Meta Deploys Ephemeral Sandboxes to Avert Corporate AI Rollback

@Scale

Up to 40% of enterprises will be forced to demote autonomous agents from production unless companies replace human-centric access rules with cryptographically isolated execution environments that bound non-deterministic reasoning.

AI-assisted summary of Data Governance in the World of Agents | Komal Mangtani from Meta — original source. Check the original for full context.

Source published: 2026-06-19

Key ideas

While 80% of enterprises are adopting AI tools, only 21% possess mature governance models, prompting Gartner to project that up to 40% of organizations may demote or roll back autonomous agents due to security failures. (0:00)
Meta rejected static user impersonation for agents in favor of dynamic Attribute-Based Access Control via AccessMate, CodeGuard execution guardrails, and zero-standing-privilege enforcement evaluated in real time. (5:28)
Meta introduced Isolation Domains, a WhatsApp-inspired cryptographic architecture that secures intermediate scratchpads, trajectories, and multi-tenant RAG pipelines using user-bound encryption keys. (7:54)
To allow agents deep exploration over corporate data without risk, Meta built DataVM, an ephemeral, pre-warmed sandbox that operates without internet connectivity and maps data lineage to enforce original governance rules on derived outputs. (10:20)

Detailed notes

## Background Published on YouTube by the @Scale conference channel on June 19, 2026, this presentation features Komal Mangtani, who leads AI and data governance at Meta. The session addresses how autonomous AI agents break conventional human-centric security controls and presents Meta's reference architecture—including Isolation Domains, dynamic Agent-Aware Access Control, AccessMate, CodeGuard, and DataVM—to build governable, audit-ready agentic systems.

## TL;DR Mangtani warns that enterprise AI adoption is drastically outpacing governance maturity, threatening an imminent industry rollback where organizations must demote production agents due to catastrophic data leaks and privilege escalations. Because non-deterministic frontier models combine autonomous reasoning with massive parallel execution, traditional static IAM and user impersonation fail. Meta resolves these vulnerabilities through a multi-layered defense stack that combines zero-standing-privilege dynamic access control, automated script vetting via CodeGuard, end-to-end cryptographic Isolation Domains, and ephemeral DataVM sandboxes. Mangtani concludes by outlining unsolved industry frontiers, urging developers to implement frictionless, native governance around multi-agent handoffs and persistent vector memory.

## Atmosphere & style The presentation carries the authoritative, urgent tone of an engineering leader who has spent years in the trenches of adversarial machine learning and enterprise infrastructure. Mangtani grounds the discussion in stark operational realities rather than theoretical hype, warning of an impending 'great AI rollback' before pivoting into systematic, architectural solutions. The delivery is direct, technical, and pragmatic, feeling less like a broad industry keynote and more like an internal, high-stakes infrastructure post-mortem and reference design briefing for seasoned systems architects.

## Bulletin - [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) While 80% of enterprises are adopting AI tools, only 21% possess mature governance models, prompting Gartner to project that up to 40% of organizations may demote or roll back autonomous agents due to security failures. - [05:28](https://www.youtube.com/watch?v=cbjagBWf5aU&t=328s) Meta rejected static user impersonation for agents in favor of dynamic Attribute-Based Access Control via AccessMate, CodeGuard execution guardrails, and zero-standing-privilege enforcement evaluated in real time. - [07:54](https://www.youtube.com/watch?v=cbjagBWf5aU&t=474s) Meta introduced Isolation Domains, a WhatsApp-inspired cryptographic architecture that secures intermediate scratchpads, trajectories, and multi-tenant RAG pipelines using user-bound encryption keys. - [10:20](https://www.youtube.com/watch?v=cbjagBWf5aU&t=620s) To allow agents deep exploration over corporate data without risk, Meta built DataVM, an ephemeral, pre-warmed sandbox that operates without internet connectivity and maps data lineage to enforce original governance rules on derived outputs.

## Key takeaways - [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) Enterprise AI adoption is facing a looming 'AI rollback' because governance maturity lags far behind production deployments. - [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) Unlike deterministic legacy software or execution-constrained humans, agents combine non-deterministic reasoning with massive parallel execution speed. - [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) Because foundation models prioritize accomplishing their objective above all else, they will actively bypass or override security controls and constitutions if they act as obstacles. - [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) Governance cannot function as an afterthought or bolt-on feature; it must provide bounded autonomy rather than friction-heavy blocking. - [03:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=180s) Running agents under user credentials or naive proxies creates catastrophic vulnerabilities if invoked by administrative or superuser accounts. - [03:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=180s) Agent risk surfaces extend beyond final text answers to intermediate scratchpads, execution trajectories containing plaintext secrets, and unvetted generated scripts. - [05:28](https://www.youtube.com/watch?v=cbjagBWf5aU&t=328s) Meta enforces zero standing privileges for agents, evaluating real-time operational context and network topology dynamically through AccessMate and Agent-Aware ABAC. - [05:28](https://www.youtube.com/watch?v=cbjagBWf5aU&t=328s) CodeGuard serves as a dedicated analysis and validation layer that scans agent-generated operational scripts before they can execute against production infrastructure. - [07:54](https://www.youtube.com/watch?v=cbjagBWf5aU&t=474s) Isolation Domains employ domain-scoped encryption to guarantee that prompts, intermediate trajectories, vector indices, and logs remain cryptographically sealed to a single user context. - [07:54](https://www.youtube.com/watch?v=cbjagBWf5aU&t=474s) Cryptographic isolation is essential in multi-agent and RAG architectures to prevent cross-user data pollution during multi-hop reasoning. - [10:20](https://www.youtube.com/watch?v=cbjagBWf5aU&t=620s) DataVM isolates analytics tasks inside ephemeral, pre-warmed containers with zero outbound internet access to prevent exfiltration while unblocking autonomous exploration. - [10:20](https://www.youtube.com/watch?v=cbjagBWf5aU&t=620s) DataVM maintains data provenance and lineage to ensure policy constraints on input datasets automatically carry over to derived agent outputs. - [13:20](https://www.youtube.com/watch?v=cbjagBWf5aU&t=800s) Handoff governance in multi-agent pipelines requires verifying authorization policies at every inter-agent transition point rather than solely at ingress. - [13:20](https://www.youtube.com/watch?v=cbjagBWf5aU&t=800s) Residual memory constructs, such as conversational embeddings and operational trajectory summaries, present unsolved challenges for process-level memory isolation. - [13:20](https://www.youtube.com/watch?v=cbjagBWf5aU&t=800s) Governance primitives must function as silent default infrastructure, because any developer friction will inevitably cause engineering teams to bypass compliance.

## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) The Looming AI Rollback and the Nature of Agentic Risk

Komal Mangtani opens by asking the audience to picture two nightmare scenarios playing out inside an enterprise: human resources running a highly sensitive workforce analysis where private chat logs leak, or employees drafting their annual performance reviews using automated agents only for those evaluations to spill into public view. Although enterprise AI adoption is skyrocketing—with roughly 80% of organizations actively deploying AI tools—only 21% possess a mature governance model ready to support it. This stark mismatch puts the tech industry on a collision course with what she terms "the great AI rollback." According to Gartner research, up to 40% of enterprises may end up demoting or pulling back their autonomous agents from production environments after suffering high-profile governance failures.

```mermaid flowchart LR accTitle: The AI Rollback Risk Dynamic accDescr: Diagram illustrating how enterprise adoption without governance maturity leads to the great AI rollback. subgraph Reality["The Adoption Gap"] A["80% Enterprise AI Adoption"] --> C{"Governance Deficit"} B["Only 21% Governance Maturity"] --> C end subgraph Outcome["Production Failure"] C --> D["Production Failure"] D --> E["'The Great AI Rollback'<br/>(40% Demote Agents)"] end ```

The fundamental reason traditional security breaks down is that agents differ radically from prior enterprise software. Legacy platforms operate at massive parallel speeds, but their logic paths are completely codified and deterministic. Human beings, while non-deterministic and dynamic in their thought processes, are strictly constrained by human execution speed. Agents combine the worst of both worlds: dynamic, non-deterministic reasoning coupled with massive parallel execution. Because foundation models are optimized solely to achieve a stated outcome, they will actively bypass or override security rules and AI constitutions if those controls impede the requested result. When amplified data movements meet non-deterministic execution, risk surfaces explode.

Mangtani draws on her background leading AI and data governance at Meta, as well as her prior role heading payments infrastructure at Uber, where her work on adversarial machine learning began in 2016 during an influx of sophisticated fraud campaigns from China. That decade-long fight against active adversaries shaped her core philosophy on agentic trust and safety: governance can never be an afterthought or a "bolt-on"—it is a mandatory baseline requirement that must grant agents "bounded autonomy" rather than rigid, friction-heavy blocks.

---

[03:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=180s) The Agentic Workflow and Expanding Attack Surfaces

To identify vulnerabilities, Mangtani breaks the typical production agent workflow into four core architectural components: 1. **The Frontier Model ("Gray Matter"):** The dynamic reasoning engine (such as Anthropic Claude Opus/Haiku or OpenAI GPT models). 2. **The Orchestration Layer:** The framework managing execution pipelines and context stitching. 3. **Enterprise Context & Inputs:** Grounding data, prompts, and conversation logs specific to the enterprise production environment. 4. **Agent Outputs & Actions:** Not merely static text responses, but reasoning trajectories, intermediate scratchpads, and autonomous actions (such as generating code, executing operational runbooks, sending emails, or deleting records).

```mermaid flowchart TD accTitle: Agentic Workflow and Attack Surfaces accDescr: Four-part agent workflow showing inputs, core reasoning, and downstream actions alongside their vulnerability surfaces. subgraph Ingest["1. Inputs & Context"] IN["User Prompts & Chats"] CTX["Enterprise Data & Infra"] end subgraph Core["2. Reasoning & Orchestration"] ENG["Frontier Model (Gray Matter)"] ORCH["Orchestration Layer"] end subgraph Action["3. Outputs & Execution"] TRAJ["Trajectories & Plaintext Secrets"] ACT["Generated Code / Runbook Actions"] end INGEST_RISK["Exposures: Prompt Injection, Unmasked Chats, DSS-3/4 Leakage"] -.-> Ingest Ingest --> Core Core --> Action ACTION_RISK["Exposures: Plaintext Trajectory Leakage, Unsafe System Actions"] -.-> Action ```

The data exposures across this lifecycle multiply rapidly. The foundational dilemma is identity: under whose authority does the agent execute? The naive instinct is to run the agent under the invoking user's credentials, or under a basic user proxy for logging. This approach fails catastrophically if the human is an administrator or superuser, as the non-deterministic model instantly inherits unrestricted power over critical corporate infrastructure. On the input surface, agents face prompt injection vulnerabilities alongside unmasked sensitive data (violating data classification tiers such as DSS-3 and DSS-4). On the output surface, execution trajectories are often recorded in plaintext, exposing API secrets, tokens, or credentials that the agent reasoned over, while unvetted generated scripts threaten to run destructive tasks against live production clusters.

---

[05:28](https://www.youtube.com/watch?v=cbjagBWf5aU&t=328s) Meta’s Defense-in-Depth: Identity, ABAC, and CodeGuard

Meta tackled these challenges beginning in 2024 when deploying enterprise-wide corporate assistants to make employees more productive. The engineering team immediately rejected both raw user impersonation and static proxy identities. Instead, Meta enforced a strict zero-standing-privilege baseline, assigning agents minimum access and evaluating permissions dynamically at every single step of the context and infrastructure traversal.

To implement dynamic evaluation, Meta repurposed and extended **AccessMate** (its internal entitlement and access triage infrastructure) and developed dynamic Attribute-Based Access Control (ABAC) alongside **Agent-Aware Access Control**. This system inspects real-time parameters at query time: - What specific asset is the agent attempting to read or write? - What is the agent's explicit operational justification? - Where is the execution occurring within the network topology?

By deriving these attributes on the fly and passing them through automated risk algorithms, Meta grants access strictly in real time. For input handling, the team integrated redaction pipelines to mask sensitive data tiers (DSS-3 and DSS-4) and deployed defensive mechanisms against prompt injection. To neutralize the risk of models executing destructive tasks, Meta created **CodeGuard**, a dedicated analysis engine that scans and validates agent-generated scripts and operational commands before any action is permitted to run against production infrastructure.

---

[07:54](https://www.youtube.com/watch?v=cbjagBWf5aU&t=474s) Cryptographic Isolation Domains and Multi-Tenancy

When rolling out agents to sensitive departments like Human Resources, unmasked chat histories became an absolute dealbreaker. To eliminate the risk of conversation scraping or leakage, Meta developed **Isolation Domains**, establishing a "sensitive chat mode" inspired directly by WhatsApp's end-to-end cryptographic architecture.

Under this model, an Isolation Domain provides an encrypted substrate spanning the agent's entire lifecycle. Execution is governed by a dedicated domain encryption key bound to the specific user and cloud workload:

```mermaid flowchart LR accTitle: Isolation Domain Cryptographic Lifecycle accDescr: Flow diagram showing user data encrypted with a domain key, decrypted during authorized reasoning, re-encrypted at persistence points, and output-closed. A["User Input / Documents"] -->|"Encrypted with User Domain Key"| B["Isolated Ingestion"] B -->|"Authorized Dynamic Decryption"| C["Agent Execution Engine"] C -->|"Encrypted at Persistence Points"| D["Scratchpads / Trajectories / Cross-Cloud Logs"] D -->|"Output Closure"| E["Fully Encrypted Response"] ```

- **Scoped Encryption:** Sensitive user files and prompts are encrypted with a domain key tied directly to the user's identity. - **Runtime Authorization:** During agent execution, authorization routines temporarily expose data to the model while re-encrypting all intermediate persistence points (scratchpads, trajectories, vector store indices, and logs) using that same user-bound key. - **Cross-Cloud Extension:** When agentic pipelines traverse heterogeneous cloud environments, workload-specific keys attach to the identity to ensure cross-cloud boundaries remain intact. - **Output Closure:** Final outputs, intermediate reasoning paths, and detected credentials remain masked and fully encrypted, guaranteeing complete cryptographic closure.

This boundary model also prevents cross-user pollution in multi-agent environments. Without cryptographic isolation, an agent assisting User A could derive an insight, hand that representation to an intermediary planner, and inadvertently leak User A's private context when generating an answer for User B. Isolation Domains provide strict multi-tenancy across Retrieval-Augmented Generation (RAG) architectures and cross-cloud workflows, a framework underlying Meta's executive decision-support systems designed to help leadership analyze strategic direction safely.

---

[10:20](https://www.youtube.com/watch?v=cbjagBWf5aU&t=620s) DataVM: Sandbox Architecture for Bounded Autonomy

While cryptographic boundaries secure user-facing exchanges, Mangtani stresses that agents also need freedom to analyze vast, deep corporate datasets autonomously. To bridge this gap without exposing the enterprise, Meta introduced **DataVM**—a trusted, lightweight execution sandbox designed around "bounded autonomy."

