WEBVTT

NOTE Sentence-level transcript of https://www.youtube.com/watch?v=IavxrdVnwXM

NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/IavxrdVnwXM.html. A cue ends where the next begins, or 2 s after its last word.

s1
00:00:12.880 --> 00:00:14.080
Um, hi everyone.

s2
00:00:14.080 --> 00:00:16.960
Welcome to um, AI Engineer New York.

s3
00:00:16.960 --> 00:00:19.119
I'm super excited to be here today.

s4
00:00:19.119 --> 00:00:20.320
Uh, my name is Ally.

s5
00:00:20.320 --> 00:00:24.160
How I'm a member of technical staff at Keycard.

s6
00:00:24.160 --> 00:00:26.960
Um, I'm here with some amazing panelists today.

s7
00:00:26.960 --> 00:00:29.679
We have Ian, CEO of Keycard.

s8
00:00:29.679 --> 00:00:42.399
We have Michael Davis, um, global chief security architect at JP Morgan Chase, and we have we have Dick Hart, the founder of AOTH and co-creator of OOTH with us on stage today.

s9
00:00:42.399 --> 00:00:47.200
I'm super excited to talk to all of them about intentbased authorization.

s10
00:00:47.200 --> 00:00:56.079
Um, and to set the stage, I want to bring to light that as more companies are looking to give their agents increased levels of autonomy, they're looking to runtime

s11
00:00:56.079 --> 00:00:58.239
authorization to help.

s12
00:00:58.239 --> 00:01:07.520
Runtime off is the practice of authorizing an agent per tool call rather than having the agent hold broadstanding access that it will eventually misuse.

s13
00:01:07.520 --> 00:01:12.400
However, is this tool call or not is never a simple question.

s14
00:01:12.400 --> 00:01:17.759
This is because many MCP tools and APIs are coarse grain.

s15
00:01:17.759 --> 00:01:24.479
Humans struggle to write the perfect policy and the environment around the agent will change as it runs.

s16
00:01:24.479 --> 00:01:35.840
Intent can help by providing extra context so that at runtime we can make better authorization decisions about what an agent is allowed or is not allowed to do.

s17
00:01:36.560 --> 00:01:44.799
So to continue I would like to talk about um really dive into why do we need intentbased off in the first place.

s18
00:01:44.799 --> 00:01:46.479
Models have dramatically improved.

s19
00:01:46.479 --> 00:01:48.320
They have bigger context windows.

s20
00:01:48.320 --> 00:01:53.119
They're able to verify work because model vision capabilities have improved.

s21
00:01:53.119 --> 00:01:57.280
In many contexts, people are proclaiming that AGI is here.

s22
00:01:57.280 --> 00:02:04.719
If the models are so good, if AGI is really here today, then why are teams struggling to give their agents more autonomy?

s23
00:02:04.719 --> 00:02:06.479
Ian, let's start with you.

s24
00:02:06.479 --> 00:02:09.200
You're helping men and financial enterprises at Keycard.

s25
00:02:09.200 --> 00:02:11.280
What are you seeing that's getting in the way?

s26
00:02:11.280 --> 00:02:17.760
Well, I think broadly speaking, enterprises, especially financial services firms, regulated industries are almost always security first.

s27
00:02:17.760 --> 00:02:30.720
It's how they build trust in their business and maintaining the business continuity is by our first like the first priority then innovation is second third or fourth I think like broadly speaking in in any enterprise what you see is this like hodgepodge

s28
00:02:30.720 --> 00:02:40.800
of different little islands of different little identities of different little systems of from across all different worlds and how do you actually tie that together in a way that an agent can navigate through that

s29
00:02:40.800 --> 00:02:56.239
ask for access and then also ensure that the agent can outperform like uh something that was by the user or the business And the unfortunate situation is most of our systems today are coarse grained right I don't know Salesforce is a good example where a very long time they had a single scope

s30
00:02:56.239 --> 00:03:10.959
which was API on their oath which is like in the context of an agent uh not very helpful so that's that's the broadly the first and foremost part is that most of the systems they have for security today were designed for a world where humans were making all the decisions and software is very deterministic

s31
00:03:10.959 --> 00:03:18.879
not this new fangled magic box we've invented that basically reasons and tries over and over again to find a solution to a problem.

s32
00:03:19.120 --> 00:03:21.120
Doug, how is OOTH part of the problem?

s33
00:03:21.120 --> 00:03:25.200
How is OOTH getting in the way and why is it not the right fit for agents?

s34
00:03:25.200 --> 00:03:34.640
Well, when people started looking at how do we authorize agents to access something, the tool that was sitting there on the shelf was OOTH and people grabbed that tool and says

s35
00:03:34.640 --> 00:03:35.680
here's a tool.

s36
00:03:35.680 --> 00:03:37.120
This is authorization.

s37
00:03:37.120 --> 00:03:38.480
It should be able to solve the problem.

s38
00:03:38.480 --> 00:03:41.280
But OOTH was not designed for this kind of world.

s39
00:03:41.280 --> 00:03:46.239
It was designed originally for like how do I let this website talk to this website?

s40
00:03:46.239 --> 00:03:48.080
You know in O2 we added scopes.

s41
00:03:48.080 --> 00:03:50.480
Before that it was just do anything.

s42
00:03:50.480 --> 00:03:54.000
Um but it required you to be pre-registered.

s43
00:03:54.000 --> 00:03:57.200
It's expecting that there's a browser involved in a redirect.

s44
00:03:57.200 --> 00:04:00.959
You know OOTH has evolved over the years to support some other things.

s45
00:04:00.959 --> 00:04:02.959
But the agentic world is completely different.

s46
00:04:02.959 --> 00:04:05.519
We don't know ahead of time what the agent needs to do.

s47
00:04:05.519 --> 00:04:08.080
We need to go and make that decision over time.

s48
00:04:08.080 --> 00:04:11.280
different instances of an agent are going to need different kinds of things.

s49
00:04:11.280 --> 00:04:17.600
And you know, as Ian talked about, the granularity of the scopes that people says, well, we already have scopes for OAS.

s50
00:04:17.600 --> 00:04:24.639
Let's just map those over to agents is far too coarse grain for what agents are doing.

s51
00:04:24.639 --> 00:04:29.040
Davis, how are you seeing enterprises move towards higher levels of autonomy?

s52
00:04:29.040 --> 00:04:33.360
Yeah, I think the key piece is uh how do you deal with that coarse grain problem?

s53
00:04:33.360 --> 00:04:46.320
And what I've seen the kind of more successful enterprises is they kind of board agents like they onboard developers right start with you don't get full you know commit access day one right you're actually having to go through and add the levels of capability

s54
00:04:46.320 --> 00:04:55.840
as they mature right and so the definitions that enterprise are coming up with what is the context that makes this agent safe and it isn't just usually what the agent says

s55
00:04:55.840 --> 00:05:06.160
right um it can you know attest to something but it's other things like the environment around it and other information that can help you understand levels of autonomy Very simple example would be where is the sandbox running

s56
00:05:06.160 --> 00:05:11.440
is it in a sandbox right those type of things can change the level of autonomy that's allowed

s57
00:05:11.440 --> 00:05:22.800
absolutely yes we mentioned that core screen access problem and to put that into perspective um to give an example um with notion's MCP server you can say fetch this page which is like the view page

s58
00:05:22.800 --> 00:05:34.479
um tool or get page but you can't say just get this database on this page um how is runtime authorization based on intent a better model that's for anyone.

s59
00:05:35.520 --> 00:05:36.400
I'll take a shot at.

