I walked past this Okta wall at Gartner IT Symposium/Xpo in Orlando and had to stop.

"Rogue agents have nowhere to hide."

6 words. And it sums up the conversation I kept having in every hallway, booth and coffee line this week.

Every CIO I meet is excited about AI agents. Every CISO I meet is worried about them. Both are right.

Agents are moving from pilots into real work. They read your data, call your APIs, act on behalf of your people and spin up other agents. The question has shifted from "should we use agents?" to "who is keeping track of them?"

That is exactly the question the Blueprint Alliance was formed to answer. In this edition I want to break down what it is, why it matters and what you should do with it on Monday morning.

The problem: 150,000 agents and a 13% readiness rate

Here are 2 numbers every leader should sit with.

Gartner predicts that by 2028, the average global Fortune 500 enterprise will have more than 150,000 agents in use. Only 13% of organizations think they have the right AI agent governance in place today.

Read that again. Most companies are building the plane while it is already carrying passengers.

The reason this is hard comes down to how agents work. A useful agent does not live in 1 system. It reasons with a model from 1 provider, pulls data from another platform, acts inside a SaaS app, travels over your network and runs on your cloud infrastructure.

Every one of those hops is a trust boundary. And at every boundary, 3 things tend to go wrong:

• Shadow agents multiply. Teams build or import agents faster than security can see them.

• Credentials cross trust boundaries. A token issued in 1 place quietly gets used in 5 others.

• Agents act beyond their intended scope. An agent built to summarize tickets ends up with write access to production.

No single vendor owns that whole chain. That is the honest truth of the agentic stack. So no single vendor can secure it alone.

Enter the Blueprint Alliance

On 22 September 2026, Okta and 11 other industry leaders formed the Blueprint Alliance. It is a multi-vendor coalition with 1 goal: help organizations run their agentic stack as a unified, governed system.

Look at who is in the room. These companies compete with each other in plenty of places. Here they agreed to build together.

The advisors are my favourite part. GE Appliances brings a real manufacturing floor. World Central Kitchen brings disaster response at global scale. These are the environments where a misbehaving agent has real consequences, and they are helping validate that the architecture works outside a slide deck.

Brian Stoll, CTO of World Central Kitchen, said WCK wants governance "as dynamic as the agents themselves" and added, with some honesty I appreciated, that he is hoping for a better night's rest as a CTO. Every technology leader reading this knows that feeling.

New members will be added over time, so the blueprint keeps evolving.

The blueprint in 4 questions

The Alliance took the blueprint for the secure agentic enterprise, first introduced by Okta in March 2026, and expanded it into an open, multi-vendor reference architecture. It is published for anyone to use.

What I like most is how simple the front door is. The whole thing is organized around 4 questions any board member could ask you tomorrow.

1. Where are my agents?

You cannot protect what you cannot see. The blueprint starts with discovery: catalog every agent, whether your team built it, it came bundled inside a SaaS tool, or someone spun it up without telling anyone.

Then each agent gets registered as its own verified identity, with an accountable human owner or team. That 1 step changes everything. An agent with an owner is a system. An agent without an owner is a liability.

2. What can they do?

Once an agent has an identity, it needs boundaries before it acts. The blueprint says scope access to the task, and avoid standing privilege.

Think of it like a contractor badge that opens 1 floor for 1 afternoon, instead of a master key that never expires. Delegation also has to stay traceable as agents spawn sub-agents and act on behalf of humans. And the same joiner, mover, leaver discipline you use for employees now applies to agents and even to model versions.

3. What are they doing?

Identity and permissions are only half the picture. Agents need to be watched while they run.

The blueprint puts gateways inline, in the actual execution path, to enforce policy and watch for data leakage, prompt injection and odd behavior during the session. It also tracks every downstream resource an agent can reach, from MCP servers and SaaS apps to data stores and payment systems. That way you always know the blast radius.

4. How do I respond?

When something goes wrong, you need a precise response. Revoke a token, end a session, rate-limit, or quarantine 1 agent, without taking down everything around it.

The part most frameworks skip is recovery. The blueprint brings a contained agent back through re-attestation and staged re-enrollment, so every reinstatement is deliberate, documented and auditable.

Underneath all 4 sits execution context and risk signals, fed by runtime telemetry and logging. That is the connective tissue that lets the pieces react together.

6 principles worth printing out

The founding members aligned on a shared set of principles. I would honestly put these on a wall in every security team's office:

1. Treat every agent as a first-class identity.

2. Scope access to the task, with no standing access.

3. Keep delegation traceable.

4. Monitor runtime behavior continuously.

5. Make containment instant and reversible.

6. Make governance adapt at the speed AI moves.

Number 5 is the one I keep coming back to. Reversible containment means security can act fast without fear of breaking the business. That is how you get security and innovation to stop fighting each other.

Why this is more than a logo slide

I have seen plenty of industry alliances that end at the press release. 2 commitments make this one different.

• Cross-vendor signal sharing. Members are building and testing interoperability across open standards including MCP, OCSF, SSF and CAEP. The goal: a threat raised by 1 vendor's runtime monitor triggers real-time action across every connected control plane.

• Published reference integrations. Members will regularly publish joint interoperability results, so you can see what actually works together.

In plain English, if CrowdStrike spots something odd, Okta can revoke access and Zscaler can cut the connection, without your team copying alerts between 3 consoles at 2am.

Steven Tamm, SVP of Ecosystem at Okta, put it well: the blueprint exists because customers needed 1 consistent way to secure agents across the whole stack, without shutting down the autonomy that makes agents useful in the first place.

What I would do on Monday morning

If you are a CIO, CISO, CTO or security architect, here is a simple way to start. Take the 4 questions into your next leadership meeting and answer them honestly.

1. Where are my agents? Can you produce a list of every agent running in your company today, with an owner next to each one?

2. What can they do? How many of those agents have standing access they do not need for their task?

3. What are they doing? If an agent leaked data at 3pm today, would you know by 4pm?

4. How do I respond? Can you shut down 1 agent without shutting down the workflow around it, and bring it back safely?

If you get 4 confident answers, you are ahead of most of the market. If you do not, you now have a free, open reference architecture built by 12 of the biggest names in the stack to guide you.

The companies that win with agents will be the ones that can move fast because they trust what they have deployed. This blueprint is a very good place to build that trust.

Explore the Blueprint Alliance and download the blueprint here: okta.com/blueprint-alliance

Follow Okta and Blueprint Alliance on LinkedIn for the reference integrations as they are published.

Tell me in the comments: which of the 4 questions is hardest for your team to answer today?

#OktaPartner #blueprintalliance #okta #agenticai #aisecurity #identitysecurity #zerotrust #cybersecurity #theravitshow

Sources

• Industry leaders form the Blueprint Alliance, Okta press release, 22 September 2026

• Blueprint for the Secure Agentic Enterprise, Okta

• Blueprint Alliance whitepaper

• Gartner on AI agent sprawl, 28 April 2026