Policy as Code for AI Agents in 2026: Cedar at the Gateway, Rego in the Hook, and the 11.2% the Model Still Lets Through
What actually enforces limits on AI agents in 2026: OPA 1.21 and Rego v1 after the founders moved to Apple, Cedar in Amazon Bedrock AgentCore Policy (GA 3 March 2026, 13 regions, default deny), Kyverno 1.19 retiring ClusterPolicy for CEL, Claude Code hooks that deny even in bypass mode, Codex's Seatbelt and bwrap sandboxes, the MCP 2026-07-28 authorization spec, and why none of it is optional while browser-agent injection success sits at 11.2% and OpenAI says the problem is unlikely to ever be fully solved. With a tested Rego policy and a Cedar policy for tool calls.
13 minOct 5, 2026Kubernetes as the Agent Control Plane in 2026: Agent Sandbox Hit v1.0, 300 Claims a Second, and DRA in Every Supported Release
What shipped for running AI agents on Kubernetes by October 2026: the kubernetes-sigs Agent Sandbox project from a KubeCon preview in November 2025 to v1.0.0 in August, its four CRDs and gVisor, Kata and Firecracker runtime classes, Google's 300 claims per second and 16x growth figures, a density benchmark of 61 Kata agents versus 88, 133 and 274 per node, DRA going GA in 1.34 and locked on through 1.37, kagent, Dapr Agents 1.0, agentgateway, the Inference Extension's move into llm-d, the CNCF survey's 66 percent, and the Gartner 80 percent platform-team prediction nobody has measured.
13 minOct 5, 2026Observability in 2026: OpenTelemetry Graduated, the Collector Is Still v0.162, eBPF Instrumentation Is v0.14, and Datadog Bills $1.12B a Quarter
The non-AI state of observability in 2026 from primary sources: OpenTelemetry graduated from CNCF in May with 12,000 contributors from 2,800 companies, yet the Collector distribution is v0.162.0 with mixed component stability, profiles are alpha, messaging conventions are still Development and OBI, the donated Beyla, is v0.14.0. Datadog grew 36 percent to $1.12B in Q2, cost is the top concern for 31 percent of 1,363 surveyed engineers, and the levers that move the bill (tail sampling, OTTL filtering, cardinality limits, columnar storage, Arrow transport) live in the pipeline you run yourself.
13 min