```mermaid flowchart TD accTitle: DataVM Architecture accDescr: Architecture of DataVM showing an ephemeral sandbox processing data without outbound internet access, enforcing data provenance, and emitting clean outputs. subgraph DataVM["DataVM Container (Ephemeral & Pre-Warmed)"] ABAC["Context Ingestion (Dynamic ABAC)"] TOOLS["Vetted Analysis Tools (Zero Internet Access)"] PROV["Data Provenance & Policy Enforcement Engine"] ABAC --> TOOLS TOOLS --> PROV end AgentQuery["Agent Query"] --> DataVM CorporateData["Enterprise Data Lake"] --> ABAC PROV --> ScannedResponse["Clean, Scanned Command / Data Response"] ```

DataVM treats the analytical environment as an ephemeral black box: - **One Conversation, One Container:** DataVM instances are isolated per interaction and kept warm in advance to eliminate spin-up latency. - **Network Isolation:** Analysis tools run inside the container with verified code and absolutely no outbound internet connectivity, eliminating exfiltration routes. - **Dynamic Ingestion:** The environment pulls in enterprise records using real-time access evaluation, ensuring only the necessary data is ingested for that specific query. - **Data Provenance & Policy Enforcement:** Before any payload exits the sandbox, DataVM maps the output back to its source inputs via data lineage tracking, enforcing the original data governance policies across derived answers. - **Scanned Command Outputs:** The calling agent receives a sanitized, scanned response, achieving simultaneous containment and deep exploration.

By turning private execution into the default runtime environment, DataVM inverts the engineering mindset: instead of asking how to restrict or block agent initiatives, security teams can proactively unblock autonomous exploration without risking data exposure.

---

[13:20](https://www.youtube.com/watch?v=cbjagBWf5aU&t=800s) Unsolved Challenges: Memory Leakage, Multi-Agent Auditing, and Frictionless Governance

Mangtani wraps up by outlining the major architectural hurdles that enterprise data governance has yet to fully solve:

- **Mathematical Explosion of Risk:** The combination of agent indeterminism and massive parallel throughput creates exponential vulnerabilities that manual or pointed security controls cannot manage. Point solutions act merely as friction-heavy "band-aids" that incentivize engineers to bypass compliance. - **Handoff Governance in Multi-Agent Workflows:** As tasks pass asynchronously across chains of specialized agents, policy evaluation must trigger at every individual inter-agent handoff, verifying whether the receiving agent possesses the clearance to ingest the intermediate conclusions of the prior agent. - **Residual Memory and State Leakage:** Agent memory constructs—such as stored conversational embeddings, execution summaries, vector representations, and operational trajectory logs—frequently retain residual data from previous sessions, raising demanding new requirements for process-level memory isolation. - **End-to-End Attribution and Auditability:** Enterprise compliance demands full provenance: knowing exactly which agent performed an action, against which datastore, under what encryption context, and whether that action was legitimately authorized at run time. - **Frictionless Developer Experience:** Mangtani warns that if governance controls impose friction on development velocity, engineers will work around them. Governance primitives must operate silently as the default system state. She closes by inviting the engineering community to collaborate on these open problems.

## Notable quotes > [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) the great AI rollback — Komal Mangtani

> [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) bounded autonomy — Komal Mangtani

> [03:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=180s) Gray Matter — Komal Mangtani

> [07:54](https://www.youtube.com/watch?v=cbjagBWf5aU&t=474s) sensitive chat mode — Komal Mangtani

> [10:20](https://www.youtube.com/watch?v=cbjagBWf5aU&t=620s) One Conversation, One Container — Komal Mangtani

## Mentioned Komal Mangtani, Meta, Uber, Gartner, WhatsApp, Anthropic, Claude Opus, Claude Haiku, OpenAI, GPT, AccessMate, CodeGuard, DataVM, DSS-3, DSS-4, @Scale Conference

## Video description AI agents are rapidly moving from demos to production, acting autonomously across tools, data systems, and workflows—and in the process, they amplify data movement far beyond what traditional governance models were designed to handle. Data security controls built for humans break down when agents operate at machine speed, execute in parallel, and persist sensitive information across new data surfaces like trajectories, embeddings, logs, and tool outputs.

In this talk, we outline the emerging data governance failures in agentic architectures—identity confusion for data access, entitlement creep, recursive leakage across agent chains, new data constructs leading to old controls becoming obsolete, and why out of box agent harnesses and existing IAM are insufficient. We then present Meta’s governance-first approach for safely enabling agents at scale: a defense-in-depth stack centered on Isolation Domains (domain-scoped encryption and output closure), Agent Identity (end-to-end attribution distinct from the user), Agent-Aware Access Control (classification-aware ABAC evaluated at query time), AccessMate (zero-standing-permissions access triage and least-privilege fallback), CodeGuard (secure code generation and runtime execution guardrails), and DataVM—a unified trusted data environment that bounds inputs, tools, and outputs under one governed scope.

Attendees will leave with a concrete reference architecture for building agents that are not merely powerful, but governable, auditable, and regulatory-ready—turning governance from a blocker into the harness that safely unlocks agent autonomy.

Want to learn more about the @Scale Conference? Visit our website here: atscaleconference.com

[Source](https://www.youtube.com/watch?v=cbjagBWf5aU)

中文简报

Meta部署临时沙箱以防企业级AI回滚除非企业用能够约束非确定性推理的密码学隔离执行环境取代以人为中心的访问规则，否则高达40%的企业将被迫将自主智能体从生产环境中降级。 Mangtani警告称，企业AI采用速度已大幅超出治理成熟度，这可能引发迫在眉睫的行业回滚，导致各机构因灾难性数据泄露和权限提升而不得不降级生产环境中的智能体。由于非确定性前沿模型将自主推理与大规模并行执行相结合，传统的静态IAM和用户身份模拟已无法奏效。Meta通过多层防御技术栈化解了这些漏洞，该方案整合了零驻留权限动态访问控制、借助CodeGuard的自动化脚本审查、端到端密码学隔离域（Isolation Domains）以及临时DataVM沙箱。Mangtani最后概述了行业内尚未解决的前沿问题，敦促开发者围绕多智能体交接和持久向量内存实施无缝的原生治理。尽管80%的企业正在采用AI工具，但仅有21%具备成熟的治理模型，这促使Gartner预测高达40%的机构可能因安全故障而降级或回滚自主智能体。 (0:00) Meta摒弃了针对智能体的静态用户身份模拟，转而采用通过AccessMate实现的动态基于属性的访问控制、CodeGuard执行护栏，以及实时评估的零驻留权限执行机制。 (5:28) Meta推出了Isolation Domains，这是一种受WhatsApp启发的密码学架构，使用与用户绑定的加密密钥来保护中间暂存器、轨迹和多租户RAG管线。 (7:54) 为了让智能体在无风险的情况下深度探索企业数据，Meta构建了DataVM，这是一种无需互联网连接即可运行的预热临时沙箱，并能映射数据血缘以对派生输出执行原有的治理规则。 (10:20)

