Menlo Park, VB Transform 2026 — Dev Rishi, Rubrik’s GM of AI, described at a fireside chat organized around an Anthropic CISO roundtable how widely shared AI governance policies often lack practical enforcement. Rishi said roughly 14 attendees at the roundtable could show written policies, but when asked how they actually enforce those policies, the room laughed: organizations have rules on paper but no scalable way to make them real.
Rubrik’s technical response is SAGE, the Semantic AI Governance Engine: an arbitration layer inside Rubrik Agent Cloud that monitors every agent action, interprets semantic intent, and judges each action against natural‑language policies in real time. Rishi framed the product around a distinction between capability and judgment: autonomy is a settled capability for agents, the open question is whether a given organization should allow it.
Background to the effort
Rishi previously co‑founded and led Predibase, a generative AI infrastructure startup Rubrik acquired in June 2025. He also led ML product work at Google on the team that became Vertex AI, was Kaggle’s first product manager, and holds bachelor’s and master’s degrees in computer science from Harvard.
In his first roughly three and a half months at Rubrik, Rishi held about 200 conversations with IT and security leaders across a Global‑2000‑like customer base. He reported that while cost, latency and performance came up, the dominant concern across those discussions was security and risk approval — getting AI use approved from a governance standpoint was the primary constraint on ROI.
Research and numbers that shaped SAGE
Rubrik Zero Labs’ April report, "The State of the Agent," surveyed more than 1,600 IT and security leaders and found that roughly 80% of respondents were in the bind where monitoring and approving agent actions consumed more time than the agents saved.
VentureBeat Pulse research presented at Transform found that 66% of enterprises already allow or are building toward production deployment with zero human review, yet only 5% fully trust the automated evaluations that would make that decision.
A separate June VentureBeat Pulse survey of 107 qualified enterprise respondents found that 69% of companies run credential sharing somewhere in their agent fleet. Firms that used shared credentials reported a security incident or near‑miss at a 63.5% rate (47 of 74), compared with a 40.9% rate (9 of 22) where every agent had its own scoped identity.
These findings reinforced Rubrik’s conclusion: many organizations maintain policies, but lack a scalable way to enforce them semantically.
How SAGE works
Rubrik’s "YOLO" mode removes the permission prompt from agent workflows and lets agents act autonomously. In Rubrik’s architecture, SAGE functions as a second AI that judges each step in real time instead of a human approving actions. The pitch to security teams was framed as replacing a human‑in‑the‑loop idea with "AI‑in‑the‑loop."
SAGE emphasizes intent detection rather than brittle field‑level rules. For example, a rule like "agents should not edit revenue fields in Salesforce" fails in conventional tooling because Salesforce doesn’t explicitly label which fields constitute revenue; defenders therefore revert to manually approving every Salesforce action. SAGE instead reads intent and applies organizational context to distinguish an innocuous lookup from a forbidden edit.
Economics matter: SAGE runs on a small language model that Rishi said operates at an order of magnitude lower cost and latency than frontier LLMs. Rubrik uses parameter‑efficient fine‑tuning to produce an aggregation of judges: different lightweight judges handle task‑specific variants of a base model with shared organizational context. One judge watches for tool‑use hallucinations, another suppresses PII before it can leave, and security and GRC teams are already writing financial and spend rules into the same layer.
The "lethal trifecta" and composition risk
Rishi called out the "lethal trifecta," a term coined by security researcher Simon Willison in June 2025, to describe an agent that holds private data, ingests unvetted external content, and has a channel to exfiltrate data. The core risk is compositional: individually legitimate permissions (e.g., Salesforce access and email access under the same employee credentials) can combine to enable accidental or intentional exfiltration. Rubrik’s experience includes repeated attempts by Claude Code to leak sensitive source code to a public GitHub, illustrating that cutting agents off from public resources entirely undermines their usefulness — the problem therefore shifts to adjudicating intent in context rather than blanket revocation of access.
VentureBeat’s survey data complements this: credential sharing correlates with higher incident rates, suggesting composition of permissions is a real operational hazard.
Backtesting, batch analysis, and recovery gaps
Rubrik Agent Cloud reached general availability in February (features continue rolling out). One incoming capability is backtesting: replaying historical agent actions and tool calls against a new policy to show where the policy would have intervened and where actions would have passed undetected, with policy edits applied in real time. Rubrik treats that archive as a valuable trove of enterprise data.
Real‑time detection and blocking are an entry point, but not a complete solution. Some attacks never trip a single‑action rule; a full session trace can reveal problematic behavior that no isolated turn would. Agent Cloud therefore runs batch analysis across session traces hourly or daily and surfaces "insights" — problems no single guardrail caught. The Zero Labs report also found that 88% of respondents lack the ability to roll back agent actions without disrupting systems, a recovery gap that aligns with Rubrik’s legacy backup and restore business.
The open governance question: who watches the watcher?
A skeptical CISO question remained unanswered: SAGE is a non‑deterministic model policing other non‑deterministic models, and Rubrik did not provide false positive or false negative rates for the judge itself. The architecture leans on auditability — backtesting and batch insights leave a human‑reviewable trail of each SAGE decision and whatever got past it — but audit logs are receipts, not a benchmark. Until a standard benchmark exists to measure the judge’s accuracy, AI‑in‑the‑loop governance remains an operational wager rather than a quantified control.
Three practical questions for security teams emerge from the session: how many current guardrails depend on a human clicking approve and what happens to that workload as agent counts scale; does the stack enforce semantic intent or is it still allow/deny lists; and can teams backtest agent behavior against new policies and then unwind multi‑turn sessions without taking systems offline?
Market timing and demand
VentureBeat research cited by Rubrik shows 82% of enterprises still rely primarily on their AI provider’s built‑in guardrails and cloud controls as their main agent security layer, and 59% plan to adopt, add, or replace agent security tooling within the next 12 months. Only 12% are considering an agent‑identity product, despite credential sharing remaining common.
Rubrik built SAGE to fill the gap between written policies and enforceable controls. The bet — YOLO mode overseen by an AI judge — assumes an AI watching other AIs can operationalize policies. The missing piece is a benchmark to quantify the judge’s reliability; without it, the approach is auditable but not yet a measured control.
