--- title: Agentic AI Security: What CISOs Say About Governing AI... description: A panel of enterprise security leaders including CISOs and AI startup founders discussed how to govern agentic AI without blocking developer productivity. Key... canonical: https://daily.dev/posts/agentic-ai-security-what-cisos-say-about-governing-ai-agents-peda204z1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Agentic AI Security: What CISOs Say About Governing AI Agents | daily.dev og:description: A panel of enterprise security leaders including CISOs and AI startup founders discussed how to govern agentic AI without blocking developer productivity. Key... og:url: https://daily.dev/posts/agentic-ai-security-what-cisos-say-about-governing-ai-agents-peda204z1 og:image: https://api.daily.dev/og/posts/pedA204z1.png og:image:alt: Agentic AI Security: What CISOs Say About Governing AI Agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Agentic AI Security: What CISOs Say About Governing AI Agents **[Docker](https://daily.dev/sources/docker)** · 7 min read · 0 upvotes · 0 comments ## Summary A panel of enterprise security leaders including CISOs and AI startup founders discussed how to govern agentic AI without blocking developer productivity. Key themes included running agents in isolated sandboxes (Docker Sandboxes, MicroVM-based), keeping humans in the loop for dependency selection, using blessed images and minimum release age policies, and treating MCP servers as potential shadow IT requiring centralized governance. Docker's approach centers on portable, disposable sandboxes and an MCP Gateway as an enforcement chokepoint. The consensus: governance must be built in from day one, not bolted on after an incident. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Docker Sandboxes secure AI coding agents like NanoClaw? Docker Sandboxes run agents inside disposable, MicroVM-based isolated environments that enforce strong operating system-level isolation. NanoClaw integrates with Docker Sandboxes so every agent execution happens in a disposable sandbox, combining NanoClaw's minimal attack surface and auditable open-source codebase with sandbox-level enforcement to meet enterprise security standards. _Teams weighing sandboxed agent execution options can track approaches like this on daily.dev._ ### What is Docker MCP Gateway and why would I use it for AI agents? Docker MCP Gateway is an open source chokepoint that routes every tool call between AI agents and external MCP servers through a single enforcement point, where calls are authenticated, authorized, and logged before reaching external systems. It gives agents access to trusted catalogs of MCP servers while making enforcement strict rather than advisory. _Developers securing MCP tool access can follow governance patterns like this on daily.dev._ ### What best practices reduce supply chain risk when AI agents autonomously pull dependencies and build images? Recommended practices include keeping humans in the loop for selecting secure upstream libraries, setting up blessed images for agents to choose from, enforcing a minimum release age of seven days for images, minimizing dependencies even when they appear safe, and using immutable tags, digests, and SBOMs to lock manifests and detect poisoned images quickly. _Anyone hardening an AI-driven build pipeline can compare supply chain tactics like these on daily.dev._ ## Similar posts on daily.dev - [Docker AI Governance: Unlock Agent Autonomy, Safely](https://daily.dev/posts/docker-ai-governance-unlock-agent-autonomy-safely-s3gotzrnq) · Docker · 2 upvotes · 0 comments - [Agentic AI Governance: Designing for Accountability and Control](https://daily.dev/posts/agentic-ai-governance-designing-for-accountability-and-control-cuhzrfrne) · JetBrains · 1 upvotes · 0 comments - [How to govern agentic AI, MCPs, and AI code assistants](https://daily.dev/posts/how-to-govern-agentic-ai-mcps-and-ai-code-assistants-htfalfimb) · GitLab · 0 upvotes · 0 comments - [Security Can’t Be an Afterthought as AI Agents Reshape DevOps](https://daily.dev/posts/security-can-t-be-an-afterthought-as-ai-agents-reshape-devops-99hporlmv) · SD Times · 3 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#docker](https://daily.dev/tags/docker), [#mcp](https://daily.dev/tags/mcp), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/agentic-ai-security-what-cisos-say-about-governing-ai-agents-peda204z1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Agentic AI Security: What CISOs Say About Governing AI Agents","url":"https://daily.dev/posts/agentic-ai-security-what-cisos-say-about-governing-ai-agents-peda204z1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/agentic-ai-security-what-cisos-say-about-governing-ai-agents-peda204z1"},"datePublished":"2026-07-24T17:23:04.069Z","dateModified":"2026-09-13T18:28:47.957Z","description":"A panel of enterprise security leaders including CISOs and AI startup founders discussed how to govern agentic AI without blocking developer productivity. Key...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Docker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Docker","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8a1022bebfc04a7d824c309bd3686787","url":"https://daily.dev/sources/docker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/agentic-ai-security-what-cisos-say-about-governing-ai-agents-peda204z1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,docker,mcp,agentic-ai","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Docker","item":"https://daily.dev/sources/docker"},{"@type":"ListItem","position":3,"name":"Agentic AI Security: What CISOs Say About Governing AI Agents"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/agentic-ai-security-what-cisos-say-about-governing-ai-agents-peda204z1#faq","mainEntity":[{"@type":"Question","name":"How does Docker Sandboxes secure AI coding agents like NanoClaw?","acceptedAnswer":{"@type":"Answer","text":"Docker Sandboxes run agents inside disposable, MicroVM-based isolated environments that enforce strong operating system-level isolation. NanoClaw integrates with Docker Sandboxes so every agent execution happens in a disposable sandbox, combining NanoClaw's minimal attack surface and auditable open-source codebase with sandbox-level enforcement to meet enterprise security standards. Teams weighing sandboxed agent execution options can track approaches like this on daily.dev."}},{"@type":"Question","name":"What is Docker MCP Gateway and why would I use it for AI agents?","acceptedAnswer":{"@type":"Answer","text":"Docker MCP Gateway is an open source chokepoint that routes every tool call between AI agents and external MCP servers through a single enforcement point, where calls are authenticated, authorized, and logged before reaching external systems. It gives agents access to trusted catalogs of MCP servers while making enforcement strict rather than advisory. Developers securing MCP tool access can follow governance patterns like this on daily.dev."}},{"@type":"Question","name":"What best practices reduce supply chain risk when AI agents autonomously pull dependencies and build images?","acceptedAnswer":{"@type":"Answer","text":"Recommended practices include keeping humans in the loop for selecting secure upstream libraries, setting up blessed images for agents to choose from, enforcing a minimum release age of seven days for images, minimizing dependencies even when they appear safe, and using immutable tags, digests, and SBOMs to lock manifests and detect poisoned images quickly. Anyone hardening an AI-driven build pipeline can compare supply chain tactics like these on daily.dev."}}]} ```