型上下文协议）集成情况。 - **生态工具：** Microsoft Entra、Okta、Power Platform、Azure AI Foundry、Palantir。 - **Gate 4：数据治理（Data Governance - 黄色）** - **核心问题：** “它能够访问哪些数据？（What data can it access?）” - **评估内容：** 验证数据资产的分类级别、匿名化脱敏处理、数据卫生状况与版本控制。 - **生态工具：** Microsoft Purview、HCL。 - **Gate 5：审批与部署（Approve and Deploy - 红色）** - **核心问题：** “它是否符合上线发布条件？（Can it be deployed?）” - **评估内容：** 验证部署授权、核准的模型版本、预发布（Staging）环境签名、MLflow 注册记录及正式上线审批；支持集成自动化测试套件进行细粒度的 AI 安全与 UAT 测试。 - **Gate 6：运行时操作（Runtime Operations - 橙色）** - **核心问题：** “它能否安全稳定地运行？（Can it safely operate?）” - **评估内容：** 检查核准模型的使用合规性、响应阈值、API 调用速率限制（Rate Limits）以及预设的行为边界。 - **生态工具：** Kong、Reva、Trust Gateway、Zscaler、AI Guard、Microsoft MCP。 - **Gate 7：持续可观测与遥测（Continuous Telemetry - 黑色）** - **核心问题：** “它在生产环境中的行为是否符合预期？（Is it behaving correctly in production?）” - **评估内容：** 实时监控模型输出，开展漂移检测（Drift Detection）、偏见监控（Bias Monitoring）以及异常错误追踪。 - **生态工具：** LangSmith、Microsoft Sentinel。 - **Gate 8：遏制与响应（Contain and Respond - 青色）** - **核心问题：** “遭遇异常威胁时如何快速处置？” - **评估内容：** 实施端到端安全防御，包括模型风险触发器判定、自动化事件应急响应、异常升级上报，以及在必要时刻一键执行的紧急关停熔断机制（Kill Switch）。 - **生态工具：** Reva、Zscaler、Kong。在阐述完八大关卡的理论体系后，Marc 随即切入具体的实战演练场景，以演示如何拦截并处置未经授权的模型调用（例如未准入的 Kimi K3 违规访问案例）。 ### [13:40](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=820s) OPA 冗余控制与 AI 网关故障时的故障关闭机制在模型尚未通过法务与安全审查以供正式公开发布（GA）的情况下，企业必须引入 OPA（Open Policy Agent）作为冗余控制措施。考虑到智能体（Agent）模型准确性的敏感度以及 AI 网关的关键性，系统在架构设计上采用了“故障关闭（Fail-Close）”机制。OPA 的职责不仅在于检测 AI 智能体的存在，更在于充当网关服务中断时的缓解控制手段，确保模型完整性不被破坏。讲者幽默地调侃道，尽管像 Kong 这样的服务商声称基于 Kubernetes 构建且具备极高韧性，但在当前的系统可靠性环境下，甚至连“5 个 9”（99.999%）的可用性都难得一见，因此绝不能盲目相信“永无宕机”的承诺。在模拟的真实故障场景中，网关在处理尚未获批的 Kimi K3 模型请求时突发服务中断。OPA 在对 Gate 6（运行时运维）进行评估时迅速介入，作为缓解措施将该请求判定为“未授权模型事件”。为了防止未经审查的 Shadow AI 流量在网关失效期间穿透，OPA 立即向网络安全防护层（Zscaler）下发信号，激活防火墙的黑名单安全规则，全面阻断黑名单 AI 流量。 ```mermaid flowchart TD accTitle: AI网关故障时的OPA冗余防护与故障关闭流程 subgraph Client["调用方"] Agent["AI 智能体\n(尝试调用未获批模型)"] end subgraph Inspection["网关与评估层"] Gateway["AI 网关 (Kong)\n(发生服务中断)"] OPA["OPA 策略引擎\n(评估 Gate 6 运行时)"] end subgraph Remediation["拦截与响应"] FailClose["触发 Fail-Close\n判定为未授权事件"] Zscaler["Zscaler 防火墙\n(启用 AI 黑名单规则)"] SOC["通知 SOC & 启动治理审查\n(智能体隔离)"] end Agent --> Gateway Gateway -.->|宕机/异常| OPA OPA --> FailClose FailClose --> Zscaler Zscaler --> SOC ``` - **威胁防御模型**：成功拦截并纠正了在 AI 网关宕机窗口期利用 RPC 协议渗入的“影子 AI（Shadow AI over RPC）”风险。 - **治理与合规闭环**：阻断未授权流量的同时，系统自动通知安全运营中心（SOC）并启动 AI 治理审查流程，将违规智能体彻底隔离，从而保障了系统符合法律、安全、隐私与运营风险的基线要求。 --- ### [16:09](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=969s) 策略即代码的工程实现与监控度量控制台讲者通过实际代码演示了如何将治理框架落地为可执行代码。在 VS Code 环境中，开发者引入 OPA 规则库后，可基于美国国家标准与技术研究院的 AI 风险管理框架（NIST AI RMF）快速生成与各道关卡（Gates）一一对应的策略集，并根据企业特定的业务边缘场景进行定制化扩展。这种架构下，决策逻辑完全交由 OPA 规则引擎在后端通过 API 管道与整体技术栈集成，而具体的拦截与防护动作则由下游集成的系统负责执行。针对运行态的可观测性，讲者强调了度量对于管理的关键价值：“如果你无法度量，你就无法管理（If you're not metricing, you're not managing）。”现场展示的策略控制台能够对整个 AI 智能体集群在各检查关卡的健康状况进行全方位遥测与可视化看板呈现。 ```mermaid flowchart LR accTitle: OPA 状态看板状态图 A["API 请求接入"] --> B{策略检查状态} B -->|绿灯 / Pass| C["通过验证正常执行"] B -->|黄灯 / Warning| D["API GET 请求信息缺失，不足以决断"] B -->|红灯 / Deny| E["策略违规，直接拦截"] ``` - **绿色指示（Pass）**：代表智能体请求完全合规，顺利通过各检查关卡。 - **黄色指示（Warning）**：通常表示传入的 API GET 请求缺少充分的元数据信息，导致策略引擎无法做出确定性判决。 - **红色指示（Deny）**：代表触发合规红线或安全策略违规，系统直接予以拒绝。 --- ### [17:47](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=1067s) 赋能业务价值：CSX 的代码化 AI 治理愿景在总结发言中，讲者指出了企业当前面临的核心矛盾：CEO 们期望迅速看到 AI 在运营与财务层面的全额回报，但唯有通过严密的 AI 治理与安全保障，这些商业回报才能真正稳妥变现。借助 OPA 实现“AI 治理即代码（AI Governance as Code）”，能够将原本停留在纸面上的静态政策文档转化为在技术栈中全自动执行、可审计的活态防护体系。对于北美货运铁路巨头 CSX 而言，AI 治理早已超越了单纯的技术或网络安全范畴，上升为事关企业安全、商业回报与财务稳健的核心要务。该治理架构的最终目标，是助力 CSX 不仅成为北美运营最佳的铁路公司，更成为最具韧性、最安全与最高效的铁路运输服务商。 - **核心范式转变**：从被动的合规文档审查，转向嵌入 CI/CD 与运行时的动态可执行代码防护。 - **商业驱动战略**：将安全与合规转化为释放 AI 生产力与财务价值的保障杠杆。