Remember that scene where Grommit lays out the track while the train is going down an unbuilt section in Wallace & Grommit. Well thats what enterprise, AI coding agents and AI productivity tools rollouts are like in 2026. CTO says we need AI agents yesterday, MDM reports everyone has had it for a year anyway and your CISO says what are our controls.

This is the war stories of a SOC and DevSecOps team rolling out agentic controls as we figure things out. This is a pro-active vs reactive story of all the disucssions, policy work, controls and incident response over the period.

The talk will cover the following topics:

• Rolling out claude code enterprise
• AI agent controls
• Sandboxing
• MDM and EDR
• OTEL for Agents
• Costs: economic, incident, cognitive load
• SDLC in the agentic era.
• When automation goes wrong.
• Security team leading the way with the torch of controls, education and setting the standard.
• Opportunities for security team to use the tools for creating tools, vuln discovery.
• Security validation testing on these controls

Takeaways:

• Agents, LLMs, etc pros and cons.
• Infosec, Dev, Devops, Infra, etc have always been early adopters. Better they debug tech than the general public debugs medical answers.
• SDLC is still relevant, might need tweaks
• Ownership is key, claude doesn’t own your code, your responsibility remains
• Trust but verify
• Sandboxing is back
• Enterprise is king ($$$$)
• Manage risk, enable efficiency
• Lead by example, get devs interested and involved.