s60
00:05:36.400 --> 00:05:43.759
So to me, um this is something that the financial services industry hopefully maybe we can learn from the background that you know banks have gone through.

s61
00:05:43.759 --> 00:05:50.400
Um banks moved long ago from authorizing and authenticating humans to authorizing the transaction, right?

s62
00:05:50.400 --> 00:05:52.080
And when is that transaction occurring?

s63
00:05:52.080 --> 00:05:53.680
At runtime, right?

s64
00:05:53.680 --> 00:06:02.960
Um, and so I think that, you know, runtime authorization is we're going to be able to learn from the kind of the scars of the past that we've had and apply it to this new new problem.

s65
00:06:02.960 --> 00:06:09.840
Um, I also think that uh, you know, one thing is easier to debug something at runtime when you understand the intent, right?

s66
00:06:09.840 --> 00:06:12.960
I think we've all remembered back in the day writing checks, right?

s67
00:06:12.960 --> 00:06:15.919
But, um, or seen those things on TV now, I guess, is the right thing.

s68
00:06:15.919 --> 00:06:19.120
Um, but, uh, you know, writing checks, there was a memo field there, right?

s69
00:06:19.120 --> 00:06:22.639
That memo field was used to actually tell the intent of what this payment was.

s70
00:06:22.639 --> 00:06:24.720
But the check itself did have limits, right?

s71
00:06:24.720 --> 00:06:28.639
The price, the pay, the date, etc. Right?

s72
00:06:28.639 --> 00:06:33.840
I think a lot of those concepts are now being applied and can be applied to help with this runtime.

s73
00:06:33.840 --> 00:06:37.199
Intent's sort of one of those, you know, like many words, words are hard.

s74
00:06:37.199 --> 00:06:43.199
And so, you know, building on uh the example here of making a payment of a transaction, right?

s75
00:06:43.199 --> 00:06:44.319
You know, that's not a scope.

s76
00:06:44.319 --> 00:06:48.479
That's can I do this one thing in this particular context?

s77
00:06:48.479 --> 00:06:52.160
Well, this one payment, but I think we need a an agent.

s78
00:06:52.160 --> 00:07:00.560
we to make any decision should it be able to do it you need all the rest of the context of why are we making this payment what are all the things that happened before

s79
00:07:00.560 --> 00:07:14.000
you know did we just make the same payment just like you know 5 seconds ago and now this is a double payment right you know just because this is right in context doesn't by itself doesn't mean it's the right thing within the broader mission and so

s80
00:07:14.000 --> 00:07:28.560
you know in AOTH we're working on the concept of a mission that is what do we want the agent to accomplish big picture and then each of the decision decisions are made within the context you know the intent around what's happening big picture around doing that and

s81
00:07:28.560 --> 00:07:42.319
you need granularity at the transaction layer for many of the things to know what exactly is happening not just I'm allowed to go and make payments yeah I think one of the most interesting things I think about like a practical example

s82
00:07:42.319 --> 00:07:54.879
like to understand like why intents required is if you have two chat GPT sessions or two cloud sessions in one session I say hey help me go to do some shopping in the other session I say, "Hey, help me understand if there why there's a bug in production."

s83
00:07:54.879 --> 00:08:03.599
Those have very different like profiles in terms of like like what permissions they should have and also when they should bring you back into the loop, like when should the human be involved again?

s84
00:08:03.599 --> 00:08:10.160
And so at the end of the day, if we don't have intent or some capacity to like relay what is the user or the business's intent with this thing,

s85
00:08:10.160 --> 00:08:12.319
we actually can't get to like autonomy, right?

s86
00:08:12.319 --> 00:08:16.240
And so a lot of the talks this morning were, hey, we're going to run our business on agents, we're going to do all this stuff.

s87
00:08:16.240 --> 00:08:17.360
It's like, well, great.

s88
00:08:17.360 --> 00:08:26.960
But what happens the first minute like a pocket OS style instant happens where like it actually accidentally deletes a production database instead of staging because it has coarse grained access instead of long scoped access.

s89
00:08:26.960 --> 00:08:33.760
And so we what we want as an industry is to leverage this like magic box we've created to like automate our lives.

s90
00:08:33.760 --> 00:08:39.360
The current state of the world is that you can do that and take all of the risk and then you can see all the instance that come from it.

s91
00:08:39.360 --> 00:08:52.160
And so until we actually solve that underlying problem, realizing true autonomy, so being able to operationalize our business and be able to step away as humans and scale that, we have to solve intent first.

s92
00:08:52.160 --> 00:08:52.880
Absolutely.

s93
00:08:52.880 --> 00:08:57.600
And now that we understand why we need intentbased off, let's talk about what it is practically.

s94
00:08:57.600 --> 00:08:58.399
What are the primitives?

s95
00:08:58.399 --> 00:09:00.640
What does it actually look like in practice?

s96
00:09:00.640 --> 00:09:04.080
Um Dick hinted at it with the concept of the AOTH mission.

s97
00:09:04.080 --> 00:09:06.880
Um so Dick, elaborate on the mission.

s98
00:09:06.880 --> 00:09:08.720
What is the mission based off of?

s99
00:09:08.720 --> 00:09:10.800
Is it based off of the user's intent?

s100
00:09:10.800 --> 00:09:12.160
Is it the agent's intent?

s101
00:09:12.160 --> 00:09:14.800
Or is it a combination of the two?

s102
00:09:14.800 --> 00:09:18.560
Uh well, the agent, you know, should be working on behalf of the person.

s103
00:09:18.560 --> 00:09:25.120
And in AOTH, we define a person as either the organization or a human because it could be operating on either one of those.

s104
00:09:25.120 --> 00:09:35.279
And so it needs to be acting in the best interest of the person that it's acting on because that is who's ultimately responsible for what the agent does, right?

s105
00:09:35.279 --> 00:09:38.640
The agent agent can't be responsible, right?

s106
00:09:38.640 --> 00:09:43.839
And and so the mission is something that the person is giving the agent to do.

s107
00:09:43.839 --> 00:09:51.839
The agent uh a good agent is going to go and negotiate with a person to go and talk more about like what what could what are the parameters around that.

s108
00:09:51.839 --> 00:10:02.800
You know a good example is when you think of back you know in the day which seems like 3 months ago when you would want to code something up and you create a plan and then the agent would do the plan.

s109
00:10:02.800 --> 00:10:05.200
Now you just tell it and it figures everything out.

s110
00:10:05.200 --> 00:10:07.519
But that whole concept of what's a plan?

s111
00:10:07.519 --> 00:10:08.959
what are you trying to do?

s112
00:10:08.959 --> 00:10:10.320
And you give that to the agent.

s113
00:10:10.320 --> 00:10:16.320
So then that then is a context around your where you're making authorization decisions later on.

s114
00:10:16.320 --> 00:10:20.320
And then that mission identifier tracks through everything.

s115
00:10:20.320 --> 00:10:30.320
So you can go and you know audit and be able to see what were all the things that happened and what were the decisions that happened in the context of this one mission,

s116
00:10:30.320 --> 00:10:30.560
right?

s117
00:10:30.560 --> 00:10:36.399
Where today you know there isn't really a good concept of agent identity or the mission, right?

s118
00:10:36.399 --> 00:10:47.120
It's just making something and and things are making decisions without really knowing which expl which instance of the agent's doing it or what's a context of what mission is this involved in.

s119
00:10:47.120 --> 00:10:48.399
Right.

s120
00:10:48.399 --> 00:10:58.720
Tell me more about that negotiation phase because what happens if a user is talking to an instant agent and it talks to that agent and says I want you to go read the CEO's email.

