# Nirmata Unified Governance for Agentic Era This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Beyond the Merge: Enforcing Policy Before the Terraform Apply DevFeed: [Beyond the Merge: Enforcing Policy Before the Terraform Apply]() Original publisher: [Read original article]() Author: Sachin Agarwal Published: 2026-09-03T17:25:32Z Content type: article Language: en Sources: [Nirmata]() Topics: [iac-security](), [Terraform](), [Security](), [Kyverno](), [Tooling]() Tags: [ci](), [cloud-security](), [code-security](), [infrastructure-as-code](), [kyverno](), [other](), [policy-as-code](), [pull-request](), [scanner](), [security](), [shift-left](), [terraform]() ### AI overview The article describes using Nirmata Control and its nctl CLI to evaluate Terraform plans against policy-as-code rules before deployment. It presents pre-apply CI checks for detecting infrastructure misconfigurations, including unrestricted ingress, missing S3 public-access blocking, wildcard IAM resources, and missing VPC deployment. ### Source excerpt Run Terraform security scanning on the plan, not the live account. nctl checks 4 critical misconfigs in CI, with exceptions scoped to one resource. ## Introducing OttoFlow: AI Workflows for Kubernetes DevFeed: [Introducing OttoFlow: AI Workflows for Kubernetes]() Original publisher: [Read original article]() Author: Shreyas Mocherla Published: 2026-08-26T18:34:15Z Content type: release Language: en Sources: [Nirmata]() Topics: [Artificial Intelligence](), [Kubernetes](), [Platform Engineering](), [GitOps]() Tags: [agent](), [ai](), [ai-agents](), [ai-governance](), [declarative](), [gitops](), [kubernetes](), [kyverno](), [llm](), [nothing](), [platform-engineering](), [product](), [workflows]() ### AI overview Nirmata introduces OttoFlow, an open-source system for building AI workflows on Kubernetes. It represents workflows as custom resources with typed DAG steps and limits AI to selected parts of the operations process, aiming to combine deterministic, reviewable automation with model-based reasoning. ### Source excerpt AI workflows for Kubernetes, without handing an agent your kubeconfig. OttoFlow makes a workflow a custom resource: typed DAG steps, AI only where it counts. ## Closing the Governance Gap in Nutanix Kubernetes Platform Environments DevFeed: [Closing the Governance Gap in Nutanix Kubernetes Platform Environments]() Original publisher: [Read original article]() Author: Sachin Agarwal Published: 2026-08-24T18:04:51Z Content type: article Language: en Sources: [Nirmata]() Topics: [Kyverno](), [nutanix](), [Kubernetes](), [Platform Engineering]() Tags: [build](), [compliance](), [governance](), [kubernetes](), [kyverno](), [nutanix](), [other](), [platform-engineering](), [upgrades]() ### AI overview Nirmata Enterprise for Kyverno is certified to run on Nutanix Kubernetes Platform through the Nutanix Cloud Platform. The article explains how installing it from the NKP Partner Catalog integrates policy governance, enforcement, and upgrades into the platform without a separate pipeline. ### Source excerpt Kyverno on Nutanix Kubernetes Platform is now certified. Install Nirmata Enterprise for Kyverno from the NKP Partner Catalog, no separate pipeline. ## Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents DevFeed: [Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents]() Original publisher: [Read original article]() Author: Ritesh Patel Published: 2026-08-19T00:24:40Z Content type: article Language: en Sources: [Nirmata]() Topics: [cross-app-access](), [Authorization](), [okta](), [Artificial Intelligence](), [Model Context Protocol (MCP)](), [Large Language Model](), [JSON Web Tokens](), [OAuth]() Tags: [ai](), [authorization](), [cross-app-access](), [engineering](), [jwt](), [llm](), [mcp](), [mcp-server](), [oauth](), [okta](), [standards]() ### AI overview The article explains how Nirmata AIControls supports Okta Cross App Access and the ID-JAG authorization profile for AI agents. It describes token exchanges performed on behalf of agents, administrator-controlled app-to-app access, policy checks, budgets, and audit records for delegated MCP and LLM calls. ### Source excerpt AIControls now performs the ID-JAG token exchanges on