WEBVTT

NOTE Sentence-level transcript of https://www.youtube.com/watch?v=zaGyGgLW3SM

NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/zaGyGgLW3SM.html. A cue ends where the next begins, or 2 s after its last word.

s1
00:00:01.309 --> 00:00:03.309
[music]

s2
00:00:12.760 --> 00:00:13.840
All right.

s3
00:00:13.840 --> 00:00:14.560
Can we start?

s4
00:00:14.560 --> 00:00:15.680
All right, there you go.

s5
00:00:15.680 --> 00:00:18.440
Um hey everyone, welcome.

s6
00:00:18.440 --> 00:00:20.120
Uh I hope everyone's enjoying the conference.

s7
00:00:20.120 --> 00:00:22.560
This is uh a really fun conference.

s8
00:00:22.560 --> 00:00:24.840
I've enjoyed all the talks and the presents here.

s9
00:00:24.840 --> 00:00:29.760
Okay, so we're going to talk about unlocking agent autonomy and what that means.

s10
00:00:29.760 --> 00:00:31.160
These last years have been crazy.

s11
00:00:31.160 --> 00:00:32.279
I'm sure you all felt it, right?

s12
00:00:32.279 --> 00:00:36.000
Like 2 years ago we were talking about chatbots and here we are.

s13
00:00:36.000 --> 00:00:40.280
We're now in this world where we all see the autonomy we get from agents.

s14
00:00:40.280 --> 00:00:44.280
Agents have become powerful and they'll continue being so.

s15
00:00:44.280 --> 00:00:53.200
Um at this point, the next big challenge like we spent the last 2 years trying to make agents more intelligent and powerful and that'll keep going and I think we're almost there.

s16
00:00:53.200 --> 00:00:58.800
I think the next challenge in front of us is actually harder and more important, which is how to make them safer.

s17
00:00:58.800 --> 00:01:03.200
At this point, I don't think intelligence is the next big blocker for us to leverage agents.

s18
00:01:03.200 --> 00:01:08.800
It is actually how to do so safely so we can give them all the access and autonomy they need.

s19
00:01:08.800 --> 00:01:10.840
Just as a story, this is a small anecdote.

s20
00:01:10.840 --> 00:01:13.240
I'm sure everyone here has some version of this.

s21
00:01:13.240 --> 00:01:16.200
Um this is one of many agents I run.

s22
00:01:16.200 --> 00:01:17.680
This runs every night.

s23
00:01:17.680 --> 00:01:21.960
It looks at some repos I care about and you know, just does some analysis for me.

s24
00:01:21.960 --> 00:01:25.760
What activities happen, who's been doing what, what progress has been made.

s25
00:01:25.760 --> 00:01:34.640
Um I have others that might do some more, might analyze the code review comments, have some of my own analysis in there, be like, what was the tone, who did what, how were they acting?

s26
00:01:34.640 --> 00:01:35.440
I'm a manager.

s27
00:01:35.440 --> 00:01:38.960
This is not meant for public views, just meant to help me keep a pulse.

s28
00:01:38.960 --> 00:01:41.760
But still, it's not something I want shared.

s29
00:01:41.760 --> 00:01:44.160
It's for my own knowledge, something to keep up.

s30
00:01:44.160 --> 00:01:46.280
This agent has been running for weeks just fine.

s31
00:01:46.280 --> 00:01:49.400
Runs every night, sends me an email, I look at it.

s32
00:01:49.400 --> 00:01:55.400
Randomly one day, uh it decided to post this report as a PR on the repo.

s33
00:01:55.400 --> 00:01:55.880
Why?

s34
00:01:55.880 --> 00:01:59.480
Nothing's changed, just the model decided to be helpful.

s35
00:01:59.480 --> 00:02:01.831
Um so

s36
00:02:01.831 --> 00:02:02.440
[laughter]

s37
00:02:02.440 --> 00:02:03.240
Thank you.

s38
00:02:03.240 --> 00:02:06.320
Um But this is a fundamental thing, right?

s39
00:02:06.320 --> 00:02:08.280
Like agents do stuff.

s40
00:02:08.280 --> 00:02:09.920
They try to be helpful.

s41
00:02:09.920 --> 00:02:12.320
They increase and change the goal they're doing.

s42
00:02:12.320 --> 00:02:19.240
Either cuz they themselves are just trying to be helpful, or they get confused, they make a mistake, or they get prompt injected, right?

s43
00:02:19.240 --> 00:02:22.000
Um This is a simple example, honestly.

s44
00:02:22.000 --> 00:02:24.160
Like it's easy to fix this.

