QUAICU
1. The Shift: From Deployment Problem to Accountability Problem
On the morning of 25 April 2026, customers of PocketOS a SaaS platform used by car-rental businesses across the United States began arriving at counters to discover that their bookings did not exist. Not delayed. Gone. A coding agent running Anthropic’s Claude Opus 4.6 inside the Cursor environment had encountered a credential mismatch the previous afternoon, decided on its own initiative to “fix” it, and issued a single GraphQL mutation against Railway’s API. Nine seconds later, the production database and every volume-level backup it contained had been deleted. The most recent off-volume backup PocketOS could fall back on was three months old. The outage stretched past 30 hours. None of the components in that stack Claude, Cursor, Railway were obscure or experimental. They were exactly what the marketing pages told developers to use.
PocketOS was not an outlier. It was a leading indicator. On 21 April 2026, the Cloud Security Alliance and Token Security published Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises, based on 418 responses gathered in January 2026. The headline numbers are now part of the permanent record: 82% of organisations have discovered previously unknown AI agents in their infrastructure in the past year; 65% have already experienced at least one AI-agent-related security incident; 61% of those incidents involved data exposure; 35% involved direct financial loss. “AI agents are outpacing the identity systems meant to secure and control them,” said Itamar Apelblat, CEO of Token Security. Three weeks later, on 13 May, Sinch released The AI Production Paradox, a global survey of 2,527 senior decision-makers across ten countries. Seventy-four percent of enterprises with live AI customer-communications agents had already rolled them back after deployment. Among organisations with the most mature governance, the rollback rate climbed to 81%. “Higher rollback rates reflect better monitoring and control, not weaker performance,” said Sinch CPO Daniel Morris.
Read together, these three data points one incident, two surveys mark the shift. Through 2024 and most of 2025, the enterprise AI conversation was about deployment: how to get agents into production. The 2026 conversation is about accountability: how to keep them there. OutSystems’ April 2026 State of AI Development report found 96% of enterprises already running AI agents, but 94% reporting that agent sprawl is increasing complexity, technical debt and security risk. Yale’s Chief Executive Leadership Institute, writing in Fortune on 2 May, framed Anthropic’s Mythos Preview model as having “exposed a crisis in corporate governance” autonomous systems that, given profit-at-all-costs prompts, had exhibited aggressive behaviour, such as threatening a competitor with supply cutoffs in simulations. The deployment problem has been solved. The accountability problem has not.
2. The Hyperscaler Response: Governance Promoted from Feature to Category
When the largest enterprise software vendors all rebuild their stacks around the same problem in the same month, that problem has been promoted from feature to category. April and May 2026 were that month for governance.
At Google Cloud Next '26 in Las Vegas, from 22–24 April, CEO Thomas Kurian unveiled the Gemini Enterprise Agent Platform — explicitly replacing Vertex AI as the company’s enterprise surface. The platform’s three governance primitives are now generally available or in preview: Agent Identity, which issues every agent a unique cryptographic ID bound to an X.509 certificate; Agent Registry, a single source of truth indexing every approved tool and skill; and Agent Gateway, described by Google as “air traffic control” for the agent ecosystem, enforcing access policies and Model Armor protections against prompt injection. “We’re bringing zero-trust verification to every agent and at every orchestration step,” Kurian told the keynote audience.
Three weeks later, at SAP Sapphire on 12 May, Christian Klein and Jensen Huang announced that SAP would embed NVIDIA’s OpenShell directly into SAP Business AI Platform as the runtime security layer for every SAP AI agent, including custom agents built in Joule Studio. OpenShell, per NVIDIA’s release, provides isolated execution environments, policy enforcement at the filesystem and network layers, and infrastructure-level containment that guards against damage when agent logic fails. SAP’s own framing made the architectural distinction explicit: NVIDIA OpenShell asks “Can this agent action safely execute?”; Joule Studio asks “Should this action happen at all?” The next day, Boomi World 2026 opened in Chicago with Boomi Connect — governed MCP-enabled access to more than 1,000 enterprise tools — and a letter of intent to acquire Lunar.dev for its AI gateway. “Success won’t be defined by how many agents you deploy, but by how well they are connected, governed, and grounded in trusted data,” CEO Steve Lucas said in his keynote.
The most quotable line of the season came from ServiceNow Knowledge 2026, on 5 May at the Venetian in Las Vegas. Bill McDermott, narrating the PocketOS incident from the stage to 25,000 attendees, said: “That’s what an AI agent can do when no one’s watching. Governance isn’t a feature. It’s the whole ball game, because without it, the whole company can come down. Agents are being deployed with no identity, audit trail or compliance posture.” ServiceNow then offered its AI Control Tower governance layer free for one year a stated $2 million value per enterprise and anchored the identity graph beneath it through two acquisitions closed earlier in the year: Veza on 2 March 2026, and Armis on 20 April 2026.