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=4s) there will be no gatekeeping here — Marc Cagulangan > [01:51](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=111s) you can't govern what you can't see — Marc Cagulangan > [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) What are we building? — Marc Cagulangan > [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) Can it be built? — Marc Cagulangan > [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) Who is doing the work? — Marc Cagulangan > [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) What data can it access? — Marc Cagulangan > [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) Can it be deployed? — Marc Cagulangan > [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) Can it safely operate? — Marc Cagulangan > [09:11](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=551s) Is it behaving correctly in production? — Marc Cagulangan > [16:09](https://www.youtube.com/watch?v=g0zqHEOr2DM&t=969s) If you're not metricing, you're not managing — Marc Cagulangan ## Mentioned Marc Cagulangan, CSX, OPA (Open Policy Agent), Rego, CNCF (Cloud Native Computing Foundation), TSA (Transportation Security Administration), Anthropic, Responsible Scaling Policy, Netflix, Google, Capital One, Goldman Sachs, ServiceNow AI Control Tower, Microsoft Entra, Microsoft Purview, Microsoft Azure AI Foundry, Palantir, Kong, Zscaler, Reva, LangSmith, Credo AI, Trustible, Okta, Power Platform, HCL, MLflow, Microsoft Sentinel, NIST AI RMF, Kimi K3, Life360, MCP (Model Context Protocol) ## Video description Marc Cagulangan - Technical Director, CSX What if your governance policies could execute themselves—directly enforcing control at every layer of your technology stack? As organizations scale AI and automation, traditional governance models struggle to keep pace, creating gaps between policy, execution, and auditability. In this session I will discuss how to embed governance directly into CI/CD pipelines, runtime environments, and agent workflows using a “AI Governance-as Code” approach. Attendees will learn how to translate risk, compliance, and security requirements into enforceable controls that operate in real time across modern AI systems. They will also see how this model improves audit readiness, reduces operational risk, and enables scalable oversight. Join this session to move from static policy documents to living, executable governance that scales with your technology. [Source](https://www.youtube.com/watch?v=g0zqHEOr2DM)

Source quotes

[0:04] Marc Cagulangan: there will be no gatekeeping here [1:51] Marc Cagulangan: you can't govern what you can't see [9:11] Marc Cagulangan: What are we building? [9:11] Marc Cagulangan: Can it be built? [9:11] Marc Cagulangan: Who is doing the work? [9:11] Marc Cagulangan: What data can it access? [9:11] Marc Cagulangan: Can it be deployed? [9:11] Marc Cagulangan: Can it safely operate? [9:11] Marc Cagulangan: Is it behaving correctly in production? [16:09] Marc Cagulangan: If you're not metricing, you're not managing

Source quotes

[1:51] Marc Cagulangan: you can't govern what you can't see [13:32] Marc Cagulangan: In this case, the AI agent was essentially quarantined and denied traffic [17:47] Marc Cagulangan: At CSX, we are envisioning an AI governance program where it is no longer just a security and technology concern—there's a business, safety, and financial imperative

Original transcript

[0:04] Good afternoon. Uh my name is Mark Hagen. I am a technical director specializing in AI governance, [0:11] IT, cyber security, risk management at CSX. My background is software development, IT audit, [0:18] cyber security and now AI governance. Today we will discuss an AI governance pattern [0:25] uh AI strategy on how to operationalize AI governance and compliance as an enforceable [0:31] policy using OPA open policy agent. I'll get into very much detail on that. It's open source. I'll [0:38] show you the coding project. Uh there will be no gatekeeping here. You will hopefully walk away