s45
00:02:24.160 --> 00:02:27.480
That agent should never have had write access to GitHub.

s46
00:02:27.480 --> 00:02:30.440
It should have just had read access, and that's an easy fix.

s47
00:02:30.440 --> 00:02:32.640
Um But it's not that simple, right?

s48
00:02:32.640 --> 00:02:33.560
That's a very easy case.

s49
00:02:33.560 --> 00:02:35.480
Let's take Let's take another example.

s50
00:02:35.480 --> 00:02:40.200
Let's imagine I have an agent, and I'm asking it to do investigate a latency spike.

s51
00:02:40.200 --> 00:02:41.440
Check out latency spike.

s52
00:02:41.440 --> 00:02:42.400
Great, it starts.

s53
00:02:42.400 --> 00:02:44.080
It's looking at the logs.

s54
00:02:44.080 --> 00:02:46.280
It sees, "Oh, I think there's another service here.

s55
00:02:46.280 --> 00:02:48.160
I want the logs to for that service.

s56
00:02:48.160 --> 00:02:49.800
Let me get that access."

s57
00:02:49.800 --> 00:02:52.360
"Oh, I see this uh might be related to a recent check-in.

s58
00:02:52.360 --> 00:02:56.400
I would like access to GitHub, to the repos, to read the recent commits."

s59
00:02:56.400 --> 00:02:58.160
Uh this looks like it may have happened.

s60
00:02:58.160 --> 00:03:03.120
Let me look at Slack conversations to see has there been any chatter about this to learn from there.

s61
00:03:03.120 --> 00:03:05.280
Great, it asked for Slack access.

s62
00:03:05.280 --> 00:03:08.160
These are all reasonable steps, right?

s63
00:03:08.160 --> 00:03:08.800
This makes sense.

s64
00:03:08.800 --> 00:03:11.040
This is what I would expect an engineer to do.

s65
00:03:11.040 --> 00:03:18.239
But what's happening is that each time as it's expanding its goal, expanding what it's doing, it's crossing the trust boundary.

s66
00:03:18.239 --> 00:03:20.280
It's increasing the scope of the task.

s67
00:03:20.280 --> 00:03:22.440
And this is fundamentally where we run into trouble.

s68
00:03:22.440 --> 00:03:24.680
How do we know it's okay to give it access?

s69
00:03:24.680 --> 00:03:33.760
We now end up with an agent that has access to everything at the same time, and so anything becomes a vector where the blast radius expands.

s70
00:03:33.760 --> 00:03:37.160
This is fundamentally the big difference we're running into and the big challenge.

s71
00:03:37.160 --> 00:03:41.120
Earlier, traditional software was deterministic, you could define the permissions.

s72
00:03:41.120 --> 00:03:49.239
But now as agents become autonomous um and they gain and they try to solve more problems, what they're doing changes at runtime.

s73
00:03:49.239 --> 00:03:51.760
The access they need changes at runtime.

s74
00:03:51.760 --> 00:03:53.920
And right now we haven't truly solved this.

s75
00:03:53.920 --> 00:04:00.360
We haven't solved how to give them exactly the access they need, how to do this in a safe manner, how to know if it's correct.

s76
00:04:00.360 --> 00:04:05.320
And this is the fundamental thing I think we have to go solve now to actually unlock autonomy.

s77
00:04:05.320 --> 00:04:11.320
And so we go away from like can it do this to like should it do this and how do we give it that access?

s78
00:04:13.000 --> 00:04:19.200
Also, this is something we can't just rely on the next frontier agent being really good and not making a mistake.

s79
00:04:19.200 --> 00:04:21.920
We're going to use more than one model.

s80
00:04:21.920 --> 00:04:24.960
I just think fundamentally we're all already there, I think.

s81
00:04:24.960 --> 00:04:30.040
No one is going to bet everything on a single model or even a single frontier lab.

s82
00:04:30.040 --> 00:04:32.960
You'll use models from different frontier labs as they make progress.

s83
00:04:32.960 --> 00:04:35.320
And importantly, we will all use open models.

s84
00:04:35.320 --> 00:04:41.280
We're all living through the GLM 5.2 um uh amazing progress last few weeks.

s85
00:04:41.280 --> 00:04:44.240
And this is just the start, but there'll be more and more of this.

s86
00:04:44.240 --> 00:04:47.480
So we'll end up wanting to use different models for different reasons.

s87
00:04:47.480 --> 00:04:55.440
Privacy, cost, etc. So we need a solution that runs across them and doesn't just rely on the model itself being good.

s88
00:04:55.440 --> 00:04:57.320
We'll also use multiple harnesses.

