AI Factory Insider

Anne Hecht on why autonomous agents only pay off when governed

Anne Hecht· Senior Director of Product Marketing at NVIDIA at NVIDIA
·~41 min·English·NVIDIA
AgentsAI InfrastructureInferenceAI Company
TL;DR

NVIDIA's Anne Hecht explains how enterprises deploy autonomous agents safely: treat each agent as a whole system, engineer the guardrails in from the start, and run open and frontier models side by side.

01Core Mental Model

An agent is a system, not just a model

When you prompt an agent you are driving an entire system — a harness, skills, a governance layer and one or more models — not a single brain.

You're not just prompting a model when you write into that context window, you are prompting an entire system. That includes the harness, the skills, the model, the governance layer.

— Anne Hecht, AI Factory Insider
Key Insight
The reframe is what makes security tractable: if the model is only one part of the system, then locking down the model alone leaves the harness, the skills and the tool connections unguarded — which is exactly where the rest of the interview spends its time.
02What Changed

From chatbot to colleague

The leap to agents is autonomy — you hand over a whole project instead of trading prompts, and the agent plans, acts and critiques its own work before reporting back.

now you can give it a project a prompt and it'll go off and research and come back and it even can critique itself and its own results before it comes back and gives you an answer

— Anne Hecht, AI Factory Insider
Key Insight
Autonomy is what forces the security conversation. A chatbot that only answers is low-risk; an agent that takes actions on your behalf — plus the transcript's other two properties, persistent memory and self-evolving skills — needs the same controls you would put on a new hire.
03Secure by Design

Keep the rules outside the sandbox

Each agent runs in its own sandbox, but the policy that governs it lives outside — because an agent left holding its own rules could rewrite them to finish the task.

so you don't put the policies inside the sandbox with the agent because the agent could act upon the policies and change them so they need to live outside that sandbox

— Anne Hecht, AI Factory Insider
Key Insight
This is the line between a guardrail and a suggestion. Anne is careful that the risk is not malice — it's not even nefarious it's just very driven — so the fix has to be architectural: an agent can only respect a policy it has no power to edit.
04Access Control

Manage the agent like an employee

Give an agent a role and only the access that role needs — the same least-privilege discipline you apply to people, extended to which networks, models, permissions and actions it gets.

It's the same best practices. They need to have a role. They need to have access to information, but only the information that they need access to.

— Anne Hecht, AI Factory Insider
Key Insight
NVIDIA's own rollout is the tell: an agent can read Anne's calendar but cannot book time on a coworker's — reading is allowed, acting on someone else is not. The company starts fully locked down and loosens only gradually, treating each new permission as a change to test, not a default to grant.
05Data Governance

IT needs a strategy for shadow AI

Employees are already pasting company data into public models, so IT needs an adoption strategy that controls what gets uploaded and on what terms.

People are taking that roadmap and uploading it to a public model, and you don't want that.

— Anne Hecht, AI Factory Insider
Key Insight
The governance isn't abstract — Anne's own example is uploading her medical lab work to NVIDIA's internal AI because the company negotiated terms barring providers from training on that data. An internal, contractually-fenced model is what makes the safe path also the convenient one.
06Protecting Data in Use

Protect the model while it's running

Most security covers data at rest and in motion; confidential computing adds the missing third state — protecting the model and its data while they are actually in use — and now runs on GPUs.

Confidential computing guards the model and protects the model when it's in use. And then also the data that's being used.

— Anne Hecht, AI Factory Insider
Key Insight
For long-running, always-on agents this is the state that matters most: they are constantly in use, so the classic protections for stored and in-transit data leave the biggest window open. Anne notes NVIDIA pushed confidential computing from CPUs to GPUs, which is where the models actually run.
07Model Strategy

Enterprises need both open and frontier models

The model choice isn't either-or: enterprises need proprietary frontier models and open models they can own, fine-tune and run air-gapped, and most will blend both, like cloud and on-prem before them.

So I don't think it's a choice between one or the other. I think we need both open, open source, open models, as well as proprietary protected frontier models as well.

— Anne Hecht, AI Factory Insider
Key Insight
Open models aren't only a cost play. Anne ties them to security — fine-tuned open models like NVIDIA's Nemotron let teams own the weights and run air-gapped — and she frames open collaboration, the Open Secure AI Alliance, as how the industry hardens AI faster, in the open.