your agents' behalf -- so agents need no protocol code -- and policy-checks, budgets, and attributes every delegated MCP and LLM call to the human it acts for. ID-JAG answers may this agent act for this user? AIControls answers what... The post Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents first appeared on Nirmata. ## Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads DevFeed: [Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads]() Original publisher: [Read original article]() Author: Jim Bugwadia Published: 2026-08-17T01:27:43Z Content type: release Language: en Sources: [Nirmata]() Topics: [Kyverno](), [Security](), [eBPF](), [configuration](), [Kubernetes]() Tags: [agent](), [ai](), [ai-agents](), [ai-governance](), [configuration](), [ebpf](), [kubernetes](), [kyverno](), [policy](), [product](), [security]() ### AI overview Nirmata introduces Nirmata Runtime for Kyverno, which extends workload controls beyond admission-time configuration checks by enforcing selected runtime behaviors in the kernel. The article describes BPF-LSM and cgroup-scoped eBPF enforcement for process execution, file access, network egress, and application protocols, plus DNS observation and reporting. ### Source excerpt Nirmata created Kyverno and donated it to the CNCF in 2020. Kyverno is now a graduated CNCF project and is widely used for enforcing and automating configuration security and best practices. However, admission control answers one question: does this spec look right? It cannot... The post Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads first appeared on Nirmata. ## Introducing the Remediator Agent: Turning Kyverno Policy Violations into Pull Requests, Automatically. DevFeed: [Introducing the Remediator Agent: Turning Kyverno Policy Violations into Pull Requests, Automatically.]() Original publisher: [Read original article]() Author: Akhil Chandran Published: 2026-08-14T11:29:37Z Content type: article Language: en Sources: [Nirmata]() Topics: [Kyverno](), [GitOps](), [Kubernetes](), [pull-requests](), [argocd](), [flux]() Tags: [agent](), [ai](), [argocd](), [flux](), [gitops](), [kubernetes](), [kyverno](), [other](), [pull-requests]() ### AI overview Nirmata's Remediator Agent is designed to automate remediation of Kyverno policy violations within an existing GitOps workflow. It traces violations to their Git sources, proposes deterministic or LLM-generated fixes, commits changes, opens pull requests for review, and relies on ArgoCD or Flux CD to sync approved changes back to Kubernetes. ### Source excerpt Kyverno detects Kubernetes policy violations. Nirmata's Remediator Agent turns them into reviewed pull requests within your existing GitOps workflow. ## Nirmata's Cloud Agents Audited a 40-Cluster Kubernetes Fleet, and recovered 40% of the Cost DevFeed: [Nirmata's Cloud Agents Audited a 40-Cluster Kubernetes Fleet, and recovered 40% of the Cost]() Original publisher: [Read original article]() Author: Anubhav Sharma Published: 2026-08-12T20:52:35Z Content type: article Language: en Sources: [Nirmata]() Topics: [Kubernetes](), [Cloud](), [Automation](), [data]() Tags: [agents](), [ai](), [automation](), [cloud](), [cloud-native](), [clusters](), [cncf](), [compute](), [cost-savings](), [deployment](), [devsecops](), [kubernetes](), [kyverno](), [policy-management](), [resource](), [verification]() ### AI overview Nirmata describes applying its Cost Analyzer and Resource Hygiene Cloud Agents across an enterprise customer's 40-cluster production Kubernetes fleet. The scans identified a roughly $107,000 monthly compute baseline and about 50% recoverable through right-sizing before stale-resource cleanup, while revealing recurring sources of waste and governance gaps. ### Source excerpt Nirmata's Cloud Agents Audited a 40-Cluster Kubernetes Fleet, and recovered 40% of the Cost Most Kubernetes Cost overruns don't come from one singularly bad decision. They come from dozens of reasonable ones -- made independently, by different teams, at different times -- that... The post Nirmata's Cloud Agents Audited a 40-Cluster Kubernetes Fleet, and recovered 40% of the Cost first appeared on Nirmata. ## AI governance gaps leave developer and agent access to AI tools insufficiently