s121
00:10:58.720 --> 00:11:00.399
That's outside of the scope of that agent.

s122
00:11:00.399 --> 00:11:03.839
So is that intent rejected from the user?

s123
00:11:03.839 --> 00:11:14.560
uh should be right so we know with a good separation and I don't know whether I forget whether we're talking about this later but the separation concerns of the

s124
00:11:14.560 --> 00:11:25.519
worker right there's an agent that's doing the work and we believe there should be a separate agent that's supervising what this one does and so that you have a separation of concerns

s125
00:11:25.519 --> 00:11:36.160
where this one can't do any of the work but it gets decide what this agent gets to do and so if the user says oh I want you to go read the co's email, that's probably going to get caught

s126
00:11:36.160 --> 00:11:38.560
in deterministic policies right away, right?

s127
00:11:38.560 --> 00:11:41.200
Like that's not a vague thing, right?

s128
00:11:41.200 --> 00:11:45.279
Reading reading somebody else's email, we've got good controls for that.

s129
00:11:45.279 --> 00:12:02.560
Um, but telling the agent to, you know, send the CEO's forward a CEO's email to the outside world, that's a little more vague and that's the kind of thing that ideally comes back to a supervising agent says that's probably a bad idea

s130
00:12:02.560 --> 00:12:04.800
and no, you can't do that.

s131
00:12:04.800 --> 00:12:05.200
Absolutely.

s132
00:12:05.200 --> 00:12:09.200
So, I feel like that's another primitive two of intent based off is is policy.

s133
00:12:09.200 --> 00:12:19.279
Um Ian at Keycard, how are you seeing that when a mission needs to change or a policy needs to update, how can Keycard help keep track of those changes as maybe the mission or policy updates need to be made?

s134
00:12:19.279 --> 00:12:31.440
Yeah, I think like taking a step back, there's like actually was Davis and I were sitting in a room some time ago and uh before like AOTH and and some of these other things actually had emerged in the ecosystem, one of the things we actually talked a lot about was consent fatigue.

s135
00:12:31.440 --> 00:12:39.760
And I think like at the minimum like we you always have this like how secure do you make a system versus like the trade-off of like the impact of the human.

s136
00:12:39.760 --> 00:12:50.800
And so you know a key card our broad view on this is you want to have like broad-based deterministic policy that basically says this is what must never happen effectively right or these are the things that always require a human be involved.

s137
00:12:50.800 --> 00:12:54.639
And then from there, what you really want to think about is, okay, cool.

s138
00:12:54.639 --> 00:13:06.000
Well, now that I have that in place, there's a big gap between all the policy I can write as a human or write as an organization and then what I actually want the policy to be in the specifics of a specific task.

s139
00:13:06.000 --> 00:13:10.639
And so the the ne the real challenge is how do I like layer over those two things, right?

s140
00:13:10.639 --> 00:13:11.920
Because humans can't write it all.

s141
00:13:11.920 --> 00:13:19.360
And so there's a version of that that is like a user or agent to agent interaction and they have an intent between those two of like transactional intent.

s142
00:13:19.360 --> 00:13:23.200
And then there's also like the business's intent for why they build or adopt an agent.

s143
00:13:23.200 --> 00:13:25.279
So why did we buy cloud code?

s144
00:13:25.279 --> 00:13:29.519
Well, because we wanted to make our developers more successful or because we wanted to do these different things.

s145
00:13:29.519 --> 00:13:35.279
And in the context of using cloud code or whatever, why am I working in this moment with cloud code?

s146
00:13:35.279 --> 00:13:37.120
Well, it's actually to fix a bug in staging, right?

s147
00:13:37.120 --> 00:13:39.040
And those are two different types of intent.

s148
00:13:39.040 --> 00:13:50.880
And if we can understand those two different things and then convert that some way into into uh like a bounding box of what those agents can do, you can then basically calculate the intersection of that and say okay here's what you can actually do.

s149
00:13:50.880 --> 00:14:00.160
And then the trick for anyone building these systems is how do I ensure that I don't bring the user into the loop except when absolutely required because that's what's going to be the adoption curve problem.

s150
00:14:00.160 --> 00:14:05.519
But that's also the adoption curve problem when it comes to like enabling agents to be autonomous in the first place.

s151
00:14:05.519 --> 00:14:06.480
That makes sense.

s152
00:14:06.480 --> 00:14:07.680
I like what you were saying with the intersection.

s153
00:14:07.680 --> 00:14:12.240
And I think that's a unique thing we don't talk about enough within identity and access management, right?

s154
00:14:12.240 --> 00:14:14.480
Normally you get access to one thing, right?

s155
00:14:14.480 --> 00:14:18.000
And so what I've seen successful kind of in this intentbased approach.

s156
00:14:18.000 --> 00:14:24.240
Um, and where I get more excited is you can actually have that those different intents be from different areas of the organization, right?

s157
00:14:24.240 --> 00:14:30.639
And so you have the decoupling of these things that they can kind of live on their own but then come together to form that, you know, decision.

s158
00:14:30.639 --> 00:14:32.959
And that decision doesn't have to be static, right?

s159
00:14:32.959 --> 00:14:42.880
So if we use the example of the CEO's email, well you know if that context involves that's the administrative assistant then yeah maybe she is supposed to read the email right or maybe just the calendar

s160
00:14:42.880 --> 00:14:58.560
right and so I think when we see and we start thinking about these intersection components um we have a totally different way we can start expressing policy but also starting to bring in not just the one side of the equation we always talked about before which was the app doing something now we actually have the ecosystem you

s161
00:14:58.560 --> 00:15:07.440
can bring in and so the more I I see organizations starting to realize that you maintaining that state or that context of these other elements to be able to help with that intention

s162
00:15:07.440 --> 00:15:11.600
can completely change the way you're effective at runtime authorization.

s163
00:15:11.600 --> 00:15:13.839
And are you seeing this across enterprises today?

s164
00:15:13.839 --> 00:15:18.079
Most people have mission tracking and policy tracking in place or is that largely missing today?

s165
00:15:18.079 --> 00:15:19.920
No, it's it's it's brand new still.

s166
00:15:19.920 --> 00:15:29.680
Um and I think you know part of the reason why I'm excited to talk about it because I think that it is changing the way to reason through this right even in the most simplistic case if you're a developer

s167
00:15:29.680 --> 00:15:36.959
um and you are thinking in terms of things like transaction and you have these concepts of intent um it makes it easier for you to potentially build the components

s168
00:15:36.959 --> 00:15:45.199
that'll be composed and used through that intention um and so I think it'll give us more ways to reason through these and communicate and then ultimately be more interoperable

s169
00:15:45.199 --> 00:15:51.600
right um and to me the last thing that I think is interesting is the diagnost diagnostics that you can run on this.

s170
00:15:51.600 --> 00:15:55.360
Intention is something that flows through many events potentially, right?

s171
00:15:55.360 --> 00:16:01.120
And I think uh one of the examples I've seen before is, you know, talking about that like that that mission flows through.

s172
00:16:01.120 --> 00:16:02.399
Um it could be longived.

s173
00:16:02.399 --> 00:16:03.516
It could be weeks that

s174
00:16:03.516 --> 00:16:03.600
[laughter]

s175
00:16:03.600 --> 00:16:04.959
attention can still be there.

s176
00:16:04.959 --> 00:16:08.560
Um so it's still very very early for most enterprises.

s177
00:16:08.560 --> 00:16:08.959
Absolutely.

s178
00:16:08.959 --> 00:16:10.560
And yes, that interoperability is key.

