You get a Kubernetes cluster with an Internal Developer Platform already running: ArgoCD for GitOps, Kyverno for admission control, Falco for runtime detection, Prometheus for observability. You also get an AI agent that reaches its tools over MCP and holds scoped cluster access, and you drive it through a set of attacks. Deploy a non-compliant workload. It goes through, because nothing stops it yet. Turn on the guardrail and run it again. This time it gets rejected. Try to escalate privileges. Try to modify infrastructure outside Git. The controls already in place reject both. Then exfiltrate data through the agent's own response. It works, because none of the existing tools inspect what the agent says back. Turn on the agent-specific guardrail and the same attempt gets blocked. When we regroup, we map what happened. The 80% that existing LF/FOSS/CNCF tools already govern gets shut down the moment the right control is on. The 20% that gets through, the data leaving in the agent's response, stays open until agent-specific tooling closes it. You leave with a concrete governance map and the exact list of failure modes your own platform probably is not covering yet.