With a flood of announcements from Google Cloud, Okta, Wiz, and Rubrik, it's becoming clearer how the layered architecture for securing autonomous agents needs to come together. This is an important topic, especially as Mandiant’s M-Trends 2026 report highlights that the attacker handoff window has shrunk to just 22 seconds.

I've found it useful to think about this as a 4-layer stack, with Identity right at the centre:

✔️ Infrastructure: Google Cloud and Wiz establish a secure runtime foundation. This encompasses everything from vulnerability detection in AI workloads to network segmentation for agent communications, focusing on whether the underlying infrastructure is secure.

✔️ Identity: At the core of control, Okta for AI Agents (GA on April 30) manages agent registration, lifecycle, and authentication of these non-human identities. It delivers audit trails for autonomous decisions and addresses the question: Who are my agents, and how do I control their access?

✔️ Intelligence: Google Cloud’s Gemini combined with Mandiant provide machine-speed threat detection and response. This is critical for addressing AI-specific attacks and figuring out if detection and response can outpace attackers.

✔️ Governance: Rubrik SAGE completes the cycle by enforcing policies, monitoring agent decisions, and controlling data access to make sure agents operate within established parameters.

These layers don't work in isolation. Okta identity decisions can dynamically influence Google Cloud's security policies. Likewise, threat intelligence from Google and Mandiant can trigger immediate identity revocations. Everything works together as a unified system.

All of this underscores an essential point: securing systems effectively depends on identifying what and who is interacting within them. Identity remains the central control point governing every interaction an agent has across this stack.

As more organisations begin deploying AI agents, focusing on an identity-first approach is crucial to maintaining control and accountability.