and [0:44] create your own uh OPA policy engine from this uh as a developer. I'm all about building solutions [0:52] that provide value, but then as an IT auditor, I care about compliance and burden of proof. Um, [1:00] I also as a cyber security practitioner, I care about AI security, threats, risks, and controls. [1:08] And now as an AI governance director, I care deeply about the safety of agents and models [1:15] in runtime and messaging that to the executives in the board. Today we're going to talk about all of [1:23] that and as I said there will be no gatekeeping. So you'll learn a lot, you'll get a lot of value. [1:28] uh if you're thinking about how this applies to your business and and audit cycle for yourself, [1:34] I'm developing an AI governance PC OPA and um you know talk to me afterwards if you'd [1:42] like to connect and we or you can connect on LinkedIn. So uh without further ado, [1:51] uh I'm going to skip through these next ones. Uh the challenge is everyone knows [1:54] a major challenge shadow AI, right? you can't govern what you can't see. But even more so as [2:00] I get into this conversation, uh there's a lack of uh centralized real time integrated [2:07] metrics over the entire AI agent and its life cycle. Um I hear that resonating through all [2:14] these speeches. I've met with many vendors um that have solutions up and coming. So [2:20] I think we're at an interesting space in our AI journey. So I'd like to talk further about that. [2:27] uh business value just to touch on a couple here. Scalable governance obviously governance scales [2:33] at the same speed as AI adoption right um runtime protection AI remains governed after deployment [2:42] not just before it. Uh agentic governance means agents can gain autonomy without sacrificing [2:50] accountability and then obviously lower operating costs. automated controls to reduce administrative [2:57] overhead. Let's get into the real um meat of this. It's OPA, open policy agent. If you've not heard [3:06] of OPA, OPA is a real time centralized policy or rules decision engine written in Rego. It's a the [3:14] policy language. It is a cloudnative computing foundation open- source project. And there's the [3:21] QR code if you'd like to download the libraries and develop. That's what I ended up doing. Uh, [3:27] Rego uses rules as a way to codify business and technology requirements into computable [3:32] conditions subject to review and inspection. So in essence, OPA is going to centrally sit [3:39] and perform governance gate checks over an AI agent at each stage of the AI development life [3:45] cycle. AI policy is not new. AI policy enforcement is in active use today. Uh, [3:54] Anthropic uses responsible scaling policy for internal compliance and Netflix, [3:59] Google, Capital One, Goldman Sachs are using OPA as a deacto enforcement. [4:07] Uh, this next slide uh is providing you a TSA analogy to kind of drive it home. So, [4:13] think of this. AI agents are like passengers on a plane. You have to prove to the final [4:19] TSA inspector that you're ready to fly. AI agents in the same manner are subject to multiple gated [4:26] checks before entering production. OPA, the open policy agent, is verifying multiple checkpoints [4:33] just like the multiple TSA checkpoints you were inspected at to arrive here in Vegas. [4:40] Um so for example prove your identity like a driver's license. Prove data governance like [4:46] bag check. Uh prove runtime behavior and observability like security surveillance [4:54] uh by your federal air marshall and proof of AI governance like DHS and TSA. I have mentioned some [5:01] vendors here in this space because again uh we can't talk about uh governance in the tech stack [5:06] without talking about the tech stack. So as you'll see here when it comes to identity um and registry [5:14] service