How are you securing your AI infrastructure?

As agents start getting access to internal systems and taking actions on their own the security boundary gets harder to pin down. A lot of the controls we already have were built around a person using one app. An agent can pull context from one place then make a call somewhere else and now the question is where do you stop it? How are people handling this in practice? Do you enforce policy at the agent layer, at the gateway or closer to the system being touched. Also how much of the agent run do you keep when something gets blocked. A single denied call doesnt tell you much if you cant see what led to it Having every app team build their own rules seems like it would get hard to manage pretty quickly