Roadmap
This page lists the capabilities we are building next. They will be delivered soon. It covers agent governance, developer AI, runtime enforcement, sensitive data protection, identity, security operations, investigations and evidence.
Last updated: October 18, 2026.
Capabilities that are already available are documented in the rest of these docs, and every shipped change is listed in the release notes.
| Status | Meaning |
|---|---|
| In development | Work has started |
| Planned | Designed and next in line |
Summary
Agent governance and control
Agent-level suspend
Status: In development.
One action suspends an agent everywhere: every AI Gateway key bound to the agent is blocked in a single transaction, agents using the ANTS SDK refuse model calls while suspended, and the action is audit-logged with who suspended the agent and when. Restoring the agent requires step-up verification. Today an administrator blocks an agent's gateway keys one key at a time.
Short-lived agent credentials
Status: In development.
AI Gateway keys can expire after hours instead of days, and an API lets an authorised system mint a short-lived, scoped key for a specific agent and task. Today every key already carries a mandatory expiry measured in days and is scoped to model groups, IP ranges, rate limits and budget.
Unified agent profile
Status: In development.
One page per agent brings together owner, purpose, deployment stage, risk tier, data sources, models, the tools and MCP servers it uses, and its permissions. A declared-tools field sits next to observed tools, and tools used but not declared are highlighted. All profiles can be exported as CSV.
Continuous drift detection and alerting
Status: In development.
Drift between each agent's approved governance profile and its observed behavior is evaluated on a schedule for every agent, and new drift alerts are sent automatically to Slack, Jira, PagerDuty or ServiceNow, with de-duplication. Today drift is evaluated when the governance view is opened and incidents are raised by an administrator.
Agent discovery from cloud inventories
Status: In development.
The AWS Bedrock and Google Vertex AI connectors list every agent, flow and reasoning engine on a schedule, so agents appear in the inventory before they first run. Agents found in a cloud inventory but never seen in traces are marked.
Microsoft Copilot Studio connector
Status: In development.
Copilot Studio agents and their activity are discovered and traced through the Microsoft connector.
Lifecycle stage approvals and pre-deployment evaluation
Status: Planned.
Agents and models move through defined stages (development, validation, production, retirement) with an approval at each transition. Evaluation results from datasets and experiments can be attached as evidence for approval, and evaluations can be triggered from CI/CD pipelines.
Tool misuse and privilege escalation detection
Status: Planned.
Each agent's tool, MCP server and data store calls are compared with its normal pattern and with the tools and permissions declared in its governance profile. Calls to new targets, calls to privileged operations and unusual volume raise alerts through the same channels as drift alerts.
Human approval for high-impact agent actions
Status: Planned.
Administrators designate high-impact actions per agent by tool name and argument rules, for example refunds above a set amount. The ANTS SDK pauses the agent and sends an approval request to an approval inbox in ANTS and to Slack or Teams, with a timeout, automatic deny and a full audit trail. LangGraph interrupts are supported.
Per-agent tool allow-list
Status: Planned.
A per-agent list of allowed tools is enforced at runtime. Tool calls outside the list are refused at the AI Gateway without changes to agent code, and before execution by the ANTS SDK.
Versioned policies with history and rollback
Status: Planned.
Guardrail and governance policies are versioned, with a full history of changes and one-click rollback to an earlier version.
Microsoft 365 Copilot interaction ingestion
Status: Planned.
Microsoft 365 Copilot interactions are ingested through the Microsoft Graph connector for investigation and reporting.
Verified delegation chain
Status: Planned.
The person who asked an agent to act is identified from a token signed by your identity provider, such as Okta, instead of a value supplied by the calling application, and the full chain from person to agent to tool call is recorded.
Deployment gate tied to governance approval
Status: Planned.
An agent can reach production models through the AI Gateway only after its governance profile is approved. Unapproved agents are limited to sandbox models.
Developer and data science AI
Unsanctioned developer tool alerts
Status: In development.
Use of an AI coding assistant or command-line tool marked Unsanctioned raises an alert to the channel you choose, with a daily digest option. The tool catalog adds more command-line tools.
MCP server allow-list
Status: Planned.