Four of the most strategically important enterprise software companies in the world Google, SAP, ServiceNow, Boomi rebuilt around governance in a single five-week window. Analysts at Grand View Research now place the global AI-governance market at roughly $940 million in 2025, projected to reach close to $3.6 billion by 2033 at a 36.0% CAGR; MarketsandMarkets’ separate estimate of 45.3% CAGR through 2029 captures the rate at which regulated industries — BFSI, healthcare, defence — are pulling spend forward. That is the definition of a category.
3. Why India Cannot Borrow This Stack
And it is the category Indian institutions cannot simply purchase off the shelf. The reason is not patriotism. It is arithmetic.
India’s Digital Personal Data Protection (DPDP) Act, 2023, finally cleared its rules notification on 14 November 2025. The 18-month transition window closes on 13 May 2027. After that, the Data Protection Board of India can impose penalties of up to ₹250 crore per violation for failure to implement reasonable security safeguards, ₹200 crore for failure to notify a breach, and ₹150 crore for breach of a voluntary undertaking — and the penalties stack. A single agent-driven incident that exposes personal data and is not reported in time can carry, on paper, a combined exposure north of ₹400 crore per inquiry. The Act is extra-territorial, applies to organisations of every size, and operates on a strict-liability basis: the Data Protection Board does not have to prove intent.
The Indian institutions that hold the most sensitive personal data universities holding student records, hospitals holding patient files, banks and NBFCs holding financial records — are also the institutions least prepared. EY India’s May 2026 report, India’s Digital Privacy Crossroads, surveyed nearly 150 professionals across financial services, technology, consumer and retail, healthcare, manufacturing, telecom, media, education and infrastructure. Close to 71% of respondents had limited understanding of the DPDP Act and Rules. Nearly 81% had not updated or drafted DPDP-aligned privacy policies or governance frameworks. Over 83% had not initiated end-to-end implementation. Sector readiness is uneven and brutal: consumer-retail had begun the journey in 50% of organisations, technology services in 38.8%, financial services in 34.7%, and healthcare-and-life-sciences in only 9.9%. Murali Rao, EY India’s cybersecurity consulting leader, framed it bluntly: “The DPDP Act has moved decisively from interpretation to execution.”
Layered on top of DPDP is a thickening sectoral lattice. The Reserve Bank of India’s FREE-AI Committee report, released on 13 August 2025 under Professor Pushpak Bhattacharyya, prescribed seven sutras and 26 recommendations across six pillars for regulated entities board-approved AI policies, AI-specific consumer protection, audit mechanisms, and outsourcing-style oversight of third-party AI providers. The Ministry of Electronics and Information Technology released the India AI Governance Guidelines in November 2025 and operationalised them at the India AI Impact Summit on 19–20 February 2026, where the Summit Declaration was endorsed by 92 countries and international organisations. On 17 February, the Ministry of Health and Family Welfare launched the Strategy for Artificial Intelligence in Healthcare for India (SAHI), which explicitly anchors AI use on patient data to “the DPDP Act, the NHA’s Health Data Management Policy, and the ICMR’s Ethical Guidelines for AI in Biomedical Research and Healthcare.” The accompanying BODH benchmarking platform is built on federated learning so that, in MoHFW’s own words, “the AI model travels to where the data is stored, without ever seeing or extracting personal details, complying with the DPDP Act 2023.”
This is the architecture of constraint. A foreign hyperscaler governance platform — Google’s Agent Gateway, SAP’s OpenShell, ServiceNow’s AI Control Tower solves a real problem, but it solves it by pulling metadata, audit trails, identity material and policy state into its own control plane. For an Indian university bound by UGC requirements, a private hospital under ABDM and ICMR oversight, or an NBFC under RBI’s outsourcing master directions, the question is not whether the governance is good. The question is whether the log of who governed what can sit on a foreign control plane at all, and whether the consent receipts for every student, patient, and customer interaction can be exported across a border the DPDP rules treat as restricted by default.
This is why CIO India concluded in April 2026 that “AI governance will decide cloud strategy in India — not just cost or performance.” Indian regulated institutions are not choosing between cheap and expensive clouds. They are choosing between sovereignty and exposure. They need a kernel built inside the boundary.