s179
00:16:10.560 --> 00:16:20.079
I think that's pretty hard for enterprises because they're rubbing between different clouds, different environments, different legacy systems and that policy that mission has to hold through all of those different hops.

s180
00:16:20.079 --> 00:16:25.131
Yeah, a lot of enterprises still have to deal with the fact that the the permission says read only and it's still rewrite,

s181
00:16:25.131 --> 00:16:25.360
[laughter]

s182
00:16:25.360 --> 00:16:25.680
right?

s183
00:16:25.680 --> 00:16:35.040
So like you have other problems you have to start dealing with and so um I think that it will help get that kind of taxonomy or language amongst people be easier to interoperate.

s184
00:16:35.040 --> 00:16:36.160
Yeah,

s185
00:16:36.160 --> 00:16:37.600
absolutely.

s186
00:16:37.600 --> 00:16:46.720
One of the reasons why I'm excited about intentbased authorization is because I think it has the ability to be a huge unlock for things like agentic commerce.

s187
00:16:46.720 --> 00:16:49.519
Um, so let's apply intentbased o to something real.

s188
00:16:49.519 --> 00:16:57.279
I think intent based off adds a lot of value here and for users it can help them ensure their agents buy the right item with their own personal budget.

s189
00:16:57.279 --> 00:17:05.919
And for merchants that means capturing the intent that gives them extra data to understand why a purchase is being made and if this agent should even be trusted to visit their site.

s190
00:17:05.919 --> 00:17:13.039
Um Davis when we think about agents in the context of financial services and agentic commerce why is intentbased off so important.

s191
00:17:13.039 --> 00:17:24.240
Um, I think simply it extends the concept maybe not everybody's aware but some are around you know know your customer right so I want to know my customer know who they are what they're doing but I think also we're starting to see I want to know my agent

s192
00:17:24.240 --> 00:17:34.080
right so I think that you have a coupling here around the agent itself um the intent of the actual user the intent of the operator the intent of the processor right etc

s193
00:17:34.080 --> 00:17:46.400
um very before now we couldn't really bring those together right um it matters of course when it comes to things like commerce because you have additional layers on top of this around what was the intention for things like regulatory requirements

s194
00:17:46.400 --> 00:17:54.320
etc. Um and this is going to help I think simplify those operations which means we'll get more access to these agents you know doing good work for us.

s195
00:17:54.320 --> 00:17:55.679
That makes sense.

s196
00:17:55.679 --> 00:18:00.000
And another blocker for aentic commerce is the fact that the web wasn't made for agents.

s197
00:18:00.000 --> 00:18:03.679
Um Ian can you tell us how agent identity can help?

s198
00:18:03.679 --> 00:18:09.120
Yeah I think stepping back we've kind of always had this problem where like what do you do with the unregistered client?

s199
00:18:09.120 --> 00:18:15.039
So, like I I show up on eBay, I haven't logged in, I'm using Chrome, eBay doesn't know who I am.

s200
00:18:15.039 --> 00:18:16.400
How do I do guest checkout?

s201
00:18:16.400 --> 00:18:17.600
How do I prove I'm a person?

s202
00:18:17.600 --> 00:18:22.480
How do I, you know, so they can, you know, say, "Yeah, you can bid on the this pair of stocks for $50."

s203
00:18:22.480 --> 00:18:37.520
And if I think if we're all paying attention to what's going on in personal agents, Muse and Instinct and Grockbot and um you know recently this announcement OD to Sierra and Decagon and friends around this personal agent protocol is like the fundamental problem we have is like how do you have an agent show up to a web

s204
00:18:37.520 --> 00:18:41.600
website be able to interact with the website know that you actually can trust that agent.

s205
00:18:41.600 --> 00:18:43.360
So like for a long time you've had captures on the web.

s206
00:18:43.360 --> 00:18:45.440
Well why is because we want to prevent spam.

s207
00:18:45.440 --> 00:18:46.720
We want to prevent abuse.

s208
00:18:46.720 --> 00:18:50.080
So we added captures and then like that's something only a human could solve.

s209
00:18:50.080 --> 00:18:51.840
So if we have a capture that stops spam.

s210
00:18:51.840 --> 00:18:53.120
So they can't spam the thing, right?

s211
00:18:53.120 --> 00:18:56.240
And now we have agents and they've broken captas.

s212
00:18:56.240 --> 00:18:58.559
Um, but this has like been a traditional problem on the web.

s213
00:18:58.559 --> 00:19:04.799
In fact, if you think back two to three years, Verscell, which is I think we're all aware of Verscell, was blocked in Spain.

s214
00:19:04.799 --> 00:19:06.400
Well, why was Versel blocked in Spain?

s215
00:19:06.400 --> 00:19:10.960
Because Versell shared the same IP addresses for every single host on Versel.

s216
00:19:10.960 --> 00:19:17.280
And there was one, one host on Versell, one website in Verscell that they were hosting that was hosting like Premier League content.

s217
00:19:17.280 --> 00:19:24.320
And Spain decided, hey, in order us to stop for that premier content being displayed illegally inside Spain, we're going to block all of Forcel, right?

s218
00:19:24.320 --> 00:19:29.600
And so in the same way that like Verscell has the problem, agents have the same problem, but so much so much worse.

s219
00:19:29.600 --> 00:19:35.840
So how do you have unregistered traffic you've never met before show up to your front door and then decide whether or not you let it in or not?

s220
00:19:35.840 --> 00:19:38.960
And that's like the actual first and foremost funal problem we have to solve.

s221
00:19:38.960 --> 00:19:40.880
It's the same issue with Muse and Instinct.

s222
00:19:40.880 --> 00:19:45.520
And what they're trying to do is like how do we actually create agreeable rails we can all operate on.

s223
00:19:45.520 --> 00:19:56.559
So as a downstream resource I can decide what what agents want to allow who I trust based on who users they are and then on the other side I can also know how to talk to those people.

s224
00:19:57.039 --> 00:19:57.840
Makes sense.

s225
00:19:57.840 --> 00:20:02.080
Dick how is AOP helping unlock the future of aentic commerce.

s226
00:20:02.080 --> 00:20:14.960
Uh well a key thing is a number of people have been building sort of proprietary closed box systems right you know so you know I'm a fan of the concept of the

s227
00:20:14.960 --> 00:20:30.960
personal agent protocol Poppy um but it doesn't really go far enough right it just it's like okay well now we've got a bit of an agent identity we just use some of the building blocks and it's an attractive approach because you're just doing it but it doesn't solve many of the new things that you need for

s228
00:20:30.960 --> 00:20:43.039
u an agent IC world and so a key motivator for people for having standards is that you can plug components from different places right so I'm a strong believer that

s229
00:20:43.039 --> 00:20:57.840
we should have control over what our agents do at some point agents going to be so much doing so much work there's no way we can have human in the loop approving everything right that's just not we've already seen that that isn't going to scale so that means we need to have a supervising agent that is our

s230
00:20:57.840 --> 00:21:06.080
supervising agent that runs our policy and decides how we do things that should be independent of the agents doing all the work.

s231
00:21:06.080 --> 00:21:11.280
And if we want to be able to plug and play those things, we need to be able to have a protocol to separate those.

s232
00:21:11.280 --> 00:21:21.679
Otherwise, you know, the decision about what the agent can and can't do, what the guard rails is decided by the agent, by the vendors of the agent around what you can and can't do.

s233
00:21:21.679 --> 00:21:28.240
And I don't really want to go and give control to them to decide what I can do and that all my decisions are based in there.

