Don Bosco Durai is co-founder and chief technology officer of Trust3 AI, which grew out of Privacera’s enterprise data-governance business. A co-creator of Apache Ranger and Apache Atlas, he has built security infrastructure spanning online fraud prevention, big-data access control, and the emerging challenge of governing autonomous AI agents.
Durai co-founded Bharosa, a developer of strong-authentication and fraud-detection technology that Oracle acquired in 2007. In 2012, he and Balaji Ganesan founded XA Secure, which centralized security administration and access controls for Hadoop. Hortonworks acquired the company in 2014, and its technology became Apache Ranger, an open-source framework for authorization, policy management, and auditing. Durai remains a Ranger project-management-committee member and committer.
In 2016, Durai and Ganesan founded Privacera to extend enterprise data governance across cloud environments. As generative AI created new exposure points, Durai expanded that work to model inputs and outputs, sensitive data, access controls, and monitoring. The resulting open-source PAIG project provides security, safety, and observability infrastructure for AI applications. At Trust3 AI, Durai, Ganesan, and fellow co-founder Neeraj Sabharwal are developing infrastructure to discover, monitor, and secure AI agents.
What enterprise agents need to earn trust
- End-to-end identity propagation. Agent frameworks often place tools, tasks, memory, and powerful service credentials inside one process, allowing a compromised component to reach sensitive resources. Durai argues that the initiating user’s identity must follow every task, tool invocation, database query, and API call, with permissions enforced for both the user and the agent. An HR assistant, for example, should not expose another employee’s benefits simply because its service account has administrative access.
- Security evaluation as a production gate. Answer quality cannot determine whether an autonomous system is safe to deploy. Durai advocates testing prompt injection, sensitive-data leakage, unauthorized actions, vulnerable dependencies, compromised models, and runaway execution, then using risk scores to assess internally developed and third-party agents alike.
- Continuous enforcement and observability. His security model combines predeployment evaluation, runtime authorization and guardrails, and ongoing monitoring. Because models, dependencies, prompts, and user behavior change, teams need measurable failure thresholds, alerts, and visibility into sensitive-data exposure. He outlines these requirements in his AI Engineer Summit presentation.
- Risk-based approval thresholds. Routine actions can proceed automatically, while consequential operations should trigger human review or a dedicated approval workflow. The aim is to give autonomous systems useful authority without allowing them to exceed the permissions, regulatory obligations, and accountability expected of enterprise employees.
