FedEx CISO: Vet AI agents with guardrails first
The stronger implication is that observability and human accountability must be designed as control points, not added after deployment. If every agent action must be attributable to a person, CIOs and CISOs will need policy for identity, logging, approval thresholds, and model behavior review across internal and vendor-supplied agents alike. That raises practical trade-offs: tighter controls may slow experimentation, but weak provenance can create regulatory, customer, and operational exposure at scale.
The article also highlights a portfolio issue. AI becomes more defensible when tied to operational outcomes such as maintenance, network resilience, or workflow execution rather than isolated proofs of concept. Leaders should distinguish between employee productivity use cases and process-embedded agents, because the latter carry very different risk, integration, and assurance requirements.
Useful next questions for leadership teams:
- Which executive owns approval rights for new AI agents and their system access?
- What evidence can we produce to explain an AI-driven action to auditors, regulators, or customers?
- Which use cases have measurable business outcomes and data quality mature enough to justify scale?
- Where do we need workforce training versus stronger technical controls?
NEW YORK — The tide of AI agents flooding the enterprise continues to rise, but that inevitable wave must still be vetted to ensure they operate within enterprise guardrails, according to Gene Sun, corporate vice president and CISO at FedEx.
For the logistics and transportation company, which brings in almost $86 billion in annual revenue, that means AI agents introduced to enterprise ecosystems must come from within and be cleared by security, according to Sun.
“Even employee-created, self-created agents are internally based on our own platform. We have to register it. We have to know about it,” Sun told InformationWeek after delivering the keynote at the recent ONUG AI Networking Summit.
Strict control over where and how AI agents are deployed is necessary, especially given reports of agents exploiting loopholes in guardrails in order to fulfill commands.
That means observability is mandatory and the originator of an agent’s actions must be known, Sun said.
“Every single action of agents must have agency traced to human beings,” he said.
How FedEx meshes AI with the real world
During the keynote, Sun was joined onstage by Arvind Rajagopalan, vice president of data and AI at FedEx, where they discussed AI at a global scale while maintaining security and control.
FedEx’s use of AI converges with the real world as it ships 18 million parcels daily in about 220 countries and territories around the globe. Sun explained how digital and physical realms function in tandem.
“AI cannot replace our airplanes, our trucks, our distribution network,” he said. However, the data associated with packages FedEx ships can provide insight into global economics.
“We’re going to leverage AI to create additional enterprise value,” Sun said.
In addition to processing that data, Rajagopalan said the digital side of the business includes assessing FedEx’s vehicles for maintenance to keep deliveries flowing.
“Our strategy has been to work on building out a real-time digital twin that gives us visibility into the entire network, what is happening at any given point in time with every single element,” he said.
FedEx deployed AI to assist with monitoring and prescribing preventive maintenance for the many moving parts across the shipper’s network.
Further, keeping appraised of external factors such as weather around the world also factors into FedEx’s planning, Rajagopalan said. That data is fed to AI to assist with decision-making to ensure deliveries arrive on schedule.
“This is helping us tremendously in terms of keeping our network fresh, scaled, as well as robust,” he said.
Related:InformationWeek Podcast: Is AI the best watchdog for the supply chain?
Arvind Rajagopalan, vice president of data and AI at FedEx. [Joao-Pierre S. Ruth/InformationWeek]
AI has also become a critical component for business strategy.
Sun did not play coy about how top-of-mind the technology is for upper management, as well as the need to show the technology can be trusted.
“Absolutely every single board meeting, AI is front and center … no doubt about it,” he said.
FedEx’s board wants to know what kind of AI use cases are being deployed and how the technology interacts with corporate systems, Sun said. That includes asking about governance, as AI may present recommendations to customers or set actions in motion across the company’s operations.
“Do we know what the AI model is doing? If a regulator or customer asks questions, can we explain that AI action?” Sun asked.
FedEx’s leadership also wants to know the value AI delivers beyond proof of concept, he said. They’re interested in understanding how an AI project could scale — and how quickly. That requires clean and accurate data so AI models can function with complete context to deliver results, Sun said.
Securing AI at the start
Rajagopalan added that conversations about the benefits of AI also include discussions of risks and how to establish guardrails early on.
“While there is a massive push and focus on getting things done and scaling AI across enterprises, it is very, very important to keep things secure,” he said.
FedEx is actively looking at two different types of AI to scale across two different areas, Rajagopalan said. The first focuses on productivity tools for the company’s more than 450,000 employees. In December, FedEx announced its multi-year partnership with Accenture to provide AI literacy training across the company.
The second is a plan to launch AI agents to work in business processes. Rajagopalan cited FedEx CEO Raj Subramaniam’s goal to see 50% of the company’s workflows “agentified” as soon as possible.
“That is front and center in terms of how we think … and what we are looking to get done in the next couple of years,” Rajagopalan said.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.