s234
00:21:28.240 --> 00:21:36.799
or I want to be able to pull that supervision into another component and in order to be able to plug and play pieces, we need to have a protocol that things interoperate.

s235
00:21:36.799 --> 00:21:37.919
I I just add to that.

s236
00:21:37.919 --> 00:21:42.799
I think like right now what we're seeing is like we kind of like we all want the web to be federated, right?

s237
00:21:42.799 --> 00:21:51.280
That does that that means like re like websites or resources on the web can decide what they're allowed to do, but the the standards upon which things operate should be federated enable us all to interoperate.

s238
00:21:51.280 --> 00:22:02.640
And I think we're at a moment where things like, you know, we're at a moment where there's a couple large players and the question for the industry is, are we going to settle on things that actually buy us to the large players and give them like concrete block doors?

s239
00:22:02.640 --> 00:22:08.880
Are we going to move to do the thing we've always done, which is build federated protocols, things like OIDC, things like, you know, TLS?

s240
00:22:08.880 --> 00:22:17.200
Those things operated, enabled like a broad web, enabled a lot of commerce to occur, enable a lot of information to flow, enabled all of us to have jobs in a way that because we could be inventive.

s241
00:22:17.200 --> 00:22:21.520
And so the question I actually asked the broad industry is okay this stuff's coming.

s242
00:22:21.520 --> 00:22:25.039
Which version of the world do we want one way or the other?

s243
00:22:25.039 --> 00:22:25.200
Yeah.

s244
00:22:25.200 --> 00:22:32.080
I add though I think um it's interesting that let's say this all goes perfect and we've got you know agents buying stuff and everybody's kind of happy.

s245
00:22:32.080 --> 00:22:37.120
What I think will end up happening is we'll start realizing that we have another piece that we have to start working on which is the human itself.

s246
00:22:37.120 --> 00:22:42.400
And so one of the things I think when you start having intents being involved is you get what's called psychological ownership.

s247
00:22:42.400 --> 00:22:46.400
Meaning I actually now have a linkage between the human and the outcome of that agent.

s248
00:22:46.400 --> 00:22:55.679
when you're just kind of, you know, disconnecting it or you you connect it up an ooth scope or something like that in a claim and let it's kind of magic and then you don't really know what's going on.

s249
00:22:55.679 --> 00:23:00.720
And so I think it'll with intention it'll be easier for a human to take accountability when things do go wrong.

s250
00:23:00.720 --> 00:23:06.400
And I think when you're talking about real money being transferred or things like that, you want to have that human ultimately accountable.

s251
00:23:06.400 --> 00:23:10.080
I think many people have probably seen the uh 1979 IBM manual.

s252
00:23:10.080 --> 00:23:20.799
It says uh you know and so like that that photo I think is very true in that we can't have the machines be accountable right we're going to have to have the humans link to it and intention I think is that link

s253
00:23:20.799 --> 00:23:35.520
yes and then yeah another word for intent is motive like we're were talking about last night um and that ability to hold someone accountable whether it's a person or an agent I think is really important and I think intent can also help with that be able to understand

s254
00:23:35.520 --> 00:23:41.440
why did this go wrong was it the user's um you know the user was maligned the agent was maligned.

s255
00:23:41.440 --> 00:23:44.080
Um, and then using that intent to be able to respond.

s256
00:23:44.080 --> 00:23:51.520
Um, for each of you, how are you seeing intent provide that benefit and the ability to respond to potentially a maligned user or agent?

s257
00:23:51.520 --> 00:23:54.799
Uh, I think it's going back to what I mentioned before about diagnosing, right?

s258
00:23:54.799 --> 00:24:00.240
So, the if if you change the word intent to motive, then you change diagnostics to forensics, right?

s259
00:24:00.240 --> 00:24:15.520
And I think um anybody who's done debugging or had to do forensics of an AI agent gone rogue will know that like trying to figure out what it was trying to do versus what the intention of the user was uh is very hard right um so having some of that information being propagated and immutable through the system

s260
00:24:15.520 --> 00:24:31.919
etc gives you some properties that allow you to more shortcircuit your investigation right um and as those things become more interoperable I think we're going to start seeing companies be able to more quickly kind of scope and identify well was this human error was this an agent software error is this what was that error and handle that

s261
00:24:31.919 --> 00:24:33.440
blast radius appropriately.

s262
00:24:33.440 --> 00:24:47.360
uh we see in the financial system right you have different things when you're doing a transaction around okay I made this payment but it was you know incorrect dollar amount or whatnot you have clear guidelines on how to work with that we don't have a lot of those when things go wrong right now so I think intention

s263
00:24:47.360 --> 00:24:51.039
will help us build those as we get go forward

s264
00:24:52.880 --> 00:25:04.000
and I think one area where a recent incident kind of highlights uh where intent um you can have like good intent but still take potentially the wrong action is the resi incident

s265
00:25:04.000 --> 00:25:12.320
um that happened recently where an Instinct agent went out on behalf of a user and tried to book a restaurant reservation on resi.com.

s266
00:25:12.320 --> 00:25:14.240
Um that agent was very eager.

s267
00:25:14.240 --> 00:25:20.400
It made 200 API calls an hour and it ended up getting the user's resi account banned.

s268
00:25:20.400 --> 00:25:30.400
Um Dick, how can AOTH budgets help in the case where an agent like that is using way too much of a downstream resource, but it still has good intent?

s269
00:25:30.400 --> 00:25:30.720
Yeah.

s270
00:25:30.720 --> 00:25:35.679
Well, this is another example about how just software is completely different now in the agentic world, right?

s271
00:25:35.679 --> 00:25:41.600
When it was predetermined software, you know, that was a bug if you called 200 times and you would fix it.

s272
00:25:41.600 --> 00:25:46.159
Um, where now, well, the agent's like, well, I'll just keep trying until I win.

s273
00:25:46.159 --> 00:25:57.120
Um and so we saw that as we were you know experimenting working with people with AOTH and we realized yeah there's a big problem that agents will learn something and they'll just

s274
00:25:57.120 --> 00:26:00.960
uh abuse the system from they don't think it's of abuse.

s275
00:26:00.960 --> 00:26:02.000
They don't know any different.

s276
00:26:02.000 --> 00:26:06.080
There's been no signal to tell them that oh I should only use this amount of stuff.

s277
00:26:06.080 --> 00:26:15.679
And so we added the concept of budgets where not only do you give a token to the agent that's timelmited as to how long can they do a particular action

s278
00:26:15.679 --> 00:26:19.679
but also a budget of how much resource they can do.

s279
00:26:19.679 --> 00:26:24.559
And so they have access until the the tokens either expired or they've exhausted the budget.

s280
00:26:24.559 --> 00:26:41.039
And so that way when they come back and you know they've exhausted all the budget the supervision you can go and decide should I give more budget to this agent or not as opposed to traditional rate limiting which just cuts it off and then like then what do you do right and it doesn't know well why did

s281
00:26:41.039 --> 00:26:58.720
I get cut off or anything like that where in budget there's continual feedback to the agent about how much budget was consumed has an idea about how much budget it has and so now it can operate within a budget right like a person would do about oh this resource is scarce I'm going to be careful about how

s282
00:26:58.720 --> 00:27:01.039
much I use this

s283
00:27:01.039 --> 00:27:18.480
then how does the brains versus the hands architecture concept come into play here to allow us to okay when a maj budget is close to being fully reached or is reached um how can the brain and hand separation of of access and the credentials being separate from the agent in the model itself

s284
00:27:18.480 --> 00:27:28.480
help us to be able to stop an agent from using too much of a downstream resource cuz it's getting close then Maybe we don't exercise uh the ability to give it another credential for example.