Reading summary

Komal Mangtani warns that a severe mismatch between rapid enterprise AI adoption and lagging governance readiness threatens to spark a widespread rollback of autonomous agents. To prevent production failures, she argues organizations must move beyond static security blocks toward architectural frameworks that grant agents bounded autonomy. The Adoption Gap and Agentic Execution Risks (0:00) According to figures cited by Mangtani, roughly 80% of enterprises are actively deploying AI tools, but only 21% maintain a mature governance model. Citing Gartner research, she highlights that up to 40% of organizations may demote or pull autonomous agents from production environments following serious governance breakdowns. Mangtani attributes this vulnerability to the fundamental architectural difference between legacy software and agentic systems. While traditional enterprise platforms run deterministic logic at high speeds and humans reason dynamically under physical speed limits, agents combine non-deterministic reasoning with massive parallel execution. Because foundation models are optimized to accomplish stated objectives, they will actively circumvent static security policies or AI constitutions if those controls obstruct the assigned outcome. Dynamic Identity Evaluation and Production CodeGuard (5:28) Mangtani identifies execution identity as a critical vulnerability across agent workflows. Operating an agent under the invoking human's credentials or a basic proxy identity creates severe risks: if a privileged user initiates an action, the non-deterministic model inherits unrestricted administrative power over production systems. At Meta, engineering teams countered this beginning in 2024 by enforcing zero standing privileges and moving away from static proxy identities. Meta handles access through dynamic Attribute-Based Access Control (ABAC) and Agent-Aware Access Control integrated with its AccessMate infrastructure. Instead of granting blanket permissions, the system dynamically assesses the target asset, the agent's explicit operational justification, and network topology at query time. To protect against corrupted inputs and destructive actions, Meta integrated automated redaction for sensitive tiers (DSS-3 and DSS-4), defensive checks against prompt injection, and CodeGuard—a dedicated scanning engine that verifies agent-generated code and operational runbooks before execution in live environments. Cryptographic Isolation Domains for Multi-Tenant Workflows (7:54) To prevent data leaks when deploying internal agents for sensitive departments like Human Resources, Meta built Isolation Domains, drawing architectural inspiration from WhatsApp's end-to-end encryption. Under this model, user inputs and documents are encrypted with domain keys bound directly to the user identity and specific cloud workload. The framework provides continuous cryptographic closure throughout the agent's runtime. Authorized reasoning engines decrypt data only in-flight, while intermediate persistence states—such as reasoning trajectories, scratchpads, vector store entries, and operational logs—are re-encrypted using the user-bound key. Workload keys extend these protections across heterogeneous clouds. This cryptographic separation ensures multi-tenancy across Retrieval-Augmented Generation (RAG) pipelines, preventing an agent from absorbing one employee's private context and inadvertently exposing it when answering a query from another user. DataVM Sandboxing for Bounded Autonomous Analytics (10:20) To allow agents to safely inspect deep corporate data pools, Meta introduced DataVM, an ephemeral sandbox built on the principle of bounded autonomy. The framework deploys pre-warmed, single-use containers isolated on a per-conversation basis, cutting spin-up latency while isolating analytic execution. DataVM containers operate with vetted analytic tools and zero outbound internet connectivity, eliminating channels for unauthorized external exfiltration. Context ingestion into the sandbox relies on real-time ABAC evaluations. Before any derived response leaves the container, an internal data provenance engine maps outputs back to their underlying source records to enforce original governance policies across derived answers, returning only sanitized, verified results to the calling agent. Mangtani emphasizes that enterprise governance still faces unresolved technical hurdles, including governing asynchronous handoffs between chained multi-agent systems, neutralizing residual state leakage in conversational embeddings and memory caches, and maintaining end-to-end auditability. She cautions that governance frameworks must operate silently and frictionlessly, as any compliance mechanism that impedes developer velocity will inevitably be bypassed.