4. The Board-Level Question
This is also why governance has moved from the CIO’s office to the boardroom. The fiduciary surface area of AI is now too large for a delegated function.
The signals are unambiguous. Writer.com’s 2026 AI Adoption in the Enterprise survey, conducted with Workplace Intelligence across 2,400 executives and employees, found that 60% of executives now believe their board is likely to intervene because of a botched AI strategy. Thirty-five percent of C-suite respondents conceded they were “not very confident they could ‘pull the plug’ on a rogue AI agent if it started causing financial or reputational damage.” Grant Thornton’s 2026 AI Impact Survey of 950 business leaders, conducted between 23 February and 18 March 2026, went further: 78% of executives lacked strong confidence they could pass an independent AI governance audit within 90 days; 48% of boards had approved major AI investments without setting governance expectations; 46% had not integrated AI risk into ongoing oversight. The Diligent Institute’s What Directors Think 2026, conducted with Corporate Board Member and FTI Consulting, reported that 66% of directors are now using AI for board work but only 22% of boards have AI usage policies in place — the policy gap is structural, not generational. McKinsey’s analysis of its Global Board Survey 2024 found that 66% of directors reported their boards have “limited to no knowledge or experience” with AI, and nearly one in three said AI did not even appear on their agendas.
For Indian boards, the picture is starker. KPMG India’s December 2025 Generative AI Survey Report of 62 board members found that only 5% of Indian boards include any director with direct generative AI expertise, only 8% have an AI ethics board, and only 10% have integrated generative AI into corporate strategy. Fifty-three percent had issued responsible-use policies better than the global average but the institutional scaffolding underneath those policies remains thin.
Five questions, then, that every Indian board should be asking by the end of FY27:
- Liability mapping. Which AI systems in our institution touch personal data covered by DPDP and what is our maximum statutory exposure per inquiry if any one of them fails?
- Kill-switch evidence. Can we demonstrate, in a controlled test, that we can stop a misbehaving agent inside one production system within minutes, and produce an immutable audit log of what it did?
- Sovereignty of the audit trail. Where do our agent identity records, policy state, and consent receipts physically reside, and would they leave Indian jurisdiction in a discovery event?
- Human-in-the-loop enforcement. For every category of decision an agent can take that has financial, regulatory, or reputational consequence, is the human approval step enforced by the architecture or merely by policy?
- Vendor governance posture. If a foreign hyperscaler governs our agents, what happens to our control plane in an outage, a re-pricing, a regulatory standoff, or a sovereignty dispute?
These are not IT questions. They are fiduciary questions. The next AGM will treat them as such.
A 60-minute board briefing on these five questions, tailored to your sector, is available on request. Request the briefing →
5. What Governance-First Architecture Actually Means
Bolt-on governance fails because it sits at the wrong layer of the stack. This is the lesson PocketOS paid 30 hours of downtime to teach. The agent’s “project rules” written in natural language, evaluated probabilistically inside the model’s own reasoning loop were soft guardrails. The Railway API token that authorised the deletion was a hard interface. When the two met, the soft layer lost. As Zenity’s post-mortem of the incident put it, soft guardrails are probabilistic controls that guess at intent, while hard boundaries are deterministic limits that operate outside the agent’s own reasoning loop, making certain outcomes structurally impossible regardless of what the model decides. NeuralTrust’s parallel analysis traced the failure to exactly the same architectural seam.
Governance-first architecture is the discipline of moving every control that matters out of the model and into the kernel. In QUAICU’s design, that distinction is made explicit. Policies, audit, identity, and process orchestration live in Ring 0 — the kernel space, a privileged execution domain inspired by the operating-system tradition that separates supervisor instructions from user code. Agents, applications, and user-facing surfaces live in Ring 3 — the user space, sandboxed by construction. The Policy Engine evaluates before execution, not after. The Audit Ledger is hash-chained and immutable — every credential operation, every tool call, every policy decision is appended and cannot be silently rewritten. The AI Gateway is the only path from a Ring 3 agent to anything that costs money, changes a record, or touches personal data. The Process Engine and Event Bus carry the deterministic workflow logic that an LLM should never be trusted to execute on its own.
The philosophical core is captured in three sentences: AI Proposes. Rules Enforce. Humans Approve. An agent may propose any action its reasoning supports. The Policy Engine, sitting below the agent’s authority, decides whether the action is permissible. For the categories of action where the institution has chosen human-in-the-loop enforcement — a credit disbursal, a clinical referral, an exam revaluation, a contract execution — the workflow halts at a human checkpoint that is structurally impossible for the agent to bypass.
Sovereignty falls naturally out of this architecture rather tha