s89
00:04:57.320 --> 00:05:00.840
You won't just use a single harness from a single provider.

s90
00:05:00.840 --> 00:05:12.040
One, you should like betting entirely on a harness from a frontier lab makes it hard for to get choice across models from labs and across open models.

s91
00:05:12.040 --> 00:05:14.480
Two, there'll be harnesses for different use cases.

s92
00:05:14.480 --> 00:05:17.800
Right now we're all very focused on coding, but we're going to expand.

s93
00:05:17.800 --> 00:05:22.200
Uh the open claw moment happened, but it's still not landed fully, right?

s94
00:05:22.200 --> 00:05:26.320
You can imagine sales people, marketing people having claws running doing stuff.

s95
00:05:26.320 --> 00:05:30.720
So the kind of harnesses and agents will use will grow and you'll build your own.

s96
00:05:30.720 --> 00:05:36.640
So we need something that works across harnesses and works across models.

s97
00:05:36.640 --> 00:05:44.080
Um and we need something that it just doesn't just depend on no mistake happening, but constrains the environment around it.

s98
00:05:44.080 --> 00:05:57.160
So what we want is an environment where the agent runs, where something goes wrong, there's limited blast radius, and we only give the access it needs, and we do this in a safe and correct manner.

s99
00:05:57.160 --> 00:05:59.960
We think the best way to do this is to create a runtime.

s100
00:05:59.960 --> 00:06:02.640
Is to have a runtime that all agents run on.

s101
00:06:02.640 --> 00:06:06.160
So, this runs across any agent, any harness, and across models.

s102
00:06:06.160 --> 00:06:14.640
And that's where we create these uh uh artifact these these capabilities that we want.

s103
00:06:14.760 --> 00:06:17.200
There are three core pillars here.

s104
00:06:17.200 --> 00:06:19.160
First is containment.

s105
00:06:19.160 --> 00:06:22.840
You need to create an environment where it's controlled what the agent can get.

s106
00:06:22.840 --> 00:06:25.360
Um this does mean sandboxes.

s107
00:06:25.360 --> 00:06:30.440
And look, you can like throw a rock and find many sandbox something at this point, but it's more than that.

s108
00:06:30.440 --> 00:06:37.000
So, when you have a you have a sandbox in which you can you run the agent and it gets only what it needs.

s109
00:06:37.000 --> 00:06:44.480
And importantly, you run the agent inside the untrusted boundary, and you run controls outside, so outside of the VM boundary.

s110
00:06:44.480 --> 00:06:47.160
Second, you scope access.

s111
00:06:47.160 --> 00:06:51.800
This is more than just what network can you access, or even what tool can you access.

s112
00:06:51.800 --> 00:06:54.240
But you need to give actual scoped capabilities.

s113
00:06:54.240 --> 00:07:01.280
So, in our example, the agent now wants to access Slack to search for any conversations around this incident.

s114
00:07:01.280 --> 00:07:05.400
Well, I could give it read only to Slack, but that's still more than what I want to give it.

s115
00:07:05.400 --> 00:07:09.680
Maybe there's a single channel with only conversation with the incident, that's great.

s116
00:07:09.680 --> 00:07:10.919
Often times that's not the case.

s117
00:07:10.919 --> 00:07:17.919
It could be spread across many channels or a team channel with other conversation and I don't want this agent to get access to other content.

s118
00:07:17.919 --> 00:07:19.400
How do I do this?

s119
00:07:19.400 --> 00:07:23.680
The upfront predefined tools typically don't aren't that fine scoped.

s120
00:07:23.680 --> 00:07:35.160
What what the runtime should do is maybe create a just-in-time tool that composes over existing Slack MCV tools or anything else, but restricts access to just conversations about the incident.

s121
00:07:35.160 --> 00:07:37.919
And that's what the agent gets access to.

s122
00:07:37.919 --> 00:07:49.600
We create and use and instead of having a big sandbox that we keep adding capabilities to, take that part, run it in a scoped sandbox for that task with just the scoped capability it needs.

s123
00:07:49.600 --> 00:08:04.000
This now starts to build the runtime and fabric for us where we can give agents fine-scoped access, break down work into tasks across security boundaries, run those in contained sandboxes with just access they need.

s124
00:08:04.000 --> 00:08:13.360
This feels much better and now we're getting to place where we can be safer, but we're still not done cuz the core a what access should you get?

s125
00:08:13.360 --> 00:08:16.200
If this is asking for Slack, is that correct?

s126
00:08:16.200 --> 00:08:22.280
Um if it's asking to read this read from the Slack channel or have write access to something, should that be allowed?

