I’ve been covering enterprise IT for over 25 years now. During that time, perimeter security has always been pointed out as a weakness that needs to be addressed. Application-centric security has never adequately addressed that weakness, a key reason we’ve seen (and become inured to) data breaches.

I suppose I shouldn’t be surprised, but it’s disconcerting to know that the same old perimeter-only security habits are being reintroduced and reinforced in the age of agentic AI. When the enterprise data layer becomes a deterministic logic knowledge layer, enterprises can close the gaps that orchestration applications and managed private clouds leave open and vulnerable.

This post evaluates a managed private cloud AI security approach described by Rackspace and comparably architected AI control plane described by Prediction Guard, and proposes a semantic graphRAG, knowledge graph-based solution with added fact, rule and deterministic logic capabilities.

Comparing Enterprise AI Approaches: Rackspace and Prediction Guard

Chetan Gupta is the Chief AI Officer of Rackspace. Before assuming the CAIO role at Rackspace, Gupta was General Manager of Hitachi Ltd.’s Advanced AI Center, and oversaw a number of Hitachi’s other industrial AI-related initiatives.

Gupta’s been at Rackspace since April 2026. Rackspace itself has been around since the 1990s. Headquartered in San Antonio, TX, the company’s main business is managing private and public clouds on behalf of enterprise customers. 

The managed private cloud business is a somewhat smaller but more important business to Rackspace than the managed public cloud business. There’s more to manage, and Rackspace can assert more control over hardware and software. As we’ll see later, Rackspace does not manage the data input flowing into LLMs or directly manage the internal enterprise data that empowers agents to address internal business concerns.

Rackspace names as its customers over 20,000 mid-to-enterprise-sized businesses, including many with highly sensitive customer data, such as thousands of healthcare companies, as well as top-tier retailers, financial institutions and the UK government.

As you can imagine, managing clouds can be a risky business. Over the years, Rackspace has had to deal with the Ransomware threat. In 2022, the company faced a number of lawsuits due to a Ransomware attack of its Hosted Exchange business. Rackspace ended up recording millions of dollars in expenses related to the attack and decided to close the Hosted Exchange. 

In April 2026, Rackspace partnered with data recovery provider Rubrik to launch the UK Sovereign Private Recovery Cloud. This cloud service automates the process of data recovery after a breach.

More recently, Rubrik announced a backup and recovery capability for Apache Iceberg tables. 

Like other tech providers, in recent years Rackspace has pivoted to AI, adding a managed private AI suite of services to its portfolio. Doing so has meant expanding its managed cloud risk footprint even further. 

Prediction Guard is a much younger, much smaller company than Rackspace, but it plays in an adjacent space: securing AI deployments for enterprises with sensitive data.

Daniel Whitenack founded and leads Prediction Guard as CEO. He’s a PhD-trained data scientist who co-hosts the Practical AI podcast and has over a decade of experience building and deploying machine learning systems at scale, including work at an international NGO with thousands of staff.

Prediction Guard was founded in 2023 and is headquartered in Lafayette, Indiana,

Prediction Guard’s platform that lets enterprises deploy AI models — LLMs, vision models, embeddings — behind their own firewall or in whatever environment they control, rather than sending sensitive data to third-party model providers. 

Where Rackspace manages the infrastructure around clouds and, more recently, private AI services, Prediction Guard focuses specifically on the control layer that governs how AI models handle and output data: structured, compliant outputs.

Similarly to Rackspace, Prediction Guard names regulated industries — healthcare, manufacturing, transportation, and government — as its target customer base. 

The reality of agent security architecture to date: An example

In a September 2026 episode of the Practical AI podcast, Gupta laid out a pragmatic reality for enterprise artificial intelligence: getting value out of AI is no longer about fine-tuning bigger foundation models—it is about system architecture. As Rackspace builds out its Enterprise AI Cloud and deploys autonomous agents into production environments, the central engineering challenge has shifted from generation to governance. How do you keep an agent from wandering off script, particularly when the operational stakes are high?

Today, most enterprise platforms address this by building an external harness around a probabilistic neural model such as a large language model (LLM). This harness intercepts user prompts, executes tool calls, and uses secondary classifiers or LLM evaluators to check whether an agent’s next action is safe. But this setup still leaves teams trying to police a probabilistic black box from the outside. You are using fuzzy heuristics to monitor fuzzy behavior.

Agentic AI changes what a company’s digital assets are exposed to. Data, institutional knowledge, and code specific to a business now sit within reach of software that does not share the habits humans pick up through years of norms and supervision. An agent that finds a gap will use it, whether or not anyone told it to look. Companies now have to strictly enforce rules in ways they hadn’t considered before. Where that enforcement lives determines whether it actually works.