s285
00:27:28.480 --> 00:27:32.240
Uh sorry I didn't quite follow the echo in here is horrible.

s286
00:27:32.240 --> 00:27:33.840
So

s287
00:27:33.840 --> 00:27:39.919
no worries that's for anyone but basically like so with the brains in the hands architecture that we're converging on in an industry.

s288
00:27:39.919 --> 00:27:44.799
We're basically keeping the credentials and the access from an agent separate from the agent itself.

s289
00:27:44.799 --> 00:27:47.600
So there's no broadstanding access that an agent has today.

s290
00:27:47.600 --> 00:27:53.279
No API keys which I know is a benefit of AOTH that AOF allows agents to run without API keys.

s291
00:27:53.279 --> 00:27:57.279
How is that helpful in the context of the resi incident

s292
00:27:57.279 --> 00:28:00.720
the when you've got the access to it?

s293
00:28:00.720 --> 00:28:02.799
Um sorry I still don't understand.

s294
00:28:02.799 --> 00:28:03.919
Yeah I can jump in.

s295
00:28:03.919 --> 00:28:04.559
Yeah thanks.

s296
00:28:04.559 --> 00:28:05.840
I got I got you dick.

s297
00:28:05.840 --> 00:28:14.080
So like broadly speaking look I think if we look back at an incident that I just keep in the top of my mind is like pocket OS where I found like a random key on on a disc, right?

s298
00:28:14.080 --> 00:28:16.799
Like obviously agents are deeply goal seeking.

s299
00:28:16.799 --> 00:28:23.679
So the core of the the core of the the question is like okay well if we give these like agents the brain which is the model and the LLM

s300
00:28:23.679 --> 00:28:38.399
and you have these hands which is you kind of give them put them in a sandbox and inside the sandbox the tools um like the funal idea of the sandbox here that that's all that is that okay there's you can control what's inside of it so it can't actually like get API access and then if you have

s301
00:28:38.399 --> 00:28:46.720
an egress proxy outside the sandbox that's where you get to have your authorization boundary and so not only does it help do translation between systems right?

s302
00:28:46.720 --> 00:28:55.279
Which is like that's where athos can exist and talk to the outside world or do termination but also means that like the agent you have like a ability to apply authorization

s303
00:28:55.279 --> 00:29:05.039
at the egress proxy boundary and so I think at the core of it that model which is the predominant model that entropic and openi and many other labs are pursuing today

s304
00:29:05.039 --> 00:29:14.720
is is the model that allows us to both do both have the things we want which is how do we have these things experiment and try stuff out and do silly things which is the core value

s305
00:29:14.720 --> 00:29:22.159
while also having a deterministic layer outside of it that can implement things like aoth and all the other components we want in our protocols.

s306
00:29:22.159 --> 00:29:24.240
I think the decoupling is valuable, right?

s307
00:29:24.240 --> 00:29:30.880
Going back to mentioned with forensics and be able to separate things, but I do think that we still have a lot to learn on it isn't just one brain, right?

s308
00:29:30.880 --> 00:29:36.480
And it's very easy actually to build your agent loop where you put the brain in the loop rather than outside the loop.

s309
00:29:36.480 --> 00:29:36.880
Right?

s310
00:29:36.880 --> 00:29:40.640
So, example of this would be, you know, people that are leveraging memory systems.

s311
00:29:40.640 --> 00:29:54.799
um they put in some memory and some context that is now used going forward for every agent that is biasing that agent to make a decision to tell the hands in this case to go do something it shouldn't do and so one of the things that I think we don't talk about enough here is toxic combinations

s312
00:29:54.799 --> 00:30:10.240
right um and so when you do separate the hands and the brain and whatnot you can actually change up you know what hands are available right so the example that you know I've seen be very successful is the removal of tools dynamically based on that actual brain and what it's doing so the earlier example we gave of

s313
00:30:10.240 --> 00:30:11.120
reading an email.

s314
00:30:11.120 --> 00:30:27.360
Um there's nothing that says that oh if they're going to go write an email I'm going to disable all you know web search tool calls or any other external egress capability tool call ww wise until the right email tool has been complete and that you know mission has been done then I can reenable them right and so

s315
00:30:27.360 --> 00:30:38.240
um I think that we have to we're going to start becoming more and more uh engineering in these different kind of concepts that um they are still complicated they're still growing and still nent but I think it's a better separation of what we have today.

s316
00:30:38.240 --> 00:30:52.159
Yeah, and this is how these things we're talking about which you know seemed like geeky O problems actually then merge back up to like real agent engineering problems which is if you actually understand what you're doing you know one of the biggest complaints less now but one of the biggest complaints with MCP was context bloat like especially

s317
00:30:52.159 --> 00:31:05.919
when we had smaller context windows right but intent systems can ensure that the right capabilities are given to the agent at the right time so they don't spend a bunch of time doing things they shouldn't be doing right they actually helps them navigate towards the goal state and helps them put them on a more of a paved

s318
00:31:05.919 --> 00:31:10.399
path so intent like not only unlocks like a bunch of security stuff.

s319
00:31:10.399 --> 00:31:19.360
Intent also will result in us spending less tokens because the agent will spend time doing less things that aren't the right pathway or it'll come up to the point say, "Hey, I just can't do it."

s320
00:31:19.360 --> 00:31:28.559
And so what we know about this era is so much of it is about nudging the agent in the right direction and ensuring you can't do the wrong thing and that's how you get the outcome you want.

s321
00:31:29.360 --> 00:31:35.120
Davis, how are you seeing intentbased as part of a larger strategy for production agents?

s322
00:31:35.120 --> 00:31:52.000
I know when it comes to building, deploying, and operating agents in production, there's many different outcomes teams should be thinking about such as discovering what's running, what agents capabilities are, the ability to validate inputs and outputs, constraining an agent like we talked about, and using the egress proxy and different networking rules.

s323
00:31:52.000 --> 00:31:58.480
Um, how does all of this fit into play and what's working inside enterprises today to really be able to ship agents to production?

s324
00:31:58.480 --> 00:32:07.360
Yeah, I I think we're finally it's helping move the kind of conversation from authentication to authorization and really like how do we do dynamic authorization?

s325
00:32:07.360 --> 00:32:08.960
How do I validate that authorization?

s326
00:32:08.960 --> 00:32:11.360
How do I have the human in the loop at the right time?

s327
00:32:11.360 --> 00:32:16.399
Because I agree with what Dick was saying earlier that the human in the loop is somewhat of an anti-attern in many ways, right?

s328
00:32:16.399 --> 00:32:21.120
Um because they can get fatigue etc. But you need to have a way to bring them in when it's important.

s329
00:32:21.120 --> 00:32:23.760
Those were not engineering discussions before, right?

s330
00:32:23.760 --> 00:32:29.600
Now they're actually part of the engineering conversation where engineers are being involved in the authorization process.

s331
00:32:29.600 --> 00:32:31.440
They're not just saying, "Oh, I've got my access.

s332
00:32:31.440 --> 00:32:32.399
I'm good to go."

s333
00:32:32.399 --> 00:32:34.799
So that actually changes the way we're seeing threat models done.

s334
00:32:34.799 --> 00:32:38.799
It changes the way we're seeing the full attack surface of applications in general.

s335
00:32:38.799 --> 00:32:50.320
Um and so I think you're now looking at this authorization model as a another kind of set of tools that you can use to reduce not just um security issues, but flatout error rates of your agent, right?