s127
00:08:22.280 --> 00:08:29.640
How do you differentiate between what is correct, where it's making a mistake or being incorrectly eager, or where it's being prompt injected?

s128
00:08:29.640 --> 00:08:33.240
This is where we have to This is what intent-based access becomes.

s129
00:08:33.240 --> 00:08:44.600
We need to understand the user's intent or the task intent, take the context in in account, and then decide what access you get and how that should be run in which contained environment.

s130
00:08:44.600 --> 00:08:50.680
And so that becomes the next big challenge for us to do, which is how do we safely evolve the capabilities the task gets.

s131
00:08:50.680 --> 00:08:52.800
So in this example, it makes sense.

s132
00:08:52.800 --> 00:08:57.080
Okay, investigating this incident, you're asking for read access to Slack for that incident.

s133
00:08:57.080 --> 00:08:57.880
That seems rational.

s134
00:08:57.880 --> 00:08:59.440
Let's do Let's do that.

s135
00:08:59.440 --> 00:09:01.960
All of a sudden, you would like email access.

s136
00:09:01.960 --> 00:09:02.440
Why?

s137
00:09:02.440 --> 00:09:08.760
Nothing about the prompt said you should have that, so I'll deny that or I'll raise it up for human approval.

s138
00:09:08.760 --> 00:09:21.960
But do this not just space in the frontier lab of the model that's running, but do this independent running at like a control layer in in the in the control sandbox layer in the core governance aspect

s139
00:09:21.960 --> 00:09:25.400
independent across all models and all harnesses.

s140
00:09:25.400 --> 00:09:39.880
This is sort of This starts to get us to a world now where we can actually have a runtime layer and run agents safely in a contained manner with scoped access and now deal with the dynamic aspect of this.

s141
00:09:39.880 --> 00:09:41.200
And to be clear, look, this is a hard problem.

s142
00:09:41.200 --> 00:09:45.320
It's not fully solved yet, but this is the world I think we have to move towards.

s143
00:09:45.320 --> 00:09:53.840
But we're not done once we do this, cuz if you're building a runtime, not only does it have to provide the safety aspects you need, it also has to meet

s144
00:09:53.840 --> 00:09:56.600
um our functional aspects.

s145
00:09:56.600 --> 00:09:58.280
The runtime needs to follow the work.

s146
00:09:58.280 --> 00:10:01.480
This can't just be something that runs locally or only in the cloud.

s147
00:10:01.480 --> 00:10:05.800
It needs to go wherever we work, wherever agents work, and that's going to be everywhere.

s148
00:10:05.800 --> 00:10:14.120
We'll work locally, we'll have agents running in the cloud, we'll do orchestration across clouds, we'll run them in our own VPC or in the customer's VPC as need be.

s149
00:10:14.120 --> 00:10:19.400
The runtime has to be omnipresent and be able to move uh across all these environments.

s150
00:10:19.400 --> 00:10:26.840
And ideally, it should be connected by a fabric, and so you can move agents up and down as you need to do.

s151
00:10:28.840 --> 00:10:31.040
Docker spent the last Everyone knows Docker.

s152
00:10:31.040 --> 00:10:33.320
I'm going to assume everyone knows Docker has used Docker.

s153
00:10:33.320 --> 00:10:38.000
And you know it's the containers, and what Docker solved the last decade is portability.

s154
00:10:38.000 --> 00:10:41.200
How do we get software from a laptop to the cloud?

s155
00:10:41.200 --> 00:10:46.880
We're taking all of that experience and building a runtime and evolving that to now solve for safety.

s156
00:10:46.880 --> 00:10:52.000
You still need portability, but you need safety, and you need this runtime to run across all environments.

s157
00:10:52.000 --> 00:10:53.560
Um that's what we're focused on now.

s158
00:10:53.560 --> 00:11:03.960
This is a new It starts with a brand new VM technology, and on top of that uh a bunch of advancements on MCP and policy and safety and governance.

s159
00:11:03.960 --> 00:11:06.120
So, I'm going to show you a quick demo.

s160
00:11:06.120 --> 00:11:09.000
Uh let's see if I can get this done in time.

s161
00:11:09.000 --> 00:11:15.240
Also, you'll have to bear with me for a minute while I figure out how to do this here.

s162
00:11:15.240 --> 00:11:17.520
Let's see.

s163
00:11:21.120 --> 00:11:23.320
I had this figured out.

s164
00:11:23.320 --> 00:11:25.280
Up.

s165
00:11:25.280 --> 00:11:29.280
Uh Let's just do that.

