The Scale of the Problem
Twelve enterprise vendors have formed the Blueprint Alliance to establish a unified governance infrastructure for AI agents, aiming to address the security risks inherent in the rapid deployment of autonomous systems. Gartner predicts that by 2028, the average Fortune 500 enterprise will manage over 150,000 agents, yet only 13% of organizations currently believe they have the necessary governance frameworks in place.
On September 22, 2026, at Oktane 2026, Okta, AWS, CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Proofpoint, Salesforce, ServiceNow, Wiz, and Zscaler announced the formation of the Blueprint Alliance. Supported by strategic advisors GE Appliances and World Central Kitchen, the coalition published a shared reference architecture for securing AI agents at enterprise scale.
Four Questions, One Architecture
The Alliance is not shipping a product. It is co-authoring a framework designed to answer four operational questions: Where are my agents? What can they do? What are they doing? And how do I respond? The group aims to create a stack where enterprises can integrate identity, endpoint security, and runtime governance from different vendors without proprietary lock-in at the governance layer.
Six shared principles anchor the architecture: treating agents as first-class identities, scoping access to specific tasks rather than granting standing permissions, keeping delegation traceable, monitoring runtime behavior continuously, enabling containment that is instant and reversible, and ensuring governance adapts at the speed AI moves. The Alliance committed to supporting established protocols including MCP (Model Context Protocol), OCSF (Open Cybersecurity Schema Framework), SSF (Shared Signals Framework), and CAEP (Continuous Access Evaluation Profile), with runtime authorization enforced via inline gateways that share signals across vendors.
“The risk of unsecured, ungoverned agents is fundamentally an industry problem, not a problem for one company,” said Eric Kelleher, Okta President and COO. “It requires an industry solution, and the reality is, it’s going to take all of us working together.” Ric Smith, Okta’s President of Products and Technology, added: “The challenge businesses face is the same access that makes agents powerful also makes them dangerous. For over a decade, Okta has continuously modernized how the workforce authenticates and connects to every app they use. That same discipline extends to AI agents.”
What Each Vendor Contributes
The reference architecture draws on each vendor’s existing infrastructure. AWS is contributing a unified approach for seeing, governing, and trusting agents across the enterprise, according to VP Chet Kapoor. Google Cloud VP Abhi Sawant emphasized open, interoperable architectures with zero-trust governance. Docker CTO Tushar Jain pointed to security, isolation, and governance at the container and runtime layer. Databricks SVP David Meyer cited the company’s Unity Catalog and Unity Gateway for unified control over data, models, agents, and tools.
Okta’s specific contribution includes new capabilities announced at Oktane: Agent SSO, Agent-to-Agent Connections, and Resource Access Certifications are generally available today, while Agent Gateway and Shadow AI Agent Discovery for Endpoints are planned for Q3, and Configuration Designer and expanded Kill Switch capabilities at the runtime layer are planned for Q4. Steven Tamm, Okta SVP of Ecosystem, was careful to frame these as the company’s contribution to a shared effort: “The Blueprint Alliance is not an Okta product, but one that belongs to the industry.”
The Proof Point
This coalition’s effectiveness will be measured by the regular publication of joint interoperability results and reference integrations. The Alliance committed to publishing these regularly, and that commitment is the difference between a marketing alignment and a functional infrastructure standard. If the published results show genuine cross-vendor signal sharing — Okta identity events triggering CrowdStrike endpoint responses, for example, or Google Cloud runtime decisions flowing through shared CAEP signals — enterprises can credibly plan for a multi-vendor governance stack without proprietary lock-in. If the results never materialize or are limited to bilateral integrations, the Alliance becomes another industry consortium with a website.
The coalition’s current roster excludes Microsoft (whose Entra competes with Okta in identity) and frontier model makers like OpenAI and Anthropic. Kelleher said this phase intentionally focuses on the four enterprise governance challenges rather than the model providers. This narrows the Alliance’s scope to enterprise-side plumbing — identity, runtime, and endpoint — rather than model-level governance. Whether the governance layer can eventually encompass model providers is an open question, but the immediate focus is on securing the infrastructure that sits between the models and the enterprise.