Presented by Red Hat and Carahsoft

Government cybersecurity policies have largely been written with people in mind. Employees receive training, read procedures, and work within technical restrictions. As AI agents begin taking action inside agency environments, John Dvorak, CTO, Public Sector at Red Hat, said organizations need a more explicit connection between written policy and enforceable controls.

In an interview with Fed Gov Today at the Google Public Sector Summit, Dvorak explained that agencies cannot rely on an agent to exercise the same judgment expected of an employee. A person who encounters information outside their responsibilities might recognize the problem and report it. An agent’s access must be bounded through technical means.

Dvorak argued that those guardrails should sit outside the agent. Training a model on policy does not provide sufficient assurance that its future behavior will remain within the intended limits. Agencies need controls that govern what the agent can access and do, with a clear relationship to the underlying requirement.

Translating policy into code is therefore a practical implementation challenge. Legislation, executive direction, standards, and agency rules are expressed in documents. Turning those requirements into restrictions an operating system or application can enforce requires resolving ambiguity and deciding how the policy applies to an agent’s work.

Dvorak discussed asago, an open source initiative involving Red Hat and other participants, as an effort to connect those activities. He described work on translating policy documents into controls, testing those controls, and observing agent behavior after deployment. The intent is to maintain traceability between operational safeguards and the policies they support.

That connection matters when agencies need to explain why an agent was allowed to perform a particular action or why a restriction exists. It also gives testing a concrete purpose: evaluating whether the implemented boundaries reflect the organization’s stated requirements. Dvorak emphasized an approach that can work across vendors and industries.

Data management is inseparable from the discussion. Agencies have spent years identifying information, assigning access, and working toward zero trust practices. Dvorak said that work remains incomplete in many environments. Introducing agents can make the unfinished areas harder to ignore.

An agent that can rapidly examine available information may encounter weaknesses that employees have not discovered. Dvorak warned against depending on the assumption that an access problem is harmless because nobody has found it. Automation can expose those gaps much faster than organizations are accustomed to seeing.

For security teams, that means agent deployment and data access review belong in the same conversation. Understanding where information resides, who should have access, and under what conditions remains necessary as the identities performing work expand beyond people. Unresolved access questions become part of the agent’s operating environment.

Dvorak’s message was to treat AI governance as something agencies must implement and test. Written expectations need enforceable boundaries, and those boundaries need continued observation as agents operate. Connecting policy, data access, and technical controls gives agencies a clearer way to evaluate whether autonomous activity stays within the authority they intended to grant. It also makes existing security gaps more visible before they spread across automated workflows.