now has a control tower uh identity for AI agents. Entra though I've talked to Kong and they [5:24] are working on that solution as well. um when it comes to baggage check purview for data governance [5:32] um about agent creation you know there's many vendors in that space as well we'll talk about [5:37] foundry if you're on Microsoft Palunteer uh there goes there sits TSA there and that OPA open policy [5:43] agent uh as that final TSA inspection before you go to prod get on that plane you're going [5:49] to be observed through CCTV federal air marshals we're going to have tight security and oversight [5:55] um for any issues that might occur. Um, Reva is a good um, uh, vendor in that space in terms of [6:02] observability. Uh, we also talk about AI gateway. We'll talk about the AI gateway. MCP gateways is [6:08] also critical. Uh, Kong is also a very good vendor in that space from when I've talked with that [6:13] team. So, um, and then that's the overarchingly, you know, from a TSA and headquarters, Credo [6:18] is doing a great job in that space as well. So, this is what I really want us to focus on today. [6:25] This view is the target state diagram for the AI development life cycle. Eight sequential [6:32] governance gates that every AI solution must pass through enforced automatically by OPA, [6:39] open policy agent. So if there's anything you'd take away from this talk, it's this visual right [6:46] here. Think of this as the pipeline with mandatory checkpoints just like the TSA. [6:55] This is a shift from static policy and manual governance to a centralized gated [7:00] rule decisioning that enforces AI governance and security. Um the prior talk did talk about [7:07] policy orchestration. This is um talking along those same lines. Now it's the materialization [7:13] or realization of that talk. This is where we get to enforce AI governance and secured at each step [7:19] of the AI development life cycle. So essent in essence how it works each gate is a rule evaluated [7:26] uh based on input data from the AI agent allowing allow and deny decisions policies are treated [7:33] as code where they are version controlled peer reviewviewed tested before release and [7:38] auditable through the life cycle now there's many implementation use cases for OPA um again there's [7:46] a lot of buy builder buy signals here the majority of the vendors that we see in the life cycle of [7:52] AI are by and you've probably met a lot of them in the exhibit but there are use cases for build [7:59] uh we'll go over that right now OPA as a build can serve as a redundant defense and depth to [8:05] existing critical solutions uh for anything you buy commoditized off the shelf like those [8:10] vendors I just mentioned they're all commodity why reinvent the wheel they're already proven they're [8:15] industry accepted buy right however if you want to customize certain edge cases for your business. [8:22] You want to have redundancy in the event of an outage. You can have an OPA policy agent [8:28] that can provide you um that assurance. OPA can also provide a single pane of glass over AI agent [8:36] presence at each of the checkpoints. Think of this as the AI agents life 360 as I like to call it. [8:43] Uh and then lastly, uh OPA can serve and be stood up as a stop gap as you're maybe doing proof of [8:50] concept. Uh we're so early in the development of the life cycle and the adoption. Um if you nearly [8:58] uh if you need have need to quickly and speedily uh go to production and you need assurance [9:05] potentially OPA might be a a path for you. So let's talk about each stage. Gate one, this is [9:11] where the agents are being evaluated for inventory and profile in blue. Basically, we're answering [9:19] the question, what are we building at this rule gate? All AI agents must prove registration uh for [9:28] governance