s336
00:32:50.320 --> 00:33:07.039
Like I mean when you have less things the agent can do it makes better decisions right and so fundamentally we've seen you know real world cases where the agent loop is just better faster stronger because you've actually spent the time on knowing what is the intent they're trying to get what's the mission that they're trying to accomplish.

s337
00:33:07.039 --> 00:33:14.159
And then last thing is it brings the people together in terms of we now have other different people, the security team, the application team.

s338
00:33:14.159 --> 00:33:17.919
They're now able to have a conversation that they're using the same language.

s339
00:33:17.919 --> 00:33:21.760
And a lot of times when it came to identity, it was a completely different language, right?

s340
00:33:21.760 --> 00:33:23.440
Um and it was just like get out of my way.

s341
00:33:23.440 --> 00:33:27.200
What do I have to go do to go ahead and get my, you know, token and I can go forward.

s342
00:33:27.200 --> 00:33:34.240
Now they're seeing that you can actually pair these things and leverage that capability um to drive, you know, efficiency of your actual agents outcome.

s343
00:33:34.240 --> 00:33:35.600
That makes sense.

s344
00:33:35.600 --> 00:33:38.960
Ian, how are you applying these concepts to software factories?

s345
00:33:38.960 --> 00:33:43.279
I know today you released a reference architecture on the secure software factory.

s346
00:33:43.279 --> 00:33:49.279
How are you applying the concepts of runtime authorization constraining agents and all of that to that?

s347
00:33:49.279 --> 00:33:54.240
Yeah, I think like so there is a a reference architecture we just published on agentbaseline.org.

s348
00:33:54.240 --> 00:33:57.039
Um we talked about three different levels of of factory.

s349
00:33:57.039 --> 00:34:06.720
one being like a human-driven one, one being a workflow driven one, one being like this agentic driven one, which is like the thing we all basically want to get to, which is like it's it's driven by agents

s350
00:34:06.720 --> 00:34:08.800
at all points in time.

s351
00:34:08.800 --> 00:34:12.399
The runtime authorization is a core component of a larger ecosystem.

s352
00:34:12.399 --> 00:34:18.639
It actually enables the the factory to like be able to be pointed in a direction and do the right thing and also get access to the right piece.

s353
00:34:18.639 --> 00:34:27.919
And it's very it looks different than previous things that you would have used like a secret manager because it's making very different decisions than previous generations head for managing deterministic

s354
00:34:27.919 --> 00:34:28.560
software.

s355
00:34:28.560 --> 00:34:35.040
But it is a core component of enabling the entire thing to work like when to bring someone into the loop when what agents can pass what work off to what other agents.

s356
00:34:35.040 --> 00:34:39.119
You know how can we have an agent that can have access to production systems and do an auto patch.

s357
00:34:39.119 --> 00:34:43.599
Um these are fundamental questions of like how do we actually solve at scale software.

s358
00:34:43.599 --> 00:34:47.200
Right now we're in a position where like we've never been able to generate more software.

s359
00:34:47.200 --> 00:34:59.920
uh but we never actually but we have a complete bottleneck in getting into production ensuring it works and that's the the next phase is like how do you actually graduate from just using LM to generate text and software to actually making it capable of deploying it into production

s360
00:34:59.920 --> 00:35:06.079
iterating on it and getting it to a stable state quickly and then responding to instances they arise

s361
00:35:07.920 --> 00:35:17.040
Davis on a podcast you did with me we talked about how cyber security has something to learn from robotics um in robotics there's this concept when maybe a robot raises its arm arm.

s362
00:35:17.040 --> 00:35:19.119
It thinks is it safe for me to raise my arm?

s363
00:35:19.119 --> 00:35:20.400
Should I am I allowed to do that?

s364
00:35:20.400 --> 00:35:24.000
But it also looks at its external environment and says, "What has changed?

s365
00:35:24.000 --> 00:35:26.640
Is it is it still safe for me to raise my arm?"

s366
00:35:26.640 --> 00:35:33.599
Um, when we think about runtime authorizations, what do those decisions need to take into context beyond just intent?

s367
00:35:33.599 --> 00:35:39.280
Yeah, I think um having a model like this allows us to add in more sensors into our decision.

s368
00:35:39.280 --> 00:35:53.760
So the robotics example of you know an arm moving up or down um any of the external factors it could be are there other objects near it right um it could be temperature it could be well am I moving and I'm don't want to move my arm while my you know the the rest of the robot's moving

s369
00:35:53.760 --> 00:36:05.920
etc so it's usually looking at all different types of things none of those are deterministic they're all probabilistic so there's a range of options and it picks the best option based on all of those sensor data at one time

s370
00:36:05.920 --> 00:36:11.520
most authorization decisions in organizations today are single binary decision, right?

s371
00:36:11.520 --> 00:36:13.520
And that just doesn't work in the future, right?

s372
00:36:13.520 --> 00:36:19.040
So, being able to pair the intent of what a user is trying to do with the ecosystem that the user is doing it in.

s373
00:36:19.040 --> 00:36:27.440
That could be where they're doing it from, time of day, but it could be even more advanced things like, for example, should I let, you know, this administrator use Firefox

s374
00:36:27.440 --> 00:36:34.480
to access this server right now when this server has, you know, high-risisk vulnerabilities and their system hasn't been patched to.

s375
00:36:34.480 --> 00:36:34.880
Right?

s376
00:36:34.880 --> 00:36:47.200
Now all of a sudden you're bringing in a lot more context into the environment around it and again um that can be through different teams but more importantly through sensors and I think we've all kind of seen the value of observability in general.

s377
00:36:47.200 --> 00:37:00.400
Imagine being able to have this type of context at the span level from an Otel perspective or something right you're looking at a trace you've got a span and you actually know what the environment was outside your application at that time as well as what the user's intention was.

s378
00:37:00.400 --> 00:37:03.599
Um that allows you to diagnose things in a completely different way.

s379
00:37:03.599 --> 00:37:14.000
Um, and so I think if we can bring in some of those concepts, we'll get shorter time, shorter shorter to live, you know, um, authorization decisions that have much more context than even just a user's intent.

s380
00:37:14.000 --> 00:37:17.920
It'll be the state of the environment around it.

s381
00:37:18.000 --> 00:37:18.960
That makes sense.

s382
00:37:18.960 --> 00:37:28.160
And forward looking as we evaluate whether intentbased authorization is working in our environments, one natural place to look will be a log of the agents actions.

s383
00:37:28.160 --> 00:37:30.400
Um, what was denied, what was allowed.

s384
00:37:30.400 --> 00:37:37.760
Um, Ian, why is it important to have your auto log separate from the agent itself, meaning outside of its control?

s385
00:37:37.760 --> 00:37:43.920
Yeah, I think this comes back to also just like why the enforcement point has to be outside the like primary like hands and brains of of an agent, right?

s386
00:37:43.920 --> 00:37:45.200
You can't trust this thing.

s387
00:37:45.200 --> 00:37:47.920
And so, in the hugging phase incident, it had a couple different components of it.

s388
00:37:47.920 --> 00:37:54.880
I mean, one obviously abused a vulnerability we didn't know about in Squid in Squid proxy, but more importantly, you didn't have any observability or monitoring about what was going on.

s389
00:37:54.880 --> 00:38:03.599
And so this thing was able to go in the open internet through this vulnerability and there was no like place at which recorded the different actions that this agent was taking and for them to monitor.

s390
00:38:03.599 --> 00:38:14.320
And so independent of like whether we're applying like a you know enforcement point to network traffic that's pushing on the internet that it's outreach of the agent to tamper with or we're using you know solving vulnerabilities as they pop up.

