Mandate Agent-Level Controls Before Procuring AI Production Platforms

AI reading

Kore.ai launched the Artemis Agent Platform on Microsoft Azure aimed at moving AI agents from pilot to production. The platform emphasises an Agent Blueprint Language, an agent architect called Arch, and integrations with Microsoft identity and security services that make identity-integration a procurement requirement. Watch whether buyers insist on live PoC evidence of logging and enforcement rather than accepting certification claims alone

Buyer takeaway

Treat Artemis as a production-capable offering that requires PoC acceptance tests for identity, logging and governance because the vendor positions it for operational agent rollouts

Cost / money

Budget for cloud consumption and identity-integration professional services in addition to any licence fees because Azure-hosted platforms shift run costs onto cloud consumption

Supplier / commercial

Expect Microsoft ecosystem partners and system integrators to package implementation services; procurement must map implementation SLAs and ongoing support ownership

Safety / operations

Certifications reduce certification effort but do not prove runtime enforcement; require live evidence of per-action logging and approvals during acceptance

What to watch

Verify that the Azure integrations and claimed authorisations can be demonstrated in a PoC and that evidence includes action-level logging

Key facts

• Built on Microsoft Azure with integrations to Entra ID and Microsoft Graph API
• Introduces an Agent Blueprint Language (ABL) and an agent architect (Arch)
• Vendor cites SOC 2, ISO 27001, PCI DSS and FedRAMP Moderate among compliance claims

Source excerpts

Used in this brief

• Next 2-4 weeks — Run a technical validation with shortlisted integrators to demonstrate agent platform integration with the organisation's identity provider and to exercise log/retention behaviour.. Rationale: because Kore.ai positions Artemis on Azure with Microsoft identity integrations and buyers must prove those integrations operate under local policies.. Owner: Ops. KPI: Validated integration steps, identified gaps and an SOW-ready list of integration tasks for contract negotiation
• Added a production-focused agent platform launch (Kore.ai Artemis) as a concrete supplier capability to evaluate during RFx and PoC planning; this is new since the prior brief
• Kore.ai launched the Artemis Agent Platform on Microsoft Azure aimed at moving AI agents from pilot to production. The platform emphasises an Agent Blueprint Language, an agent architect called Arch, and integrations with Microsoft identity and security services that make identity-integration a procurement requirement. Watch whether buyers insist on live PoC evidence of logging and enforcement rather than accepting certification claims alone

AI reading

Versa released per-action Zero Trust controls for AI agent actions in its Verbo AI tool (Release 23). The capability applies identity checks, role-based access controls and policy rules to each agent-generated action and logs approved actions with attribution, making per-action approvals a verifiable control. Buyers should include test cases that exercise approve/block paths and audit retention during PoCs

Buyer takeaway

Require vendors to demonstrate action-level enforcement in a PoC because these controls are the operational mechanism that prevents unapproved agent changes

Cost / money

Expect licensing and ongoing operational overhead for approval workflows and potential professional services to integrate with ticketing and identity systems

Supplier / commercial

Vendors offering these controls can claim lower operational risk; procurement should capture that as contractual SLA trade-offs and acceptance criteria

Safety / operations

Action-level approvals and attribution reduce the risk of runaway changes, but logging, retention and approval latency must be contractually defined

What to watch

Confirm compatibility with existing connectors and the Model Context Protocol; require PoCs that exercise block/approve and audit paths

Key facts

• Per-action identity checks and RBAC applied before agent actions execute
• Administrators can require human approval, allow automatic actions, or block actions based on
• Approved actions are logged with attribution to create an auditable trail

Source excerpts

Used in this brief

• Safety / operations: Agentic AI without action-level identity checks or approval workflows increases the risk of unauthorised or cascading changes in production systems
• Safety / operations: Limited ability to inspect AI traffic and fragmented policies will expand detection blind spots and extend incident response scope for operations teams
• Next 72 hours — Tag suppliers and live proposals that claim 'agent governance' or per-action controls in the supplier register and flag contracts for addendum review.. Rationale: because Versa and Kore.ai now market per-action governance as a procurement differentiator and these capabilities must be contractually testable before awards.. Owner: Contracts. KPI: Supplier register annotated with agent-governance flags and candidate contract addenda identified for negotiation