s166
00:11:32.720 --> 00:11:33.600
Do you guys see that?

s167
00:11:33.600 --> 00:11:34.600
Cool.

s168
00:11:34.600 --> 00:11:35.080
All right.

s169
00:11:35.080 --> 00:11:39.960
So, is that visible?

s170
00:11:40.120 --> 00:11:40.600
You'll see that?

s171
00:11:40.600 --> 00:11:41.120
Cool.

s172
00:11:41.120 --> 00:11:41.600
All right.

s173
00:11:41.600 --> 00:11:42.680
I'm going to type over here.

s174
00:11:42.680 --> 00:11:43.960
We'll see if this works.

s175
00:11:43.960 --> 00:11:45.800
So, oops.

s176
00:11:45.800 --> 00:11:48.000
Give me a minute.

s177
00:11:49.600 --> 00:11:51.880
Let's start really basic.

s178
00:11:51.880 --> 00:11:54.960
So, what we Oh my god.

s179
00:11:55.240 --> 00:11:57.600
I'm there.

s180
00:11:57.600 --> 00:11:58.240
Cool.

s181
00:11:58.240 --> 00:12:01.440
Um just to orient you all, so you've got a new tool called SPX.

s182
00:12:01.440 --> 00:12:02.960
Want to guess what it stands for?

s183
00:12:02.960 --> 00:12:09.240
This is This runs with a new micro VM that runs across all environments, Windows, Mac, Linux, cloud, everywhere.

s184
00:12:09.240 --> 00:12:11.000
Uh let's start simple just so you can see this.

s185
00:12:11.000 --> 00:12:13.880
Let's say I just do something like let's give this a name.

s186
00:12:13.880 --> 00:12:14.680
And we'll create something.

s187
00:12:14.680 --> 00:12:20.240
We'll say Codex test one codex.dat.

s188
00:12:20.240 --> 00:12:20.800
Great.

s189
00:12:20.800 --> 00:12:31.440
Just like that, this is going to go spin up a codex for me in a sandbox that's running um with my credentials injected in and with the network controls injected in.

s190
00:12:31.440 --> 00:12:36.760
So, just as a test, I can do tell me a joke and as you can see this works.

s191
00:12:36.760 --> 00:12:38.560
And hopefully it tells me something funny.

s192
00:12:38.560 --> 00:12:51.160
And I can also say um what credentials do you have access to and are they real or stubs?

s193
00:12:52.640 --> 00:12:55.480
GitHub and codex creds.

s194
00:12:55.480 --> 00:12:57.400
Ignore my typos.

s195
00:12:57.400 --> 00:13:02.280
Um I'll wait a minute for that to run, but just to describe this, the base environment here is got a sandbox running.

s196
00:13:02.280 --> 00:13:03.600
This looks like a normal agent.

s197
00:13:03.600 --> 00:13:08.400
You get the DX you you're used to, but this is running in a safe environment now for you.

s198
00:13:08.400 --> 00:13:09.920
No credentials are there.

s199
00:13:09.920 --> 00:13:11.080
They're all injected in.

s200
00:13:11.080 --> 00:13:12.520
Network policy is controlled.

s201
00:13:12.520 --> 00:13:14.160
And you'll see later you can control MCT.

s202
00:13:14.160 --> 00:13:15.920
You can control a lot more here.

s203
00:13:15.920 --> 00:13:16.440
All right.

s204
00:13:16.440 --> 00:13:19.400
Um I'm just going to ask you to believe me so we can save some time.

s205
00:13:19.400 --> 00:13:22.800
This will come back and say all the creds are there, but they're all stubs.

s206
00:13:22.800 --> 00:13:24.720
And they're all just being injected in.

s207
00:13:24.720 --> 00:13:27.480
Uh this takes some time, so I'm going to escape out for this.

s208
00:13:27.480 --> 00:13:30.200
Okay, so now um let's let's work through use case.

s209
00:13:30.200 --> 00:13:35.520
Let's say I want to review a PR and I want to write that summary into a Notion page.

s210
00:13:35.520 --> 00:13:36.800
Well, I can break this down.

s211
00:13:36.800 --> 00:13:40.800
I don't need a single monolithic sandbox where I give it both credentials.

s212
00:13:40.800 --> 00:13:43.360
I can have one task to do the PR, write it down.

s213
00:13:43.360 --> 00:13:49.240
I can have a separate sandbox with just Notion access, no other network access to take that and write it up.

s214
00:13:49.240 --> 00:13:50.520
This could be a good way to break it down.