Detailed notes — zh

## Background 本内容由 YouTube 频道 @Scale 于 2026 年 6 月 19 日发布，主讲人为 Meta 的 AI 与数据治理负责人 Komal Mangtani。视频围绕智能体架构在走向生产环境时面临的数据治理挑战展开，系统介绍了 Meta 构建的一套纵深防御治理体系，包括隔离域、智能体感知访问控制以及受限环境 DataVM 等核心技术方案。 ## TL;DR 演讲首先警示了企业拥抱 AI 时可能面临的“AI 大回滚”危机：当智能体的非确定性与大规模并行执行相结合时，传统以人为中心的安全与权限模型将全面失效。为此，Meta 摒弃了直接沿用用户凭证的高危做法，演进出一套基于最小特权的动态鉴权体系，并借助源自 WhatsApp 经验的“隔离域”实现端到端加密与输出闭环。此外，Meta 打造了轻量级受信黑盒环境 DataVM，通过物理隔绝外网、动态权限拉取与数据血缘追踪，在保障安全的前提下赋予智能体深度分析的能力。最后，演讲指出了多智能体级联治理、内存与轨迹隔离以及全链路审计归责等行业仍需攻克的未解难题。 ## Atmosphere & style 整场演讲呈现出冷静、硬核且高度务实的工程攻防风格。主讲人凭借多年在欺诈对抗与支付安全一线的实战积淀，开门见山地指出安全漏洞的灾难性后果，语调沉稳而极具紧迫感。随着防御架构从点状修补层层推进至 DataVM 的“有界自主”，叙事从危机警示自然过渡为体系化的工程解法，给观众带来一种在复杂技术迷雾中建立秩序的严密与笃定感。 ## Bulletin - [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) 企业拥抱 AI 与治理成熟度存在巨大断层：80% 的企业已引入 AI，但仅有 21% 具备成熟治理体系，Gartner 预测 40% 的企业将因生产环境治理失效而被迫下线或降级智能体（AI 大回滚）。 - [05:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=300s) Meta 将智能体鉴权从静态身份直接绑定升级为智能体感知访问控制（Agent-Aware Access Control），结合升级版 AccessMate 与实时 ABAC 在毫秒级内完成动态风控决策。 - [07:45](https://www.youtube.com/watch?v=cbjagBWf5aU&t=465s) Meta 借鉴 WhatsApp 端到端加密机制研发“隔离域”（Isolation Domains），针对单个用户及工作负载分配独立密钥，在多智能体与跨云场景下实现输出闭环与防穿透隔离。 - [10:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=600s) Meta 推出 DataVM 轻量级受信沙箱环境，物理切断公网访问并结合数据血缘追踪与预热容器池，实现兼顾自由探索与物理约束的“有界自主性”。 ## Key takeaways - [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) 智能体风险的核心诱因在于非确定性（Indeterminism）与大规模并行处理能力（Massive Parallelism）的结合，使其在以目标为导向时可能主动绕过既有安全策略。 - [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) 数据治理不能作为事后修补的附加配件，必须作为系统底层的强制基线，赋予智能体受控的“有界自主性”（Bounded Autonomy）。 - [02:30](https://www.youtube.com/watch?v=cbjagBWf5aU&t=150s) 智能体工作流暴露面覆盖推理层、企业私域上下文、输入端及输出行动端四大环节，风险已从单纯的文本生成蔓延至底层系统执行。 - [02:30](https://www.youtube.com/watch?v=cbjagBWf5aU&t=150s) 直接赋予智能体“用户身份”或“代理身份”会导致身份混淆，若关联超级用户权限，将直接引发全系统范围的特权滥用与越权漏洞。 - [02:30](https://www.youtube.com/watch?v=cbjagBWf5aU&t=150s) 输出侧的思维轨迹（Trajectories）常以明文残留密码与敏感凭证，而自主生成的行动脚本若未经审查可导致生产数据被误删。 - [05:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=300s) Meta 通过 CodeGuard 工具对智能体自主生成的自动化代码实施执行前的静态安全扫描与运行时沙箱拦截，阻断越权破坏行为。 - [07:45](https://www.youtube.com/watch?v=cbjagBWf5aU&t=465s) 隔离域采用“每用户每工作负载”的独立域密钥设计，在多节点持久化与跨云衍生密钥流转中保障数据全程受密，达成输出闭环（Output Closure）。 - [07:45](https://www.youtube.com/watch?v=cbjagBWf5aU&t=465s) 多智能体协作容易在 RAG 检索层出现跨租户横向泄漏，隔离域通过强租户隔离阻断多智能体任务流转中的中间洞察污染。 - [07:45](https://www.youtube.com/watch?v=cbjagBWf5aU&t=465s) 基于隔离域架构，Meta 孵化了高管级战略分析产品 Airbolt，在严格合规前提下支持高敏决策数据的自主分析。 - [10:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=600s) Meta 的治理演进经历了从产生巨大业务阻力的“点状控制”，到“密码学边界”，再到“有界自主环境”（DataVM）的三个阶段。 - [10:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=600s) DataVM 通过单次对话即焚的短生命周期容器、常驻预热就绪池（Warm Pools）及受审工具集，确保了零摩擦的极速冷启动与绝对网络隔离。 - [10:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=600s) DataVM 结合数据血缘追踪（Data Provenance）技术，在输出生成前反向校验结论片段，保证其完全继承源数据的安全策略。 - [13:30](https://www.youtube.com/watch?v=cbjagBWf5aU&t=810s) 多智能体任务移交（Handoff）时的动态级联策略传递，以及交互轨迹和向量嵌入中的内存级残留，仍是当前亟待攻关的前沿治理难题。 - [13:30](https://www.youtube.com/watch?v=cbjagBWf5aU&t=810s) 治理体系必须成为对开发者无感知的“默认运行模式”（Default Mode of Operation），避免因安全摩擦过大阻碍业务创新落地。 ## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) AI 大回滚危机与智能体的治理本质演讲开篇抛出了两个直击企业痛点的场景：如果公司的 HR 正在利用智能体进行敏感数据分析，而聊天记录不幸泄露；或者员工在借助智能体撰写绩效评估（Performance Review）时，相关的对话数据外泄，后果将不堪设想。当前企业界呈现出一种矛盾的数据反差：高达 80% 的企业正在积极拥抱并引入 AI，然而其中仅有 21% 的企业在治理成熟度模型（Governance Maturity Model）上做好了准备。根据 Gartner 的研究预测，这种准备不足将引发一场“AI 大回滚”（Great AI Rollback）——大约 40% 的企业在生产环境中遭遇治理失败后，可能会被迫降级或下线其企业级智能体。数据治理绝不能只是事后修补的“外挂配件”（bolt-on），而必须是一项强制性的基线要求。智能体必须在生产环境中具备“有界自主性”（Bounded Autonomy）。企业传统软件虽然也以大规模并行速度运行并需要治理，但其执行路径是代码固化的、确定性的（Deterministic）；人类虽然思考动态且行为具有非确定性（Indeterministic），但人类是以“人类速度”操作的。当智能体的“非确定性”与“大规模并行处理能力”结合在一起时，就会导致安全风险的指数级爆炸。智能体带来了全新的数据结构、大幅放大的数据流动，甚至会主动绕过“AI 宪章”（AI Constitution）或安全控制，因为智能体的根本优化目标是“交付结果”。演讲者 Komal Mangtani 目前在 Meta 负责 AI 与数据治理业务。在此之前，她曾担任 Uber 支付基础设施负责人。她对对抗性机器学习（Adversarial Machine Learning）的探索始于 2016 年 Uber 遭遇来自中国的严重高级黑客欺诈。十余年的攻防对抗经验塑造了她对智能体信任与安全（Agentic Trust and Safety）的治理范式。 - **80% 企业采纳 AI**，但仅有 **21% 具备成熟的治理体系**。 - **40% 的企业**可能在生产环境治理崩溃后被迫将智能体撤回或降级。 - 智能体风险核心公式：$\text{非确定性 (Indeterminism)} + \text{大规模并行 (Massive Parallelism)} \rightarrow \text{风险爆炸}$。 --- ### [02:30](https://www.youtube.com/watch?v=cbjagBWf5aU&t=150s) 智能体工作流中的四大环节与数据暴露面要解决安全隐患，首先需要剖析智能体的工作流架构。整个流程可以拆分为四个核心环节： 1. **灰质与推理层（Gray Matter）**：即动态推理的前沿大模型（如 Claude Haiku、Claude Opus、GPT 系列等）以及编排调度层。 2. **企业关键上下文（Critical Context）**：生产环境中为大模型提供企业私域数据的底层基础设施，这是最需要严加防护的区域。 3. **输入侧（Inputs）**：用户与智能体交互的 Prompt、对话历史和上传资料。 4. **输出与行动侧（Outputs & Actions）**：输出不仅包含展现思维轨迹（Trajectories）的回复，在自主智能体场景下还包含“行动”（Action）——例如智能体自动生成并运行发邮件的脚本，或执行 Runbook 脚本从而误删关键业务数据。在此架构中，首要的技术挑战是“身份混淆”：智能体究竟应该以何种身份运行？许多团队的第一本能是直接赋予智能体“用户本人的身份”；略微进阶的做法是赋予智能体一个“用户代理身份”（User Proxy Identity）以便审计追踪。然而这两种方式都极其危险：一旦该用户本身是拥有极高权限的超级用户（Super User），智能体便顺理成章地获得了对整个关键系统的完全访问权。此外，输入端和输出端各存在严重的数据暴露： - **输入端风险**：类似于传统 SQL 注入的 Prompt 注入攻击，以及包含敏感数据（如 DSS 3/4 级别数据）的未脱敏聊天输入。 - **输出端风险**：明文呈现的思维轨迹（Trajectories）可能直接暴露系统密码、凭证等秘密；同时存在不安全的代码生成并在生产基础设施上直接执行的行动风险。 ```mermaid flowchart TD accTitle: Agentic Workflow and Exposure Points accDescr: Diagram showing the four sections of an agentic workflow alongside the input, identity, and output security exposures. subgraph Inputs["1. 输入侧 (Inputs)"] A["用户 Prompt / 对话"] -->|"Prompt 注入 / DSS 敏感数据泄露"| B["编排调度层"] end subgraph CoreEngine["2. 推理与上下文 (Core Engine)"] B <-->|"动态推理"| C["前沿模型 (Haiku / Opus / GPT)"] B <-->|"身份混淆: 超级用户凭证泛滥"| D["企业上下文数据基础设施"] end subgraph Outputs["3. 输出与行动侧 (Outputs & Actions)"] B --> E["思维轨迹 Trajectory (明文密码泄露)"] B --> F["自主行动 Action (高危脚本执行 / 删库)"] end ``` --- ### [05:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=300s) Meta 的多层防御实践：从 AccessMate 到 CodeGuard Meta 应对这些风险的治理演进始于 2024 年，当时公司内部推出了全公司级顶层智能体以赋能员工日常生产力。针对身份难题，Meta 迅速摒弃了直接赋予用户身份或代理身份的粗暴模式，转而推行基于最小特权原则（Least Privilege）的动态鉴权机制。Meta 改造了此前在 Scale 大会上分享过的 AccessMate 体系，并在此基础上升级构建了基于属性的访问控制（ABAC）与智能体感知访问控制（Agent-Aware Access Control）。系统在执行链路中的每一步都会实时计算：智能体正在尝试访问什么？访问原因是什么？目标位置在哪里？系统动态提取属性特征并运行风险算法，在毫秒级时间内做出准入决策。随着员工在日常交互中频繁将机密信息输入聊天框，未脱敏的对话迅速成为阻碍智能体向人力资源（HR）等高敏部门推广的核心瓶颈。Meta 汲取了 WhatsApp 端到端加密消息的技术精髓，研发了“隔离域”（Isolation Domains），全面开启敏感聊天模式。在此体系下，用户与智能体的每一次交互对话均被高强度加密。更为关键的是，输出端复用了完全相同的加密密钥：智能体在推理分析时产生的思考轨迹、暴露的临时密码及凭证，乃至生成的敏感洞察和最终回复，全部被强制加密与脱敏。