What the Berkeley Agentic AI Summit Tells Us About Governing Agents

A research summit, not a product launch

The Berkeley RDI Agentic AI Summit 2026, held earlier this year, was a research conference, not a vendor showcase. Its poster sessions covered the full "agent stack": the models that plan, the tools they call, the memory they keep, and the guardrails that are supposed to keep them in line. For governance teams, the interesting part is not any single poster. It is the direction of the research as a whole. Agents are getting better at acting on their own, and the governance playbook for them is still thin.

What the research actually shows

A common thread in the posters was the gap between an agent's reasoning and its actions. Several papers proposed better ways to log and trace what an agent does, step by step. Others focused on sandboxing: giving an agent a constrained environment where it can experiment without touching real systems. A few looked at how agents handle ambiguous instructions, and how they decide when to ask for help versus when to act.

None of this is a failure. It is normal research progress. But the themes line up with the failure patterns we already know from production systems. The Bing and Copilot demos in 2023 showed how hidden text in web pages could hijack an assistant into leaking data. Air Canada's chatbot invented a refund policy in 2024, and the airline was held liable. Knight Capital's trading algorithm lost $440 million in 45 minutes in 2012 because a deployment went wrong. Agents multiply these risks: they act across more tools, with more autonomy, and often with less human oversight.

What this means for governance teams

If you are responsible for AI risk, the summit's research agenda is a useful checklist. Ask whether your organization can answer three questions about any agent in production:

• What actions is it allowed to take, and who approved that list?
• How do we stop it quickly if it goes off track?
• How do we know what it actually did, after the fact?

The EU AI Act's high-risk rules, which apply from December 2027, require things like human oversight and accuracy. The OWASP LLM framework gives practical guidance on input/output filtering and least-privilege tool access. But the research at Berkeley suggests that the technical controls are still maturing. Governance cannot wait for the perfect tool; it has to work with what exists.

Key risk indicators to track

Start measuring what matters, even if the numbers are rough at first. Three indicators are particularly useful for agentic systems:

• High-risk actions taken without review. The target is zero. If an agent can send an email, transfer money, or change a config, that should require a human check.

• Mean time to stop a misbehaving agent. If an agent starts doing something wrong, how long does it take to halt it? This is your kill-switch metric.

• Agents in production without a registry entry. You cannot govern what you do not know exists. Keep a list of every agent, what it can do, and who owns it. The target is zero unregistered agents.

These indicators are not hypothetical. They come directly from the incident patterns above. Hidden instructions, invented policies, and runaway automation all show up as failures in these metrics.

The role of observability

One thing the summit made clear is that observability is not an afterthought. You cannot review an agent's actions if you have no record of them. That means logging not just what the user typed, but what the agent retrieved from documents, what tools it called, and what it returned. Tools like Argus (argus.threatclaw.ai) are built to capture those traces and scan for attacks hidden in retrieved content, not just in user prompts. Governance decides what an agent is allowed to do; observability shows what it actually did.

What to do

1. Inventory your agents. If you do not have a registry, start one this week. List every agent, its purpose, its tool access, and its owner.

2. Define high-risk actions. Sit with the system owners and agree on which actions require human review. Write them down. Start small.

3. Test your kill switch. Do a drill where you deliberately make an agent misbehave in a sandbox and time how long it takes to stop. Fix what breaks.

4. Review your logging. Can you reconstruct what an agent did, step by step, for any given day? If not, that is your first gap to close.

5. Keep watching the research. The Berkeley summit is one data point. Follow the work on agent tracing and sandboxing. It will shape the tools you will be using in two years.

The agents are coming. The governance work is not glamorous, but it is the difference between a useful tool and a costly incident.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.