Administrators define which MCP servers developers may use. The allow-list is pushed to supported AI coding tools through their managed settings, and use of servers outside the list is reported.
Notebook environment coverage
Status: Planned.
Ready-made setup for Databricks clusters, Amazon SageMaker notebooks and Jupyter installs the ANTS SDK and routes AI calls through the AI Gateway automatically, so guardrails and usage reporting apply to notebook code.
Broader IDE assistant coverage
Status: Planned.
Discovery extends to JetBrains AI Assistant, Amazon Q Developer, Sourcegraph Cody, Tabnine and Cline.
Local model runtime detection
Status: Planned.
Local model runtimes such as Ollama and LM Studio are detected on developer endpoints.
Personal AI API key detection
Status: Planned.
Endpoint agents detect personal AI provider API keys in developer environments and report them, without sending the key values to ANTS.
Runtime enforcement
Warn mode with approved alternative
Status: In development.
In warn mode, opening an AI service marked Unsanctioned shows the user a banner in the browser with a message you write, the approved alternative and a link to your request process. Each warning and dismissal is recorded. Observe mode remains the default.
Employee monitoring notice
Status: In development.
A monitoring notice you write is shown by the browser extension on first run and again when its text changes. Each user's acknowledgment is recorded and can be reported and exported.
Tamper and silence alerts
Status: In development.
Alerts when a device stops reporting for a set time, when the browser extension is uninstalled and when an endpoint agent is unenrolled. Generated browser policies can also disable private browsing.
Real-time block and allow in the browser and on macOS
Status: Planned.
The browser extension and macOS endpoint agent enforce allow, warn or block in real time, driven by each AI service's sanction status and risk tier, with customizable user messaging and links to approved alternatives.
Windows enforcement
Status: Planned.
Real-time enforcement on Windows endpoints.
Personal and enterprise account detection
Status: Planned.
Distinguishes a personal account from your enterprise tenant on the same AI service and applies a different action to each.
Identity group and device posture rules
Status: Planned.
Enforcement rules can combine identity provider groups and attributes, device posture and the AI service's risk tier in a single rule.
Discovery of uncatalogued AI services
Status: Planned.
AI services that are not yet in the catalog are detected from their traffic patterns and submitted to the catalog review queue.
Sensitive data protection
Credential, API key and source code detectors
Status: In development.
Pre-built detectors for credentials and API keys (cloud providers, AI providers, code hosting and collaboration tokens, JWTs, private keys and connection strings) and for source code. Card numbers and U.S. Social Security numbers gain checksum and format validation to reduce false positives.
Custom regular expression and keyword detectors
Status: In development.
Define your own detectors with regular expressions or keyword lists, test them against sample text and apply them inline and in scheduled scans.
Per-detector actions and warn
Status: In development.
Choose block, redact, warn or log only for each detector category instead of one action per agent.
False-positive review
Status: In development.
Analysts mark each detection as a true or false positive with a note, and a report shows detection volume and false-positive rate per detector.
Warn with user justification
Status: Planned.
When content triggers a warning, the user can provide a justification before continuing, and the justification is recorded.
Configurable fail-open or fail-closed
Status: Planned.
Each policy sets whether inline inspection fails open or fails closed when the detection service is unavailable.
Exact data match and document fingerprinting
Status: Planned.
Detect your own records using a hashed reference dataset, and detect fragments of specific confidential documents.
Enterprise DLP integration
Status: Planned.
Integration with enterprise DLP and secure web gateway platforms through ICAP and policy synchronization.
File content inspection and sensitivity labels
Status: Planned.
Inspection of uploaded file content, and policies that read existing sensitivity labels such as Microsoft Purview Information Protection labels.
Identity and access
SCIM group provisioning
Status: In development.
Okta and other identity providers can push groups and group membership to ANTS through SCIM 2.0, in addition to users.
Session and key revocation on deprovisioning
Status: In development.
Deactivating a user from your identity provider ends their open sessions immediately and revokes their AI Gateway keys.
Okta group to role mapping
Status: In development.
Map identity provider groups to built-in or custom roles at organization or project scope. Roles are applied at sign-in and on SCIM group changes.