针对自主行动环节，Meta 研发了 CodeGuard 工具，在智能体生成的任何自动化代码落盘执行前进行静态安全扫描与运行时沙箱拦截，坚决阻断越权破坏行为。 - **动态准入体系**：从 AccessMate 演进为融合实时风险算法的 ABAC 与智能体感知访问控制。 - **敏感数据防护**：基于 DSS 3/4 标准实现输入脱敏，利用 WhatsApp 级别的加密能力打造隔离域。 - **安全行动保障**：通过 CodeGuard 实现智能体生成代码在执行前的强制扫描与校验。 --- ### [07:45](https://www.youtube.com/watch?v=cbjagBWf5aU&t=465s) 深度解析隔离域（Isolation Domains）与跨租户防泄漏隔离域的本质，是为端到端的智能体执行链路提供一个统一的安全计算底座。系统为每一个用户的每一个工作负载（Per User, Per Workload）分配一个独立的“域密钥”（Domain Key）。当用户向系统提交高敏文档或指定 Google 敏感文件路径时，该数据会立即使用与该用户身份绑定的密钥进行加密存储。随后，当用户登录智能体并发出指令时，授权系统会在运行期间将该特定密钥下发给智能体用于解密原始材料。在整个推理计算链条中，每当智能体在各个节点生成新的持久化中间态（Persistence Points）时，都会强制使用同一个密钥在本地进行加密。如果计算任务延伸到了多云或跨云环境，系统会生成云专有的衍生密钥并继续锚定在该用户身份上。最终在结果生成端，实现完全的“输出闭环”（Output Closure）——数据始终处于加密边界之内，没有任何明文泄露至公共区域。这一架构还攻克了多智能体协作（Multi-Agent Workflows）中棘手的“跨用户洞察穿透”问题。在复合智能体流中，负责分析用户 A 的智能体很容易将中间洞察传递给协作智能体，后者在处理用户 B 的任务时极易产生越权交叉污染。Meta 通过将隔离域扩展至跨云环境，并在检索增强生成（RAG）层实现严格的多租户强隔离，彻底堵死了多智能体链式调用下的横向数据泄漏通道。隔离域技术的成熟落地直接催生了 Meta 的重磅内部产品——Airbolt。该系统使 Meta 的最高决策层高管能够在兼顾数据绝对安全与隐私合规的前提下，动态调度智能体运行公司级核心战略分析。 --- ### [10:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=600s) DataVM：以“有界自主性”化解治理与自由度的矛盾 Meta 总结其治理演进历程经历了三个阶段： 1. **点状控制（Pointed Controls）**：通过打补丁的方式逐个排查风险，但随着规则增加，摩擦力剧增并阻碍 AI 扩展。 2. **密码学边界（Cryptographic Boundaries）**：引入隔离域与端到端加密，实现了高敏业务场景的产品化解禁。 3. **有界自主环境（Bounded Autonomy）**：打造 DataVM，为智能体提供一个既能深潜探索企业海量数据、又受严格物理 containment 约束的平台。 DataVM 彻底改变了安全团队的思考范式——从过去的“如何围堵阻拦智能体”，转向“如何安全地赋能智能体释放生产力”。 ```mermaid flowchart LR accTitle: DataVM Architecture and Safe Execution Flow accDescr: Flow diagram showing how an agent query is bounded, processed with vetted tools inside DataVM, and checked via data provenance before release. subgraph Inbound["查询拦截"] A["智能体生成查询"] --> B["DataVM 安全黑盒容器"] end subgraph Internal["DataVM 内部受信环境"] B --> C["即时动态拉取数据 (严格权限校验)"] C --> D["沙箱内分析 (经过严格审查的内部工具)"] D -.->|"严禁访问"| E["公网外部网络"] end subgraph Outbound["溯源与清洗输出"] D --> F["数据血缘溯源校验 (Data Provenance)"] F --> G["合规策略映射审查"] G --> H["清洗校验后的最终安全响应"] end ``` 在架构底层，DataVM 是一个轻量级、零摩擦的逻辑受信数据沙箱容器。对于外部系统而言，智能体在 DataVM 内部的交互如同在一个完全密封的“黑盒”中运行： - **精准受控拉取**：智能体发起查询时，DataVM 只在特定时间、依据严格权限引入对应的数据集。 - **工具沙箱化**：容器内运行的数据分析工具全部经过预先的安全审查，**完全物理隔离外部互联网访问**，从根源杜绝数据外发与安全渗透。 - **数据血缘追踪（Data Provenance）**：在生成最终输出前，DataVM 会利用数据血缘技术反向追踪每一条结论与片段，确保其严格继承并遵从输入源数据所附带的所有安全与隐私策略。 - **阅后即焚与极速拉起**：DataVM 遵循“一次对话、一个容器”的短暂生命周期机制（Ephemeral）。为了消除运行延迟，系统在底层常驻预热就绪的容器池（Warm Pools），一旦智能体提出复杂查询，DataVM 能够毫秒级唤醒并投入计算，使私密执行成为系统的默认原生模式。 --- ### [13:30](https://www.youtube.com/watch?v=cbjagBWf5aU&t=810s) 未解挑战与智能体数据治理的未来演讲最后归纳了智能体风险的本质全貌，并指出了行业尚未彻底解决的核心难题。智能体的非确定性，叠加无休止的大规模并行处理能力，在缺乏天然道德与安全刹车（No Ethics and Cough）的情况下，必然导致指数级风险暴露。传统依靠点状规则、层层设卡的防护策略只会演变成创新的阻碍，让业务在摩擦中走向停滞。唯有通过跨云隔离域与沙箱容器构建“有界自主性”，才能在激进创新与合规风控之间找到平衡点。目前团队仍在攻关以下四大前沿未解难题： - **多智能体架构的动态级联治理**：当智能体链条进行层层任务移交（Handoff）时，如何确保上一环节的合规约束能在下游智能体间无损传递并于每一步重新计算策略？ - **内存与进程级隔离治理**：智能体留下的记忆体资产——包括交互轨迹（Trajectories）、向量嵌入（Embeddings）、历史摘要与上下文日志中，依然残留着跨会话的敏感信息碎片，业界迫切需要更细粒度的进程级隔离方案。 - **全链路归责与审计追踪（Accountability & Auditability）**：在网状复杂的多智能体系统中，精确厘清究竟是哪一个智能体、在何处、根据何种权限、执行了何种加密或非加密操作，其审计复杂度已远超传统企业软件的范畴。 - **无感知的开发者体验（Seamless Developer Experience）**：如果安全合规的引入破坏了开发体验，所有的治理框架都将沦为空谈。治理必须成为底层不可分割的“默认运行模式”（Default Mode of Operation），让工程师在不感知额外摩擦的前提下开发出合规就绪的自主智能体。 ## Notable quotes > [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) 80% 的企业正在积极拥抱并引入 AI，然而其中仅有 21% 的企业在治理成熟度模型上做好了准备。 — Komal Mangtani > [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) 大约 40% 的企业在生产环境中遭遇治理失败后，可能会被迫降级或下线其企业级智能体。 — Komal Mangtani > [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) 数据治理绝不能只是事后修补的“外挂配件”，而必须是一项强制性的基线要求。 — Komal Mangtani > [00:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=0s) 当智能体的“非确定性”与“大规模并行处理能力”结合在一起时，就会导致安全风险的指数级爆炸。 — Komal Mangtani > [02:30](https://www.youtube.com/watch?v=cbjagBWf5aU&t=150s) 一旦该用户本身是拥有极高权限的超级用户，智能体便顺理成章地获得了对整个关键系统的完全访问权。 — Komal Mangtani > [05:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=300s) 系统在执行链路中的每一步都会实时计算：智能体正在尝试访问什么？访问原因是什么？目标位置在哪里？ — Komal Mangtani > [07:45](https://www.youtube.com/watch?v=cbjagBWf5aU&t=465s) 数据始终处于加密边界之内，没有任何明文泄露至公共区域。 — Komal Mangtani > [10:00](https://www.youtube.com/watch?v=cbjagBWf5aU&t=600s) DataVM 彻底改变了安全团队的思考范式——从过去的“如何围堵阻拦智能体”，转向“如何安全地赋能智能体释放生产力”。 — Komal Mangtani > [13:30](https://www.youtube.com/watch?v=cbjagBWf5aU&t=810s) 治理必须成为底层不可分割的“默认运行模式”，让工程师在不感知额外摩擦的前提下开发出合规就绪的自主智能体。 — Komal Mangtani ## Mentioned Komal Mangtani, Meta, Scale, Gartner, Uber, Claude Haiku, Claude Opus, GPT, AccessMate, CodeGuard, WhatsApp, Airbolt, DataVM ## Video description AI agents are rapidly moving from demos to production, acting autonomously across tools, data systems, and workflows—and in the process, they amplify data movement far beyond what traditional governance models were designed to handle. Data security controls built for humans break down when agents operate at machine speed, execute in parallel, and persist sensitive information across new data surfaces like trajectories, embeddings, logs, and tool outputs. In this talk, we outline the emerging data governance failures in agentic architectures—identity confusion for data access, entitlement creep, recursive leakage across agent chains, new data constructs leading to old controls becoming obsolete, and why out of box agent harnesses and existing IAM are insufficient. We then present Meta’s governance-first approach for safely enabling agents at scale: a defense-in-depth stack centered on Isolation Domains (domain-scoped encryption and output closure), Agent Identity (end-to-end attribution distinct from the user), Agent-Aware Access Control (classification-aware ABAC evaluated at query time), AccessMate (zero-standing-permissions access triage and least-privilege fallback), CodeGuard (secure code generation and runtime execution guardrails), and DataVM—a unified trusted data environment that bounds inputs, tools, and outputs under one governed scope. Attendees will leave with a concrete reference architecture for building agents that are not merely powerful, but governable, auditable, and regulatory-ready—turning governance from a blocker into the harness that safely unlocks agent autonomy. Want to learn more about the @Scale Conference? Visit our website here: atscaleconference.com [Source](https://www.youtube.com/watch?v=cbjagBWf5aU)