controlled DevFeed: [AI governance gaps leave developer and agent access to AI tools insufficiently controlled]() Original publisher: [Read original article]() Author: Anubhav Sharma Published: 2026-08-05T01:56:41Z Content type: opinion Language: en Sources: [Nirmata]() Topics: [ai-governance](), [Security](), [Access Control](), [Authorization](), [developer-productivity](), [Monitoring](), [Large Language Model]() Tags: [access-control](), [ai](), [ai-governance](), [cloud-native](), [cncf](), [developer](), [devsecops](), [engineering](), [kubernetes](), [kyverno](), [llms](), [policy-management](), [risk-management](), [security](), [visibility]() ### AI overview The article presents aggregated responses from security leaders about AI governance in fast-moving engineering organizations. It identifies gaps in centralized access control, policy enforcement, session auditing, real-time visibility, and protection against exposing permissions or environment variables to LLMs. ### Source excerpt Three Questions We Asked About AI Governance -- And What the Answers Reveal Over the past few months, we've been having the same conversation on repeat with security leaders about AI at fast-moving engineering organizations. Different companies, different tech stacks, same three questions -- and,... The post The AI Innovation-Security Paradox first appeared on Nirmata. ## The AI Gateway Buyer's Guide: Beyond Routing and Tool Visibility DevFeed: [The AI Gateway Buyer's Guide: Beyond Routing and Tool Visibility]() Original publisher: [Read original article]() Author: Ritesh Patel Published: 2026-08-02T16:58:40Z Content type: opinion Language: en Sources: [Nirmata]() Topics: [Artificial Intelligence](), [Model Routing](), [ai security](), [agent observability](), [Model Context Protocol]() Tags: [ai](), [ai-gateway](), [ai-security](), [claude](), [cost-optimization](), [engineering](), [kubernetes](), [latency](), [mcp](), [routing]() ### AI overview This opinion article argues that AI gateways should not be treated as governance systems merely because they provide model routing and tool-call visibility. Routing can optimize cost and latency, while monitoring can show which tools or MCP servers were used, but governance requires deciding whether an agent action is permitted for a specific agent, with specific arguments, at a specific time. ### Source excerpt Over the past year, nearly every engineering org I talk to has reached the same milestone: AI agents are no longer a demo. They're calling real tools, against real systems, with real consequences. And nearly every one of those orgs has reached for the same... The post The AI Gateway Buyer's Guide: Beyond Routing and Tool Visibility first appeared on Nirmata. ## Critical Kyverno Vulnerability -- CVE-2026-54523 DevFeed: [Critical Kyverno Vulnerability -- CVE-2026-54523]() Original publisher: [Read original article]() Author: Anubhav Sharma Published: 2026-07-29T01:08:41Z Content type: news Language: en Sources: [Nirmata]() Topics: [Kyverno](), [vulnerability](), [Exploit](), [Kubernetes](), [Cloud Native Ecosystem]() Tags: [2026](), [admission-controller](), [ai](), [cloud-native](), [cloud-native-ecosystem](), [cncf](), [cve](), [devsecops](), [engineering](), [kubernetes](), [kyverno](), [nctl-ai](), [platform-engineering](), [policy](), [policy-as-code](), [policy-management](), [release](), [upgrade](), [vulnerability]() ### AI overview The article reports CVE-2026-54523, a critical Kyverno vulnerability affecting versions 1.18.0 and 1.18.1. A tenant able to create a NamespacedMutatingPolicy could bypass namespace isolation and generate resources in other namespaces, potentially enabling cluster-wide privilege escalation. Kyverno 1.18.2 patches the vulnerability. ### Source excerpt Critical Kyverno Vulnerability -- CVE-2026-54523 On July 13, 2026, a critical vulnerability was disclosed in Kyverno, the Kubernetes-native policy engine used broadly across the cloud native ecosystem for policy-as-code enforcement. The vulnerability, tracked as CVE-2026-54523 (GHSA-79gf-7frw-68m9), allows a tenant with permission to create a NamespacedMutatingPolicy... The post Critical Kyverno Vulnerability -- CVE-2026-54523 first appeared on Nirmata.