Enterprise AI Agent Infrastructure in 2026: Why Identity, Secrets, and Runtime Governance Decide Production

The headlines from the first week of June were about models and money. Anthropic filed to go public. Microsoft put agents in the Windows shell. The coding-agent vendors traded blows over whose model would default inside Copilot. All of it real, all of it loud.

Underneath that noise, a quieter set of announcements landed that matter more to anyone actually running agents in production. NVIDIA published a vendor-neutral reference stack for enterprise agents. AWS extended its agent identity service to reuse existing secrets governance. Anthropic shipped 28 enterprise integrations across security and observability tooling. None of these trended. All of them are the part of the enterprise AI agent infrastructure you will spend the next two quarters wiring together.

I work with Fortune-level enterprise clients architecting and building agentic frameworks, and the pattern I keep seeing is that the demo is never the hard part. The hard part is the plumbing: identity, secrets, runtime isolation, and the integrations that let an agent touch the systems it needs without becoming a liability. June was the month that plumbing got real.

The shift: from "can it do the task" to "can it live inside your controls"

Here is the through-line across the three announcements, and it is the one sentence most coverage missed. The competition has moved from can the agent do the task to can the agent live inside the controls you already run. That is a maturity signal. It is what a market looks like right after the demos stop being the point.

I call the resulting design rule Fit, Don't Rebuild: the agent platforms that win the enterprise are the ones that inherit your existing governance rather than asking you to stand up a parallel governance model for agents. Every one of June's substrate announcements is an instance of it.

NVIDIA is trying to own the substrate

The most strategically interesting move came from NVIDIA, which announced enterprise software leaders building agents on its stack: NeMo blueprints, Nemotron models, an OpenShell secure runtime, and CUDA-X agent skills, paired with ISV partnerships across CRM, ITSM, and ERP. The accompanying ServiceNow expansion put autonomous agents directly into ITSM, HR, and customer workflows on the ServiceNow AI Platform, running on the same NeMo and Nemotron components.

Read those two announcements together and the intent is obvious. NVIDIA is not trying to win the model race or the application race. It is trying to be the vendor-neutral substrate underneath both, the layer every agent runs on regardless of which model sits on top or which app it serves. That is a smarter position than it looks. Models will keep churning and application vendors will keep fighting, but the runtime, the skills format, and the deployment blueprints are sticky once a platform team standardizes on them.

For an enterprise buyer, this is the difference between betting on a horse and betting on the track. The reference architecture matters more than any single component in it, because the architecture is what your platform team will copy.

AWS made the unglamorous decision the right one

The AWS announcement was narrow and easy to skip: Amazon Bedrock AgentCore Identity now lets you reference existing AWS Secrets Manager ARNs in its Credential Providers, GA across 14 regions. That is a one-line release note. It is also exactly the kind of thing that decides whether an agent platform survives a security review.

Before this, an agent platform that managed its own credentials created a second, parallel secrets store sitting outside your existing governance: separate rotation, separate encryption keys, separate resource policies, separate audit surface. Every security architect I have worked with treats a duplicated secrets store as a finding, not a feature. Letting AgentCore point at the secrets you already govern, with your existing CMK encryption, rotation, and tagging intact, means agent credentials inherit the same controls as the rest of your AWS estate. No parity gap to explain to the auditors.

The contrast is the whole story:

Dimension	Parallel-store posture (old)	Inherited-controls posture (new)
Secrets location	New agent-specific store	Existing Secrets Manager ARNs
Rotation & encryption	Separate, re-implemented	Your existing CMK and rotation
Audit surface	A second thing to monitor	The surface you already monitor
Security review	A finding to defend	Nothing new to explain

This is the tell for where enterprise agent infrastructure is heading. The winning move is not a new governance model for agents. It is making agents fit the governance you already run.

Anthropic is wiring Claude into the perimeter

The third piece was Anthropic adding 28 enterprise integrations to Claude across security, identity, and observability systems. On its own that reads like a routine connector update. In context it is the same play as the other two: get the agent inside the boundary the enterprise already trusts, alongside the SIEM, the IAM stack, and the DLP tooling, rather than asking the enterprise to build a new boundary around the agent.

Three vendors, three layers of the stack, one strategy. The substrate, the identity path, and the integration surface are all converging on the same principle. That convergence is not a coincidence. It is the market discovering, at the same time, what enterprises will and will not buy.

The proof is in the adoption curve

This is not a vibe shift, it is a measured one. A KPMG survey cited by VentureBeat put roughly 33% of organizations deploying AI agents, a threefold jump in two quarters. Deployment is now outpacing governance maturity, and the gap between piloting and shipping has become a visible curve. That gap is precisely the space these substrate announcements are racing to fill. When a third of the market crosses from experiment to deployment in six months, the binding constraint stops being model capability and becomes whether the thing clears a security review. Vendors are responding to the constraint that actually blocks revenue.

The Inherited-Controls Scorecard: what I would actually do

If you own an agent program, here is the practical read, structured as the scorecard I use when evaluating a platform.

1. Separate the model decision from the infrastructure decision, and treat infrastructure as the longer-lived one. The model you default to will change, probably more than once. The runtime, the identity layer, and the secrets path are what your platform team has to maintain for years. Pick those for stability and governance fit, not for benchmark scores.

2. Make secrets and identity reuse a day-one gating requirement, not phase-two cleanup. The AWS change exists because duplicated secrets stores are where agent programs stall in security review. Specify on day one that agent credentials reuse your existing secrets manager, your existing keys, and your existing rotation. If a platform cannot do that, it is not enterprise-ready yet, no matter how good the demo was.

3. Score platforms on integration depth into the controls you already run, not on feature-list length. Twenty-eight integrations only matter if they cover your SIEM, your IAM, and your observability stack. Map the integration list against your actual estate before you score anything. The right question is not "what can this agent connect to" but "does it connect to the things I am already required to monitor."

4. If you are early, borrow a reference architecture rather than inventing one. NVIDIA, AWS, and the major cloud vendors are now publishing blueprints precisely so you do not have to design the substrate from scratch. Adapting a vendor's reference stack is faster and far more defensible in front of a risk committee than a bespoke design no auditor has seen before.

The keynotes will keep being about models. The work will keep being about the layer underneath them. June was a good reminder that the boring layer is where the enterprise race is actually being run, and the teams that treat infrastructure as the strategic decision will be the ones still standing when the model of the month changes again.

---

If you want the field notes version of analysis like this — the orchestration, decisioning, and governance patterns that get enterprise agents from pilot to production — subscribe to the newsletter. One idea, every week, from inside the work.

Sources: NVIDIA Newsroom, NVIDIA Blog, AWS, SecurityWeek, and VentureBeat.

This post is part of the pillar guide on deploying AI agents in production, which covers the four properties a pilot never tests.