and evaluate AI profile identifiers, business uh context and risk classification and [9:35] systems of record. some vendors in the space like I mentioned Krato trustable service now AI control [9:42] tower um so there's possibility for a hybrid both a buy and build scenario there gates two [9:50] through six are bundled rules and evaluations over AI agent development AI data governance [10:00] deployment AI and MCP gateways so let's talk about gate 2 build in purple can it be built [10:08] At this rule gate, AI agents proved architectural viability. We'll evaluate um stack metadata for [10:17] compatibility, dependencies, approved services, data sources. The activity here is architectural [10:23] review, stack compatibility, and AI profile. Moving on to gate three, the agent will then [10:31] uh proceed to determine who is doing the work, the agent itself. So at this rule gate AI agents [10:38] have to prove the agent itself. You'll be it'll be evaluated on role-based security sanctioned [10:44] models tools and MCP integrations vendors in this space entra octa power platform Azure uh Azure [10:53] AI foundry palunteer um and so forth. Uh if if passing upon that gate the next gate will be gate [11:01] four data governance in yellow. What data can it access? At this rule gate, AI agents prove AI data [11:09] governance. It'll be evaluated on classification, anonymization, hygiene, and version control. [11:16] Vendors in the space are purview potentially HCL. If upon passing that gate, they go to gate five, [11:24] approve and deploy in red. The answer here, the question here is can it be deployed at this rule [11:32] gate? AI agents prove deployment authorization. They get evaluated on approved model versions, [11:38] staging environments, sign off, ML flow registration, and formal deployment approval. [11:45] Um there's also opportunity for UAT of AI um uh security testing. Uh I was doing some research [11:53] here. uh dev build might be an opportunity for a test harness that you can integrate an API with to [11:59] get gain assurance over uh fine grain AI security scenarios um for evaluation. Upon passing that [12:08] gate, you go to the orange gate, which is gate six, runtime operations. Can it safely operate? [12:15] At this rule gate, AI agents and models prove safety. We evaluate sanctioned model usage, [12:21] response thresholds, rate limits and behavioral boundaries. Vendors in this space, Kong, Reva, [12:27] Trust Gateway, Zscaler, AI Guard, Microsoft MCP. And then the last two gates, rule evaluations over [12:36] AI security. So this is a lot of observability. Gate seven here in black is answering is it [12:42] behaving correctly in production. So at this rule gate AI agents are under continuous telemetry [12:48] evaluating drift detection bias monitoring and exception tracking vendors in this space [12:55] Langmith Sentinel. Then lastly gate 8 contain and respond and teal. At this gate, AI agents [13:05] are subject to security measures, evaluating model risk, triggers, automating incident response and [13:14] anomaly escalation or even the kill switch if needed. Vendors in the space again, Reva, [13:20] Zcaler, I believe Kong now after meeting with them uh are vendors that can provide services at gay 8. [13:32] So let's drive this home with a uh use case. So an unauthorized model Kimmy K3 AI governance [13:40] has not released this model for GA use due to legal and security review. So we're using OPA [13:46] as a redundancy use case given the sensitivity of the models. In a by design redundant use [13:53] case fail close scenario you may choose to build redundancy with OPA due to the sensitive nature [14:00] of agent model accuracy and the criticality of an AI gateway. So OPA is used to not only check [14:06] for AI agent presence but to ensure proper model integrity as a mitigating control