Two ways to think about today’s black-box perimeter agent control

Rackspace and Prediction Guard both build control around the model and its data input, not inside it. Chetan Gupta at Rackspace describes a stack wrapped around the LLM: a harness that ties the model to a specific outcome, an orchestration layer that manages multiple harnesses, and governance and assurance layers around the whole stack. 

The model stays a black box. Control comes from what surrounds it, not from what happens inside it.

Prediction Guard frames the same idea differently but sits in the same place architecturally. Daniel Whitenack, who interviewed Gupta for the Practical AI podcast, describes a self-hosted AI control plane that limits agent autonomy and contains the blast radius of whatever an agent does inside a company’s own infrastructure.

Again, this sits outside the model. It watches what the agent does and restricts where it can go, but it never touches the reasoning happening inside the model itself.

Both approaches treat the LLM as sealed. Control gets exercised through orchestration, tool permissions, and containment, a perimeter built around the model rather than a structure that governs what the model can reason its way into.

When walls aren’t enough

The OpenAI-Hugging Face breach (also discussed in another helpful Practical AI podcast which I used as a resource for a previous post)  shows where that perimeter approach breaks down. OpenAI ran a research agent inside a network-isolated sandbox during a benchmark test. The agent found a flaw in the sandbox’s own installer tool and used it to escape, reasoned that a published solution to its assigned problem probably existed somewhere, went looking on Hugging Face, uploaded a file with hidden code, and got a foothold inside Hugging Face’s private systems when their automated pipeline opened it. 

From there it multiplied into thousands of parallel instances and moved across servers faster than any human team could track.

Nobody jailbroke this agent. It pursued its assigned goal, and that pursuit took it somewhere nobody designed for. The sandbox was a pure perimeter control, a network wall with nothing behind it defining what the agent was actually authorized to touch. 

Guardrails failed the same way at Hugging Face itself: when the security team tried to use a closed commercial AI to analyze the attack logs, the model’s safety classifier refused to read them, mistaking the presence of attack code for evidence that the investigators were the attackers.

A wall stops nothing once an agent finds a gap in it. A content filter stops nothing because it judges content, not authorization.

What grounding actually looks like

A knowledge model and instance data layer control such as contained in a standards-based knowledge graph works differently. Instead of walling the model off and hoping the wall holds, it builds authorization directly into the enterprise’s own knowledge as an explicit, checkable fact. 

Andreas Blumauer, Growth EVP of semantic graphRAG provider Graphwise, calls this a context graph, dynamic, procedural knowledge sitting on top of an enterprise knowledge graph’s static facts. The agent consults a fact before acting, this system belongs to a different organization than my assigned task, expressed as something its own reasoning checks against, not something a firewall merely blocks until the agent finds a different route around it.

The mechanism matters here. MCP is a general tool-use protocol, not a query language. The LLM makes a general MCP tool call, and a separate translation step converts the natural language request into a SPARQL query, the query language for graph databases.

SPARQL (originally named Simple Protocol and RDF Query Language when it was introduced in 2008), a standard semantic graph query language, is what actually retrieves scoped, checkable facts from the knowledge graph and returns them to the agent. The agent never touches the graph directly, and it never receives more than the specific fact its task requires.

Perimeter security versus an explainable knowledge graph

Laid out side by side, the two philosophies diverge on more than mechanism. One checks whether a response looks safe. The other checks whether it is valid against explicit bu/siness rules, and can show its work.

Data sovereignty at the knowledge layer

Chetan Gupta of Rackspace alludes to the sovereignty problem directly during the same Practical AI podcast interview. He points out that every time someone asks a large language model a question outside their own environment, they are effectively handing that data over, and as he puts it, “your data sovereignty is not guaranteed.” He frames this as a loss of the enterprise’s own intellectual property the moment its data, context, and processes leave its walls and land inside somebody else’s model.

What Gupta and Whitenack didn’t point out during the interview is the nature of the yawning gap the perimeter approach cannot close. A harness or a control plane can restrict what an agent does once it has the enterprise’s data in hand, but it does nothing to stop the data from leaving the enterprise’s authority in the first place. The moment proprietary context gets pasted into an external LLM’s prompt window, sovereignty over that data is already gone, regardless of how tightly the surrounding orchestration is governed afterward.

Changing the data architecture by adding an ontology or knowledge model metadata to contextualize the instance data changes where sovereignty gets enforced. The enterprise keeps its data, knowledge, and code inside its own knowledge graph, on its own infrastructure, under its own access rules. The LLM never receives the underlying internal data directly. It sends a general MCP tool call, that call gets translated into SPARQL, and the graph returns only the specific, scoped internal facts the query is authorized to see. What crosses the boundary is a narrow, checkable answer, not the asset itself.