s215
00:13:50.520 --> 00:13:53.480
So, let's just do that manually so we get a feel for it.

s216
00:13:53.480 --> 00:14:01.840
Um So, uh I'm going to just pull this over.

s217
00:14:03.080 --> 00:14:05.880
So, I'm going to create a sandbox here.

s218
00:14:05.880 --> 00:14:06.840
I'll give it a name.

s219
00:14:06.840 --> 00:14:12.680
I have got a killed a kit uh a skill that tells it how to do the PR and go ahead and do that.

s220
00:14:12.680 --> 00:14:20.200
And while that's going, this So, that's created.

s221
00:14:20.200 --> 00:14:22.760
Um just so you get a sense.

s222
00:14:22.760 --> 00:14:24.800
We can look at the policies here.

s223
00:14:24.800 --> 00:14:31.040
Um that was my PR bot and as you can see it's got access to GitHub and Anthropic and that's it.

s224
00:14:31.040 --> 00:14:31.880
Nothing else.

s225
00:14:31.880 --> 00:14:34.200
I can't have I can't go anywhere else now.

s226
00:14:34.200 --> 00:14:38.640
Um and actually just to make sure I'm going to give this more access.

s227
00:14:38.640 --> 00:14:39.360
I already give it that.

s228
00:14:39.360 --> 00:14:39.960
Great.

s229
00:14:39.960 --> 00:14:42.480
So, let's just run it.

s230
00:14:48.560 --> 00:14:48.800
Great.

s231
00:14:48.800 --> 00:14:53.800
This will run and now I can tell it go research this PR and it'll go off and do the work and write a summary.

s232
00:14:53.800 --> 00:14:57.440
All right, just to save us time, I'd already done this.

s233
00:14:57.440 --> 00:15:00.440
So, now imagine this run.

s234
00:15:02.400 --> 00:15:06.680
I can create another one here where I'll say this time I'm going to use Codex.

s235
00:15:06.680 --> 00:15:09.600
And if you look here, I'm creating another sandbox.

s236
00:15:09.600 --> 00:15:13.600
I'm giving this access to the Notion MCP.

s237
00:15:13.600 --> 00:15:18.680
So, this is now an example of me containing it and giving scoped access just to what it needs.

s238
00:15:18.680 --> 00:15:21.120
And this is not going to get access.

s239
00:15:21.120 --> 00:15:24.600
I've I created this one, so assume I recreated it."

s240
00:15:24.600 --> 00:15:30.120
And this one gets access to just those things.

s241
00:15:30.120 --> 00:15:32.520
It doesn't have access to GitHub anymore over here.

s242
00:15:32.520 --> 00:15:38.560
And now I can run this, and there I am, and I can tell it go do work.

s243
00:15:39.600 --> 00:15:44.880
So, hopefully the idea you're getting is we get these sandboxes that can be composed and scoped down to the access they need.

s244
00:15:44.880 --> 00:15:45.760
All right.

s245
00:15:45.760 --> 00:15:46.800
Uh this is going to run.

s246
00:15:46.800 --> 00:15:47.560
It'll do the right thing.

s247
00:15:47.560 --> 00:15:49.200
It'll find the MCP tool and do all that.

s248
00:15:49.200 --> 00:15:50.040
We'll save time there.

s249
00:15:50.040 --> 00:15:51.400
Just trust you know, trust me.

s250
00:15:51.400 --> 00:15:52.400
All right.

s251
00:15:52.400 --> 00:15:54.040
So, great.

s252
00:15:54.040 --> 00:15:57.080
Let's escape that, too, while that's running.

s253
00:15:57.080 --> 00:15:57.440
Okay.

s254
00:15:57.440 --> 00:15:58.480
So, this is great.

s255
00:15:58.480 --> 00:15:59.400
I've got this now.

s256
00:15:59.400 --> 00:16:05.080
But, you know what would be great is um I had created this thing.

s257
00:16:05.080 --> 00:16:08.200
Well, can I just put this in the cloud?

s258
00:16:08.200 --> 00:16:08.840
Let's find out.

s259
00:16:08.840 --> 00:16:11.960
That'd be nice if my runtime just extends.

s260
00:16:11.960 --> 00:16:13.960
Uh like sure.

s261
00:16:13.960 --> 00:16:19.760
Uh I already created that, so give me I'm just going to give it a different name.

s262
00:16:19.760 --> 00:16:26.120
Just um just bear with there.

s263
00:16:27.080 --> 00:16:28.200
So, cool.

s264
00:16:28.200 --> 00:16:31.800
That ran, and can I just go in there?

s265
00:16:36.839 --> 00:16:39.839
Uh what did I do?