in the event [14:13] of an AI gateway service outage. Now, Kong said they're Kubernetes and they're resilient, but hey, [14:19] you know, this day and age of reliability, uh, I don't even see 59s anymore. So, [14:24] I can't even rely on uh the word of no outages. The problem identified OPA uh the AI gateway [14:34] service outage when OPA acted as an mitigating control and detected an attempt to use Kimmy K3. [14:43] Um, OPA evaluated gate 6 runtime operations for an AI agent currently held and inspected [14:49] an AI gateway checkpoint. This AI gateway service had an outage after reporting it. So [14:58] as a mitigating control OPA decision was made to request and treat as an unauthorized model [15:03] event. The action resulted in a fails fail close. However, with the AI gateway having an outage, [15:12] OPA signaled Zcaler to enable firewall scale safe. AI blacklist firewall rule now enabled [15:19] to deny traffic for blacklisted AI traffic, notifying sock and initiating AI governance [15:25] review process. So in this case, AI um the AI agent was in essence quarantine, [15:32] was denied traffic. uh it was detected due to OPA redundancy control as a mitigating factor [15:40] in the event your AI gateway goes down. Takeaway a OPA has detected and corrected shadow AI over RPC [15:48] threat model use at time of AI gateway outage. Thus maintains compliance with approved model [15:54] governance requirements and ensures model security, legal, privacy and operational [16:00] risks are assessed. So let's look at the code. I said I developed the code. Here's the code. [16:09] Here we go. So, as you see here on the left, these are the OPA um policies. This is the uh [16:18] policy engine. Uh they represent each of the gates here. Quite simply, you navigate to the OPA site, [16:26] download the library, pull it into VS Code, you vibe on NIST AI RMF, you'll generate u a list [16:36] of policies that align to the NIST framework. You can even customize them to your business use case [16:42] edges. Um now this this is not live this is PC but in essence you now have a backend that is piped [16:52] out for API integration with your stack uh to where the decisioning comes into the rule engine [16:59] but the enforcement the action taken is in your downstream or your integrated stack solution. And [17:06] then of course what's uh an engine without metrics because if in my opinion if you're not metricing [17:13] you're not managing. Here I'm demonstrating a policy console to give you uh telemetry and [17:19] a dashboard of what your the health of your AI agent population is against the multiple gated [17:29] uh checkpoints as seen here. Green indicates a pass. Yellow indicates more or less lack of the [17:39] API get uh request having enough information to make a proper decision. Uh red indicates deny. So [17:47] in summary, I want to thank everyone here. Uh the key takeaway CEOs want immediate and full return [17:54] on AI in the operation and financials but need AI governance and security to realize those returns. [18:04] AI governance as code through OPA transforms AI from policy document to effective and auditable [18:10] programs. At CSX, we are envisioning an AI governance program where it is no longer [18:18] a security and technology concern. There's a business and safety and financial imperative. Our [18:26] CSX railroad goal is to not only be the bestrun railroad in all of North America, but to be the [18:34] safest, efficient, and most resilient, all while providing best-in-class service and delivery to [18:43] our customers. I appreciate the opportunity to share this perspective and happy to connect. [18:49] Please scan the QR code if you would like to know more, need help or guidance, or would like to stay [18:55] connected on an OPA journey together to improve AI governance in the tech stack. Thank you.