Okta Integration Network listing
Status: Planned.
ANTS listed in the Okta Integration Network for single sign-on and SCIM provisioning.
Function-level controls inside AI services
Status: Planned.
Allow or deny specific functions inside an allowed AI service, such as file upload or connectors, by identity group.
Security operations
Real-time SIEM delivery
Status: In development.
AI events, endpoint events, alerts and audit logs are pushed within seconds over HTTP Event Collector to CrowdStrike Falcon Next-Gen SIEM, Splunk and compatible SIEMs, with a published event schema. Today delivery is a scheduled export to object storage.
CrowdStrike Falcon identifiers on events
Status: In development.
When CrowdStrike Falcon is installed, the endpoint agents collect the Falcon agent ID, and every exported event carries the Falcon agent ID, hostname, serial number and user principal name.
Policy violation webhooks
Status: In development.
Policy violations trigger signed, documented JSON webhooks that CrowdStrike Falcon Fusion SOAR and other automation tools can consume, filtered by violation type and severity.
Automatic ticket creation on violations
Status: In development.
Violations create Jira and Linear issues automatically, with de-duplication, as ServiceNow and PagerDuty incidents do today.
CrowdStrike Falcon posture integration
Status: Planned.
CrowdStrike Falcon device posture, such as the Zero Trust Assessment score and sensor presence, is available as a condition in enforcement rules.
Investigations and records
Audit log of content views
Status: In development.
Every view of prompt or response content is recorded in the audit log with user and time, and exports and the public API follow the same content permission as the console.
Identity provider ID on every record
Status: In development.
Each AI interaction record carries the user's identity provider ID, such as the Okta user ID, in addition to their email.
Search by data classification and policy decision
Status: In development.
Interaction search adds filters for detected data classifications and policy decisions alongside user, AI service, time range and free text.
Investigation queues
Status: In development.
Investigations with assignment, status, notes, tags and export, built from interactions, sessions and endpoint events.
Export checksums and download audit
Status: In development.
Every exported file carries a SHA-256 checksum in its manifest, and every download is recorded with user, time and file.
Default masking of sensitive values
Status: Planned.
Sensitive values are masked in displayed content by default, with an audited reveal action.
Separate retention for content and metadata
Status: Planned.
Prompt and response content can be kept for a shorter period than interaction metadata.
Legal hold and eDiscovery export
Status: Planned.
Legal holds by user or matter suspend deletion, and held data exports in an eDiscovery-ready format.
Tamper-evident records
Status: Planned.
Captured records are hashed at ingestion, with chained daily digests stored in write-once storage.
Trust, risk and evidence
Security framework control mappings
Status: In development.
Pre-built control mappings for SOC 2 and ISO/IEC 27001 join the existing EU AI Act, ISO/IEC 42001 and NIST AI RMF mappings, with framework versions shown.
Scheduled executive reports
Status: In development.
A weekly or monthly executive summary of AI exposure, adoption and compliance is emailed as a PDF to chosen recipients.
Configurable risk tiers and intake questionnaires
Status: Planned.
Define your own risk tiers and intake questions, with scoring that assigns a tier and a tier that sets access policy automatically.
Policy exceptions with expiry
Status: Planned.
Policy exceptions with owner, justification, expiry date and automatic re-review.
AI tool requests
Employee AI tool requests
Status: In development.
Employees request a new AI tool or use case from a self-service form. On approval, ANTS adds the user to the identity provider group that grants access, and a report shows request-to-decision time by risk tier.
Automatic approval and parallel review
Status: Planned.
Requests in the lowest risk tier that meet policy are approved automatically, and higher-tier requests go to several reviewer groups in parallel, with service levels and escalation.
Platform and integrations
Microsoft Teams notifications
Status: In development.
Compliance, detection and drift notifications in Microsoft Teams, alongside Slack.
Unified AI asset inventory and public governance API
Status: Planned.
One inventory of AI services, models, applications, agents and use cases, and a documented public API for inventory, governance and policy.
Data catalog integrations
Status: Planned.
Integrations with data catalogs such as Microsoft Purview and Collibra.