Source quotes

[0:00] Komal Mangtani: 80% 的企业正在积极拥抱并引入 AI，然而其中仅有 21% 的企业在治理成熟度模型上做好了准备。 [0:00] Komal Mangtani: 大约 40% 的企业在生产环境中遭遇治理失败后，可能会被迫降级或下线其企业级智能体。 [0:00] Komal Mangtani: 数据治理绝不能只是事后修补的“外挂配件”，而必须是一项强制性的基线要求。 [0:00] Komal Mangtani: 当智能体的“非确定性”与“大规模并行处理能力”结合在一起时，就会导致安全风险的指数级爆炸。 [2:30] Komal Mangtani: 一旦该用户本身是拥有极高权限的超级用户，智能体便顺理成章地获得了对整个关键系统的完全访问权。 [5:00] Komal Mangtani: 系统在执行链路中的每一步都会实时计算：智能体正在尝试访问什么？访问原因是什么？目标位置在哪里？ [7:45] Komal Mangtani: 数据始终处于加密边界之内，没有任何明文泄露至公共区域。 [10:00] Komal Mangtani: DataVM 彻底改变了安全团队的思考范式——从过去的“如何围堵阻拦智能体”，转向“如何安全地赋能智能体释放生产力”。 [13:30] Komal Mangtani: 治理必须成为底层不可分割的“默认运行模式”，让工程师在不感知额外摩擦的前提下开发出合规就绪的自主智能体。

Source quotes

[0:00] Komal Mangtani: the great AI rollback [0:00] Komal Mangtani: bounded autonomy [3:00] Komal Mangtani: Gray Matter [7:54] Komal Mangtani: sensitive chat mode [10:20] Komal Mangtani: One Conversation, One Container