s266
00:16:40.120 --> 00:16:41.040
Up.

s267
00:16:41.040 --> 00:16:45.080
Dash dash cloud, and great.

s268
00:16:45.080 --> 00:16:51.520
Are you running on the cloud or on a Mac?

s269
00:16:51.520 --> 00:16:53.440
This might take a while for it to debug it all come down.

s270
00:16:53.440 --> 00:17:03.400
But, this now took it this feels the same, but the exact same sandbox just runs in the cloud cuz the runtime is portable and goes there with your policies applied,

s271
00:17:03.400 --> 00:17:04.400
with all your controls applied.

s272
00:17:04.400 --> 00:17:09.120
So, the same policy plane, same control continues with you and extends.

s273
00:17:09.120 --> 00:17:09.839
Um all right.

s274
00:17:09.839 --> 00:17:11.120
I'm going to let this be great.

s275
00:17:11.120 --> 00:17:11.680
It figured it out.

s276
00:17:11.680 --> 00:17:13.760
It's running in the cloud.

s277
00:17:13.760 --> 00:17:20.920
If I have the cloud, well, it'd be nice if I could do a lot of work with it and it fan out.

s278
00:17:20.920 --> 00:17:27.800
So, there's a little script that goes tries to review six PRs, creates It's going to clean up that I run this before right before this.

s279
00:17:27.800 --> 00:17:31.800
Create six sandboxes and runs them all in parallel.

s280
00:17:31.800 --> 00:17:42.600
So, this is the power where you get the score same experience you have locally in the cloud with the same secure runtime uh and the same policy and scoped access running.

s281
00:17:42.600 --> 00:17:45.600
So, this is going to run all six running in parallel.

s282
00:17:45.600 --> 00:17:46.960
This is great.

s283
00:17:46.960 --> 00:17:50.920
Uh I'm going to save us time and come out of that.

s284
00:17:50.920 --> 00:17:52.560
Assume they all run.

s285
00:17:52.560 --> 00:17:54.480
Um let me skip.

s286
00:17:54.480 --> 00:17:56.480
Cool.

s287
00:17:57.800 --> 00:18:03.320
Well, if I have I'll let that be for a minute.

s288
00:18:04.040 --> 00:18:11.920
While that's running, if I can do cloud, well, it'd be really nice if I can orchestrate.

s289
00:18:11.920 --> 00:18:13.760
Let's see if I can do that.

s290
00:18:13.760 --> 00:18:15.040
Nope, that's my slide.

s291
00:18:15.040 --> 00:18:17.800
Talk, excuse me.

s292
00:18:18.520 --> 00:18:20.520
Great.

s293
00:18:20.680 --> 00:18:23.440
So, what if I can now do actual orchestration?

s294
00:18:23.440 --> 00:18:31.080
So, if this is a an orchestration tool we have, you see the same bots here, the Notion one and PR one.

s295
00:18:31.080 --> 00:18:34.200
And we have this orchestrator that knows how to orchestrate.

s296
00:18:34.200 --> 00:18:41.920
Um can I come here and tell it Uh where's my cursor?

s297
00:18:41.920 --> 00:18:55.120
Can I come and tell it find 10 random PRs from and review them and write a summary to Notion.

s298
00:18:55.120 --> 00:18:56.880
So, this will take some time.

s299
00:18:56.880 --> 00:18:58.840
I'll just briefly show you what it's doing.

s300
00:18:58.840 --> 00:19:05.800
This is the same runtime with the same control plane, with the same policy and scoped access, but now scaled out to orchestration and running.

s301
00:19:05.800 --> 00:19:16.280
This will go off, it finds those agents, it'll schedule them, it'll compose over them, run PR with just a PR bot limited access, and then run the notion one with just a notion tool.

s302
00:19:16.280 --> 00:19:17.800
This goes off and does work.

s303
00:19:17.800 --> 00:19:19.680
And once I have this, you can do more things.

s304
00:19:19.680 --> 00:19:22.120
You can create a schedule and schedule all that.

s305
00:19:22.120 --> 00:19:34.880
So, we go from a runtime that's providing us scope like containment for just the task you need with scoped access, and the same thing follows you locally to the cloud to full orchestration.

s306
00:19:34.880 --> 00:19:35.440
All right.

s307
00:19:35.440 --> 00:19:37.920
Last thing.

s308
00:19:40.920 --> 00:19:44.880
Um where is uh There you go.

s309
00:19:44.880 --> 00:19:45.960
Okay.

s310
00:19:45.960 --> 00:19:50.040
So, we said now we need um we need intent-based access.

