OneTrust announced CORIE on 29 September 2026 as a shared intelligence layer inside the OneTrust Platform for governing AI agents. The company describes CORIE as a way to use existing privacy, consent, risk, data and AI program context to enforce rules as agents work across systems and to record the evidence behind those decisions.
That makes this more than another enterprise AI feature launch. Agent governance is often described as a policy problem, but policies alone do not control a tool call at the moment an agent asks for data, invokes an application or prepares an action. OneTrust is positioning CORIE at that moment: between the agent request and the enterprise system that may expose data or permit a consequential action.
What OneTrust announced
OneTrust says CORIE, short for Contextual Orchestration for Reasoning, Intelligence, and Evidence, draws on governance context already held in the OneTrust Platform. That can include consent signals, risk decisions, policies, controls and regulatory intelligence. The stated purpose is to decide what an agent is permitted to do, enforce that decision where the work happens and preserve proof of the result.
The announcement gives three core functions. CORIE turns organizational context and governance decisions into rules an agent can use on every request. It enforces those rules at the tool call by allowing an action, stopping it or flagging it for human review. It also keeps the checker separate from the agent and records the agent, request, purpose, outcome and governing policy.
OneTrust also cites its own AI-Ready Governance Report, saying 87 percent of respondents encourage agent use while 47 percent say they have clear governance, oversight and controls. Treat those survey figures as vendor-reported market context, not independent proof of CORIE adoption or performance.
Why this matters
The important shift is from governance as documentation to governance as runtime evidence. When a marketing, sales, HR, finance or engineering agent asks to use data, the governance question is not only whether a policy exists. It is whether the policy can be applied to the exact request, whether exceptions move to the right reviewer and whether the organization can later show what happened.
That evidence matters for compliance teams because agent activity can combine personal data, regulated records, third-party systems and delegated authority. It also matters for security and audit teams because the same record can explain why a request was denied, which policy applied and whether the agent or user changed the task after the decision.
Maetra's AI compliance evidence checklist follows the same operational logic. Useful compliance records need an owner, control, source, timestamp and freshness state. For agents, they also need the request, tool boundary, decision and final effect.
What buyers should verify
Teams evaluating CORIE should ask which agent platforms, tool gateways and enterprise systems it can actually govern today. They should separate native OneTrust agents from customer-built and third-party agents, because each integration path may have different enforcement depth.
They should also test evidence exports. A governance team will need records that survive audits, incident reviews and data-subject requests. The record should show the agent identity, requester identity when available, policy version, data category, business purpose, reviewer action when human review is triggered and final downstream effect.
Most of all, buyers should test bypass resistance. A runtime governance layer is useful only if agents cannot quietly switch to another route, call a parallel connector or move sensitive data before the check happens.
What remains uncertain
The announcement does not independently prove customer outcomes, false-positive rates, integration coverage or how CORIE behaves under adversarial prompts and compromised agent identities. OneTrust's examples explain intended controls, but customers will still need implementation testing before treating CORIE as a compliance control.
The strongest claim that can be made from the current evidence is narrower: OneTrust has introduced a product layer meant to connect policy context, runtime enforcement and evidence capture for AI agents. Its effectiveness will depend on integrations, configuration quality, reviewer workflow and the completeness of the retained records.
Maetra analysis
CORIE is useful market evidence because it reflects where AI governance is heading. Enterprises are moving past static registries and into control points that sit in the path of agent action. That does not remove the need for an inventory. It makes the inventory more important, because a runtime decision layer needs to know which agents exist, what systems they can reach and which policies apply.
For regulated teams, the practical pattern is clear. Maintain an agent inventory. Map agents to policies, data categories and compliance obligations. Evaluate each consequential request at runtime. Route the subset that policy marks for human review. Preserve evidence that connects the request, context, decision and outcome.
That is the difference between saying agents are governed and being able to prove how a specific agent was governed on a specific day.
Sources
Primary source: OneTrust CORIE announcement.
Context: OneTrust AI Governance resources.