AI reading

Check Point's cloud security report highlights a material gap between organisations updating cloud security strategy for AI and those with architectures that can enforce policies. The survey notes limited AI-traffic inspection, fragmented policies and a high rate of AI-related incidents, making architecture and runtime enforcement a procurement priority. Watch vendor PoCs for real enforcement across hybrid environments rather than roadmap statements

Buyer takeaway

Prioritise suppliers that can demonstrate enforcement in hybrid environments because survey data shows enforcement capability lags strategy across many organisations

Cost / money

Procurement should plan to fund architecture redesign, runtime inspection tools and identity-based controls to close enforcement gaps

Supplier / commercial

Vendors that provide unified policy control and runtime protection will be in higher demand; use RFx criteria to surface proven offerings

Safety / operations

Limited inspection and fragmented policies increase incident detection and response complexity; suppliers must prove runtime protections to reduce operational exposure

What to watch

Ask for specific test cases demonstrating AI traffic inspection and policy enforcement; avoid awards based on strategy-only statements

Key facts

• Significant gap between organisations updating cloud security strategy for AI and those that
• Many respondents cannot fully inspect AI traffic or enforce AI-specific access controls
• High incidence of reported or suspected AI-related security events indicating operational exp

Source excerpts

Used in this brief

• Next 2-4 weeks — Add PoC requirement templates to RFx that explicitly test per-action approvals, audit logging, and identity-provider integration during evaluation stages.. Rationale: because Check Point data shows a strategy-to-execution gap in enforceable architectures and procurement needs PoC evidence rather than strategy statements.. Owner: Category. KPI: Comparable PoC responses that validate enforcement controls and integration with identity stacks to inform shortlist decisions
• Included an industry survey (Check Point) quantifying the gap between AI strategy and enforceable architectures, strengthening the need to budget for runtime enforcement work
• Check Point's cloud security report highlights a material gap between organisations updating cloud security strategy for AI and those with architectures that can enforce policies. The survey notes limited AI-traffic inspection, fragmented policies and a high rate of AI-related incidents, making architecture and runtime enforcement a procurement priority. Watch vendor PoCs for real enforcement across hybrid environments rather than roadmap statements

AI reading

Exabeam appointed Chillisoft Australia as a distribution partner to expand local distribution, training, PoC and support capabilities in Australia. The move changes the local route-to-market and shifts some delivery responsibilities to the distributor, making vendor/distributor contractual handoffs operationally important. Procurement should map which party signs support warranties and who delivers PoCs before relying on distributor-led execution

Buyer takeaway

Map which contractual obligations (support SLAs, PoC delivery, training) are owned by the distributor versus the vendor because the procurement counterparty can change after distribution deals

Cost / money

Distributor involvement may reduce time-to-deploy but can add margin layers; require transparent pass-through pricing and PS rates in commercial terms

Supplier / commercial

Expect distributors to negotiate local terms and service bundles; include reseller performance obligations and handover SLAs in sourcing documents

Safety / operations

Local partner support can improve deployment success and speed incident response if SLAs and capabilities are validated up-front

What to watch

Validate local PS capacity, training availability and who owns escalation; require distributor commitments for handover and warranty support

Key facts

• Chillisoft Australia to distribute Exabeam's security operations platform locally
• Distributor to support training, pre-sales, PoCs and customer support in Australia
• Move intended to accelerate deployments and shorten sales cycles through local partner enable

Source excerpts

Used in this brief

• Next 72 hours — Identify which shortlisted vendors will be delivered via distributors and collect named pass-through pricing, PS availability and escalation contacts.. Rationale: because distribution deals (for example Exabeam via Chillisoft) change who provides PoCs, training and first-line support and that alters contractual responsibilities.. Owner: Contracts. KPI: Documented distributor pass-through clauses, PS capacity statements and mapped escalation contacts for shortlisted vendors
• Exabeam appointed Chillisoft Australia as a distribution partner to expand local distribution, training, PoC and support capabilities in Australia. The move changes the local route-to-market and shifts some delivery responsibilities to the distributor, making vendor/distributor contractual handoffs operationally important. Procurement should map which party signs support warranties and who delivers PoCs before relying on distributor-led execution
• Buyer bottom line: distribution changes alter who delivers PoCs, training and first-line support—procurement must verify channel SLAs and price pass-throughs before awarding distributor-mediated implementations