s311
00:19:50.040 --> 00:19:52.000
How do we manage this dynamically?

s312
00:19:52.000 --> 00:19:56.160
This is still I'm showing you an early prototype we have internally, not built yet.

s313
00:19:56.160 --> 00:20:00.120
Um let me fetch a PR here.

s314
00:20:00.120 --> 00:20:06.880
Just give me Uh where Okay.

s315
00:20:06.880 --> 00:20:11.400
So, what's happening here is we're running On the left, you see an agent running in a sandbox.

s316
00:20:11.400 --> 00:20:13.440
You see the main agent over here.

s317
00:20:13.440 --> 00:20:16.760
This has access just Anthropic Claude, no GitHub.

s318
00:20:16.760 --> 00:20:25.200
But now I tell it do a quick overview of this PR.

s319
00:20:26.560 --> 00:20:29.280
This agent in this sandbox is scope limited.

s320
00:20:29.280 --> 00:20:31.000
It cannot do that.

s321
00:20:31.000 --> 00:20:38.880
In this environment, we built an intent-based tool for it where it can ask the runtime and say, "Hey, I want to take this action."

s322
00:20:38.880 --> 00:20:39.680
What should happen?

s323
00:20:39.680 --> 00:20:41.440
It says, "Oh, my network's blocked.

s324
00:20:41.440 --> 00:20:42.680
Let me delegate and ask."

s325
00:20:42.680 --> 00:20:52.920
And if you look here now, we created a scoped sub-sandbox that got access to GitHub, and the main one did not.

s326
00:20:52.920 --> 00:20:54.160
So, we're running that.

s327
00:20:54.160 --> 00:20:56.080
We decided that the intent made sense.

s328
00:20:56.080 --> 00:20:58.400
The user query said, "Review this PR."

s329
00:20:58.400 --> 00:21:05.600
So, it makes sense you want access to that, but I'm going to create a scoped sub-sandbox for you where you get that access, and the result comes back.

s330
00:21:05.600 --> 00:21:08.760
And the same thing can expand and go from there.

s331
00:21:08.760 --> 00:21:13.360
So, what we did manually can start happening automatically with judgment in person.

s332
00:21:13.360 --> 00:21:18.480
If the PR suppose the text PR said, "I want you to now export this to pastebin.com."

s333
00:21:18.480 --> 00:21:19.840
That would get rejected.

s334
00:21:19.840 --> 00:21:26.480
And this is running at a base one-time layer, so runs across every agent, every model, every harness that you need.

s335
00:21:26.480 --> 00:21:27.720
Okay.

s336
00:21:27.720 --> 00:21:33.280
Um let's come back to our presentation if I can figure out how to do this.

s337
00:21:33.280 --> 00:21:34.480
Let's see here.

s338
00:21:34.480 --> 00:21:35.320
Great.

s339
00:21:35.320 --> 00:21:43.760
So, just to recap, the core thing here is to really unlock autonomy, we need safety.

s340
00:21:43.760 --> 00:21:48.040
To succeed at safety, you have to do this across models, across harnesses.

s341
00:21:48.040 --> 00:21:51.320
You need to provide a contained environment.

s342
00:21:51.320 --> 00:21:56.920
You need to put that environment, you need to be able to add scoped capabilities to that environment.

s343
00:21:56.920 --> 00:22:01.000
You need to be able to know what capabilities to provide there based on intent.

s344
00:22:01.000 --> 00:22:09.280
And this one-time has to work across models, across harnesses, and move across all environments, local, cloud, VPC, orchestration.

s345
00:22:09.280 --> 00:22:10.280
That's what we focus on.

s346
00:22:10.280 --> 00:22:10.920
That's what we're building.

s347
00:22:10.920 --> 00:22:14.640
That's what we think is needed to actually go unlock agent autonomy next.

s348
00:22:14.640 --> 00:22:15.560
Please go try this out.

s349
00:22:15.560 --> 00:22:16.280
It's really easy.

s350
00:22:16.280 --> 00:22:19.080
You can just go brew install SPX, run this.

s351
00:22:19.080 --> 00:22:23.040
You can run Claude, Codex, Open Code, any agent, build your own in there.

s352
00:22:23.040 --> 00:22:25.280
Um I'll be around afterwards, open for questions.

s353
00:22:25.280 --> 00:22:27.160
And we have a booth uh down below.

s354
00:22:27.160 --> 00:22:28.920
Come find us there, too.

s355
00:22:28.920 --> 00:22:30.625
Thank you.

s356
00:22:30.625 --> 00:22:32.625
[applause]