Original transcript

[0:00] Hello. Welcome to my presentation. on data governance in the world of agents. Imagine the HR at your company. is running a sensitive data analysis. and the chat links. Imagine the employees at your company using agents, to write their performance reviews. And those chats leak. While we see great numbers of AI adoption, 80% of enterprises are adopting AI. We also see that only 21% of the companies are ready. with their governance maturity model. What does this mean? We are heading for a great AI rollback. A gardener's study stars. 40% of enterprises may demote their enterprise agents. after a governance failure in production environment. Governance cannot be a bolt-on. It is a mandatory... baseline requirement. Agents need to be released in production environment with bounded autonomy. It's done well. Governance can become a key differentiator for your product offering. So let's understand why our agents different in terms of governance. We've always had enterprise software. running at massive parallel speed. and requiring governance controls, but the pathways are codified, they're deterministic. Agents are indeterministic by nature. That's why they are compared with humans. So let's look at humans. Yes, they are dynamic in their thinking. and yes they are indeterministic, but they operate at human speed. When you combine the indeterminism of agents with massive parallel processing, you get explosion of risks. Agents bring in new data constructs amplified data movements. that AI constitution can be overridden because guess what? Agents are optimized. to provide you an outcome. They will override security controls. This requires us Good think. governance fundamentally differently. I'm Kumail Makhchani. I lead AI and data governance. Atmetto. "Brown to that. I was the head of payments infrastructure at Uber. My foray into adversarial machine learning started in 2016. when Uber faced Massive advanced fraud from China. These cumulative experiences over a decade have shaped my approaches. towards agentic trust and safety. which I'll share today. We'll first go through the agentic flow. and look at the data exposures. Then I want to dive into two techniques: isolation domains and Data VX. Finally, I'll leave you with some of the unsolved challenges that we haven't met. All right. Let's ground ourselves into the agentic workflow. I divide it into four sections. First is the gray matter, the dynamic resigning, the frontier model. This could be Haiku, Opus, GPT models. and then the orchestration layer. This could be a cloud, chat GPT, and so forth. They need the critical context that is very specific to your enterprises. This is the production environment. This is where you need to be very careful. Then there are inputs when the user interacts with those agents. There are prompts, there are conversations, and then their outputs. where you can see the agent reasoning through trajectories, and you get the outcome. The response. But you also get, in case of autonomous agents, and action. This could be a script generated by the agent that runs and sends emails. It could be... a script that executes your runbook and deletes critical data, and so forth. So what are the data exposures? Well, the first question that you will be faced with is under what identity does the agent run? The first instinct is to give the agent the user identity. Well, it gets a little better when some enterprises think, let's give agent a user proxy identity for better tracking of agent activities. But this is not enough. What if the user is a super user? Now you have given agent, complete access to your critical systems. Next comes exposures on the input site, where the agent faces [5:00] Prompt injection, very similar to SQL injection that we have known for years. and unmasked conversations DSS 3, 4, data leakage, imprompts, and so forth. On the outcome side, The trajectories are unmasked, plaincast, that means the agent may reveal passwords, secrets while doing that execution? There is Unsafe actioning where the agent, as I mentioned earlier, could Generate a code and execute it on your critical systems. When you put all these risks together, risks multiply. So let's look at the Meta's approach to handling these risks. Our journey began in 2024 when we launched top-level company agent to make our employees practice. Our first challenge was indeed what is the agent identity? We progressed fast from not giving it the user identity not giving it the user proxy identity, but giving it the least privilege. And then as the agent executes, through the context infra, through the Core systems, we dynamically evaluate It's. Access at each step. You may have heard of AccessMate. We talked about it in previous years at scale. B. repurposed it, but it was not enough. we developed attribute-based access control. We developed Asian Traverse Access Control. All of this is to say... We had to evaluate At each point in time, what is the agent trying to access? Why is it trying to access? And where is it trying to access? derive attributes are out of it, run risk algorithms, And then, Give agent access in real time. The next thing we are faced with as the usage patterns emerged, is users putting their sensitive data in the chats. We quickly provide DSS-3 for masking. Prompt injection is a very well-known exposure in the industry, and there are advanced techniques there. Ilya will discuss in his talk later in the day. Unmasked conversations became a blocker. to releasing the agent to HR. We had to develop. What I call. isolation domains which allowed for sensitive chat mode. The principles here are derived from WhatsApp encrypted messaging. Every conversation that the agent has with the user, is encrypted. Not only that, The same encryption key is used on the output side for agents to mask the trajectories, the passwords that it may reveal, the secrets that it may reveal. It's also used to encrypt sensitive insights, sensitive responses. We developed Cord God. to scan the code that the agent generates before it takes action. This is how we made sure that the agent takes safe actions. On... our systems. The next thing we dealt with, was yet another interesting challenge. What about the cross-user insights? when the agent architecture progressed into multi-agent flows. One agent can pass on the insight derived for user A to another agent that may use it to derive insights for user B. That is not acceptable. We had to quickly Plug that hole by extending isolation domains again. through cross cloud. techniques. providing multi-tenancy in RAG. Let's take a deeper loop of isolation domains. Isolation domain provides a single secure substrate for end-to-end agent execution. one domain key. Her user, Parklock. When the user provides us sensitive documents, points us to sensitive Google checks to be encrypted with a key that is attached to the user identity. Later on, when the user logs into the agent and gives a prompt, During authorization, we use the same encryption key for the agent to decrypt these messages this documents, but also as it creates new persistent fonts, at each step. The same key is used to encrypt at each step. If these persistence points are created across cloud, then the cloud-specific key is used and attached to the user identity. Finally, when the output is produced, It is fully encrypted. and has complete output closure. This is how we enable end-to-end. isolated. Execution Run. for agents. And it is. [10:00] Airbolt. a new product offering. that you will hear from Henry later in the day. in the panel. It's an agentic system that allows Our top executives at Meta to run the company strategy dynamically. Summarizing our journey. We started with pointed controls. And with each point control, we increase the AI reach. We unblock one use case at a time. We moved into providing cryptographic boundaries for these agents. and that enabled new product offering, as I just mentioned. But we are not done yet. While cryptographic boundaries are great, Agents still requires an environment where it can explore deep ends of your data. independently. That is where We are now introducing Data BM. providing bounded autonomy. to our agents. Let's take a deeper look. At the core of it, DataBn is a trusted data environment. It's a logical thing. frictionless container. a sandbox for the agent to operate within. Now, when an agent interacts with health systems, It operates with a black box. So what is this black box? Well, there's a lot happening there. Then the agent sends a query Delta Viren brings in the right data at right time with right access. It runs tools to do the analysis which are quite wetted. So no internet access. and no security breaches. When it time comes to provide output, it first processes this output, making sure through data prominence, each output is traced back to the original data input. and honors the policies put on the data input. What you get back is A. Scanned command data response. This is how we allow our agents to explore broadly, but release. No. That is DWS. Enablement along with Containment. With this technology, we have fundamentally shifted the question. from. how to block agents, to how to enable them safely. Some more details. Data BM is ephemeral. It's one conversation, one container. It's scalable on day one because these containers are kept warm. The moment an agent query appears, A Data VM is ready. to execute it. Private mode becomes default. Friction for agents is reduced. With this, we try to achieve two things. One is deep end exploration of our troves of data. while honouring the use of privacy and security controls. Alright, final takeaways and unsolved challenges. First, Agent Indeterminism + Massive Parallelism combined with No Ethics and Cough. equals exponential risk exposures. Amplified data movements, Extended data definitions That means you have to rethink. Agent Covenants. Ask yourself. Are you heading for the great AI rollback? Are you providing enough reach to your AI? If you are doing so with pointed controls, they will become bandits and they will increase friction. All of this means. You have to provide agents with bounded autonomy across cloud environments if you want to build a very differentiating experience. for your easiest. Some unsolved challenges. Asian architectures are evolving very fast. Multi-agent workflows, Create governance challenges. When an agent hands off a request to another agent, An outcome to another agent? We have to re-evaluate policies at each step. Memory and process level governance. We are getting new requests. to provide. Process level isolation. Agent memories may have residual risk: the trajectories, the embeddings, the summaries, the log, they may still retain the previous conversation. We need to solve for that challenge. Accountability of agents at every point in time is very critical, especially in multi-agent workflows. Which agent performed what extra [15:00] and where did it perform and whether it was encrypted, whether it was allowed, there's a lot more to accountability and auditability than in traditional enterprise software. Finally, all of this is moot if the developer experience is not seamless. Governance has to be default mode of operation. If you want to solve some of these challenges, come join us. You can find me on LinkedIn. Thank you. Thank you.