The CISO here was accountable for everyone who ships: the developer, the data scientist, the analyst deploying the agents, the PM, and the marketer writing the Python. Last month, an analyst spun up an agentic workflow with access to multiple internal systems, and nobody had told security. Orca surfaced it, mapped what the agent could reach, and we were able to govern it before it became an exposure. That’s what the unified data model actually means in practice: code, cloud, AI services, and now agents, all in one place.

Our agents can call tools, hit APIs, and read from data sources, but until Orca we didn’t have a clear map of exactly which combinations were possible. Orca shows, for each agent, which tools it can invoke, which services it can reach, and what data stores sit behind those paths. That makes it obvious when an agent’s tool stack is broader than its job.

Agents were being created in different clouds and business units , and nobody had a single list for what was running where, Orca effectively gives us an Ai agent restrict a unified view showing which agents exist, which accounts they live in ,what system, they touch wand who owns them. That registry like visibility means the CISO no longer has how many agents dow we even have.