Topic starter
19/08/2026 4:08 pm
TL;DR: Shared traces are what make AI agent governance auditable across evaluation, runtime control and observability, according to Arize. Without OpenInference, teams are left with fragments of evidence that are harder to review, replay and compare across frameworks.
Editorial analysis by NHI Mgmt Group, based on content published by Arize: “Microsoft’s open trust stack runs on OpenInference”.
Key questions
Q: Why do agent governance controls need to sit outside the model?
A: Controls outside the model are easier to review, version and enforce consistently across frameworks.
Q: How do security teams know whether an AI agent followed the right path?
A: They need traces that include tool calls, routing decisions, intermediate model steps and control outcomes, not just final text.
Q: How should teams govern AI agents that use tools during evaluation?
A: Treat the agent’s permissions as part of the test itself.
Practitioner guidance
- Define a shared agent trace contract Standardise the spans, events and metadata your evaluation, control and observability tools must consume so policy decisions can be compared across environments.
- Test agent behaviour against specifications Write behavioural specs that include allowed tools, prohibited actions and expected routing paths, then use them to generate regression cases.
- Externalise runtime controls Place high-risk checks outside the model at input, tool and output checkpoints so governance survives framework changes and is logged consistently.
Bottom line: AI agent governance becomes materially harder when evaluation, runtime control and observability do not share the same trace evidence.
Glossary terms: Trace Contract, Runtime control, Spec-Driven Evaluation, Agent Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
19/08/2026 4:41 pm
OpenInference is the missing governance layer for agent evidence. The article shows that evaluation, enforcement and observability only become durable when they share the same trace contract. Without that contract, teams can claim control coverage in one tool and lose the audit trail in another, which weakens both assurance and incident investigation. Practitioner conclusion: treat trace portability as a governance requirement, not an observability preference.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What does shared telemetry change for AI agent accountability?
A: Shared telemetry makes the agent’s behaviour auditable across evaluation, runtime and production, so governance can rely on evidence rather than assumptions. That improves accountability because the same trace can show what the agent tried, what was blocked and what was allowed. It also makes framework changes less disruptive to control validation.
👉 Read our full editorial: Microsoft’s open trust stack ties agent controls to shared traces