s391
00:38:14.320 --> 00:38:17.200
You know this this hugging face one is a little unique.

s392
00:38:17.200 --> 00:38:23.680
Um we still need to actually have a record of like who told this agent to do what thing for what purpose and is that still true?

s393
00:38:23.680 --> 00:38:28.079
Um because ultimately at the end of the day what we're doing with agents is we is is a liability question.

s394
00:38:28.079 --> 00:38:30.400
And so this is why I actually don't think we need more regulation around agents.

s395
00:38:30.400 --> 00:38:46.240
What we just need is our pre-existing laws around liability to be held to be dealt with which is if I employ an agent do some action who is liable if that action causes damage right it is the person who employs it which could be an organization or a person or someone that delegated some action to something

s396
00:38:46.240 --> 00:38:56.560
that is like that's the final question we have to deal with and then of course you have to ability to answer that question which is well who did it which is where the tamper resistant autolog comes from

s397
00:38:57.119 --> 00:39:00.800
perfect and then to wrap up I wanted to ask you all a fun question.

s398
00:39:00.800 --> 00:39:17.119
So there's a concept of the probability of doom or pdoom where the uh AI doomers are saying that AI agents are going to um release all sorts of havoc or be like the ruin to humanity whereas the AI optimists are like no this is really you know poised to help us it's not a genuine threat.

s399
00:39:17.119 --> 00:39:21.200
Um for each of you on the panel, what is your take on this?

s400
00:39:21.200 --> 00:39:30.000
Is you know runtime authorization based on intent and the other things we talk about like constraining agents, validating inputs, outputs, a holistic strategy for production agents.

s401
00:39:30.000 --> 00:39:32.000
Is that enough to save us?

s402
00:39:32.000 --> 00:39:36.640
Is Poom real or is it not worth the hype?

s403
00:39:37.280 --> 00:39:38.079
You get to start there.

s404
00:39:38.079 --> 00:39:38.880
Oh, I did.

s405
00:39:38.880 --> 00:39:40.952
You got that spicy look on your face.

s406
00:39:40.952 --> 00:39:42.560
[laughter]

s407
00:39:42.560 --> 00:39:46.560
Uh uh well part of your question is are agents going to take over?

s408
00:39:46.560 --> 00:39:55.440
And uh I I think agents being fully autonomous and not really tied to a particular organization is still science fiction, you know, so who knows, right?

s409
00:39:55.440 --> 00:39:58.240
Like that's a that's one direction.

s410
00:39:58.240 --> 00:40:10.400
Another one is in a responsible organization put in the right controls, agents aren't, you know, we're getting in evolving enough of the tools to make sure that bad things don't happen in a responsible organizations to put in the right controls.

s411
00:40:10.400 --> 00:40:14.560
And so that leaves two scenarios for where there's going to be a potential problem.

s412
00:40:14.560 --> 00:40:23.440
One of those is in an organization that isn't got its act together, an insider threat could go and unleash an agent to cause havoc, right?

s413
00:40:23.440 --> 00:40:26.560
And so they've got some special access that other people have.

s414
00:40:26.560 --> 00:40:32.400
The other one, the one that I'm more concerned about is, you know, it's been shown, you know, the hugging faces.

s415
00:40:32.400 --> 00:40:45.280
And if you watch the the talk that they gave at Black Hat, right, that was really a call to arms around, you know, here's a situation where we didn't want a bad thing to happen and a bad thing did happen.

s416
00:40:45.280 --> 00:40:58.720
What about people that want bad things to happen and have these tools and that I think is a threat that's the one that's potentially going to have I mean it's going to happen and there's going to be some catastrophes.

s417
00:40:58.720 --> 00:41:09.680
Hopefully, we're prepared enough that those aren't horribly disastrous, but it's going to be, you know, some there's going to be some things that are like massive natural disaster like scale

s418
00:41:09.680 --> 00:41:23.760
issues caused by malicious actors either kind of intentionally or kind of unintentionally, but it's where people aren't being responsible in their use of these super powerful tools.

s419
00:41:24.000 --> 00:41:27.200
Yeah, I can't give necessarily a specific probability, right?

s420
00:41:27.200 --> 00:41:44.079
But what I uh can say is I think I've always been you know kind of uh surprised and excited when you know ingenuity of engineers gets involved in problem solving and I think where we're at the stage now like some of the new capabilities within agents etc. We have real engineers, folks that are here actually just iterating

s421
00:41:44.079 --> 00:41:45.280
on the problem, right?

s422
00:41:45.280 --> 00:41:52.720
We're starting to see just tremendous improvement in the, you know, in my mind, some of the capabilities that'll be available to change what our future can be.

s423
00:41:52.720 --> 00:41:58.560
And so to me, I have no problem kind of believing the engineers are going to figure out a solution here.

s424
00:41:58.560 --> 00:42:00.079
I mean, maybe I have the hottest take.

s425
00:42:00.079 --> 00:42:04.319
I mean, like I can't say it's equal to zero, but I would say it's approaching asmtoically zero.

s426
00:42:04.319 --> 00:42:06.160
Uh, is the probability the world is going to end.

s427
00:42:06.160 --> 00:42:09.440
Uh, I think like the incentive structure for most people is to continue.

s428
00:42:09.440 --> 00:42:18.160
Um and also at the end of the day like we still have liability frameworks and you know I think generally humans are good people so we don't set out to destroy the world specifically.

s429
00:42:18.160 --> 00:42:24.720
Um I also think like broadly speaking like these agents at the end of I have this sort of hot take I say which is like they can just be unplugged but I think it's just true.

s430
00:42:24.720 --> 00:42:28.800
It's like at the end of the day like they you can just they're computers we can unplug them.

s431
00:42:28.800 --> 00:42:32.400
Um and at so broadly speaking I I don't believe in the debate.

s432
00:42:32.400 --> 00:42:33.359
I I don't think it's real.

s433
00:42:33.359 --> 00:42:40.000
I think at the at the upside of it, I I kind of believe more more to what Davis's position is is we're iterating very quickly.

s434
00:42:40.000 --> 00:42:41.920
We're figuring out where these things can work, where they don't.

s435
00:42:41.920 --> 00:42:43.599
And when they don't work, they create damage.

s436
00:42:43.599 --> 00:42:50.640
And that's what ultimately like sort of um the antibbody of society is that says, "Hey, maybe we shouldn't do this."

s437
00:42:50.640 --> 00:42:51.839
Like this is probably a bad thing.

s438
00:42:51.839 --> 00:42:53.760
So, I'm the doomer on the on the panel.

s439
00:42:53.760 --> 00:42:54.179
Yeah.

s440
00:42:54.179 --> 00:42:54.319
[laughter]

s441
00:42:54.319 --> 00:43:06.240
It's unfortunate for, you know, people like the P, you know, the founder of Pocket OS who like lost a bunch of data like but it's great for the rest of us because we all learn together and uh at the end of the day like that results in people not doing things that don't make a lot of sense

s442
00:43:06.240 --> 00:43:09.119
and I think that will continue to be true.

s443
00:43:09.119 --> 00:43:09.680
Makes sense.

s444
00:43:09.680 --> 00:43:16.560
Thank you each for your expertise and your time here on this panel today and thank you to the audience for listening and we'll catch you next time.

s445
00:43:16.560 --> 00:43:17.200
Thank you.

s446
00:43:17.200 --> 00:43:18.414
Thanks, Marshall.

s447
00:43:18.414 --> 00:43:20.414
[applause]