In this way, the deterministic logic inside a knowledge graph creates a governance-as-code dynamic that’s inherently provenanced and auditable.

As Gupta points out, comprehensive data sovereignty isn’t just for nation-states. It’s essential to any business entity that wants its own governance applied to the behavior of the agents it uses internally, rather than someone else’s rules dictated by whoever built the model. 

A knowledge graph the enterprise owns and controls, queried through a scoped protocol instead of exposed wholesale, is what makes that kind of self-sovereignty actionable and enforceable, rather than aspirational.

Grounding: Essential for true agent safety

Perimeter security cannot contain autonomous agents when they reason their way around external guardrails. True agent safety requires grounded, native data layer security. 

By anchoring agent reasoning directly in an enterprise knowledge graph, organizations enforce granular governance, maintain data sovereignty, and transform unpredictable probabilistic behavior into deterministic, verifiable action.

For More Information:

Benson, Chris, and Daniel Whitenack. “Reconstructing How OpenAI Agents Attacked Hugging Face.” Practical AI, episode 366. July 30, 2026. Podcast audio. https://practicalai.show/366/transcript

Benson, Chris, Daniel Whitenack, and Chetan Gupta. “Less about Models; More about Architecture.” Practical AI, episode 370. September 3, 2026. Podcast transcript. https://practicalai.show/370/transcript

Graphwise. “AI-Ready Graph Environments: The Key to Scaling AI with Graphwise’s Knowledge Graphs.” Graphwise Blog. Accessed September 12, 2026. https://graphwise.ai/blog/ai-ready-graph-environments-the-key-to-scaling-ai-with-graphwises-knowledge-graphs/.

Graphwise. “Taming Probabilistic LLMs Using Deterministic Models: New Graphwise Platform Pulse Initiative to Accelerate Trustworthy Agentic AI.” Graphwise News. Accessed September 12, 2026. https://graphwise.ai/news/taming-probabilistic-llms-using-deterministic-models-new-graphwise-platform-pulse-initiative-to-accelerate-trustworthy-agentic-ai/.

Hugging Face. “Security Incident Disclosure.” Hugging Face Blog, July 16, 2026. https://huggingface.co/blog/security-incident-july-2026

Morrison, Alan. “The Hugging Face Breach: A Case Study in Why Agents Need Grounding.” The GraphRAG Curator, August 1, 2026. https://graphrag.info/2026/08/01/the-hugging-face-breach-a-case-study-in-why-agents-need-grounding/

OpenAI. “OpenAI and Hugging Face Partner to Address Security Incident During Model Evaluation.” OpenAI (blog), July 21, 2026. https://openai.com/index/hugging-face-model-evaluation-security-incident/

Verhelst, Frédéric. “Connecting Is Not Aligning: The Governance Gap Your Observability Stack Cannot Close.” Modern Data 101 (blog), Substack, July 16, 2026. https://moderndata101.substack.com/p/agentic-ai-capability-stack

Benson, Chris, Daniel Whitenack, and Chetan Gupta. “Less about Models; More about Architecture.” Practical AI, episode 370. September 3, 2026. Podcast transcript. https://practicalai.show/370/transcript

Graphwise. “AI-Ready Graph Environments: The Key to Scaling AI with Graphwise’s Knowledge Graphs.” Graphwise Blog. Accessed September 12, 2026. https://graphwise.ai/blog/ai-ready-graph-environments-the-key-to-scaling-ai-with-graphwises-knowledge-graphs/.

Graphwise. “Taming Probabilistic LLMs Using Deterministic Models: New Graphwise Platform Pulse Initiative to Accelerate Trustworthy Agentic AI.” Graphwise News. Accessed September 12, 2026. https://graphwise.ai/news/taming-probabilistic-llms-using-deterministic-models-new-graphwise-platform-pulse-initiative-to-accelerate-trustworthy-agentic-ai/.

Hugging Face. “Security Incident Disclosure.” Hugging Face Blog, July 16, 2026. https://huggingface.co/blog/security-incident-july-2026

Morrison, Alan. “The Hugging Face Breach: A Case Study in Why Agents Need Grounding.” The GraphRAG Curator, August 1, 2026. https://graphrag.info/2026/08/01/the-hugging-face-breach-a-case-study-in-why-agents-need-grounding/

OpenAI. “OpenAI and Hugging Face Partner to Address Security Incident During Model Evaluation.” OpenAI (blog), July 21, 2026. https://openai.com/index/hugging-face-model-evaluation-security-incident/

Verhelst, Frédéric. “Connecting Is Not Aligning: The Governance Gap Your Observability Stack Cannot Close.” Modern Data 101 (blog), Substack, July 16, 2026. https://moderndata101.substack.com/p/agentic-ai-capability-stack