1 00:00:00,921 --> 00:00:01,461 Hi. 2 00:00:02,021 --> 00:00:02,301 Hi. 3 00:00:04,261 --> 00:00:05,061 Hey, Dick. 4 00:00:05,341 --> 00:00:05,781 Hey, Davis. 5 00:00:05,981 --> 00:00:06,381 Hey, Ian. 6 00:00:07,101 --> 00:00:07,961 Hi, everyone. 7 00:00:08,181 --> 00:00:10,961 Welcome to AI Engineer New York. 8 00:00:11,121 --> 00:00:12,781 I'm super excited to be here today. 9 00:00:13,461 --> 00:00:14,781 My name is Allie Howe. 10 00:00:14,901 --> 00:00:17,781 I'm a member of technical staff at Keycard. 11 00:00:18,241 --> 00:00:20,921 I'm here with some amazing panelists today. 12 00:00:21,201 --> 00:00:22,901 We have Ian, CEO of Keycard. 13 00:00:23,681 --> 00:00:28,421 We have Michael Davis, global chief security architect at JPMorgan Chase. 14 00:00:28,761 --> 00:00:36,081 And we have Dick Hardt, the founder of AAuth and co-creator of OAuth with us on stage today. 15 00:00:36,361 --> 00:00:40,521 I'm super excited to talk to all of them about intent-based authorization. 16 00:00:41,201 --> 00:00:48,361 And to set the stage, I want to bring to light that as more companies are looking to give their agents increased levels of autonomy, 17 00:00:48,621 --> 00:00:51,761 they're looking to runtime authorization to help. 18 00:00:51,761 --> 00:00:57,021 Runtime auth is the practice of authorizing an agent per tool call rather than having 19 00:00:57,021 --> 00:01:00,621 the agent hold broad standing access that it will eventually misuse. 20 00:01:01,321 --> 00:01:05,521 However, is this tool call or not is never a simple question. 21 00:01:06,761 --> 00:01:13,121 is because many MCP tools and APIs are coarse-grained, humans struggle to write the 22 00:01:13,121 --> 00:01:17,661 perfect policy, and the environment around the agent will change as it runs. 23 00:01:17,661 --> 00:01:24,061 And intent can help by providing extra context so that at runtime we can make better authorization 24 00:01:24,061 --> 00:01:28,121 decisions about what an agent is allowed or is not allowed to do. 25 00:01:30,201 --> 00:01:36,401 So to continue, I would like to talk about, really dive into why do we need intent based 26 00:01:36,401 --> 00:01:37,781 off in the first place. 27 00:01:39,321 --> 00:01:40,441 have dramatically improved. 28 00:01:40,701 --> 00:01:42,121 They have bigger context windows. 29 00:01:42,501 --> 00:01:47,041 They're able to verify work because model vision capabilities have improved. 30 00:01:47,041 --> 00:01:50,781 and many contexts people are proclaiming that AGI is here. 31 00:01:51,181 --> 00:01:54,481 If the models are so good, if AGI is really here today, 32 00:01:55,081 --> 00:01:58,221 then why are teams struggling to give their agents more autonomy? 33 00:01:58,721 --> 00:02:00,081 Ian, let's start with you. 34 00:02:00,381 --> 00:02:03,061 You're helping many financial enterprises at Keycard. 35 00:02:03,301 --> 00:02:04,941 What are you seeing that's getting in the way? 36 00:02:05,241 --> 00:02:07,441 I think, broadly speaking, enterprises, 37 00:02:07,641 --> 00:02:08,821 especially financial services firms, 38 00:02:08,961 --> 00:02:11,801 regulated industries are almost always security first. 39 00:02:11,961 --> 00:02:13,301 It's how they build trust in their business 40 00:02:13,301 --> 00:02:14,841 and maintaining the business continuity 41 00:02:14,841 --> 00:02:16,601 is by our first priority. 42 00:02:17,041 --> 00:02:19,181 Then innovation is second, third, or fourth. 43 00:02:19,701 --> 00:02:22,661 I think, like, broadly speaking, in any enterprise, 44 00:02:23,081 --> 00:02:25,901 what you see is this, like, hodgepodge of different little islands, 45 00:02:26,221 --> 00:02:28,381 of different little identities, of different little systems 46 00:02:28,381 --> 00:02:30,881 from across all different worlds. 47 00:02:30,941 --> 00:02:32,361 And how do you actually tie that together 48 00:02:32,361 --> 00:02:34,281 in a way that an agent can navigate through that, 49 00:02:34,861 --> 00:02:38,041 ask for access, and then also ensure that the agent can outperform, like, 50 00:02:38,901 --> 00:02:41,101 something that was unintended by the user of the business. 51 00:02:41,361 --> 00:02:46,041 And the unfortunate situation is most of our systems today are coarse-grained, right? 52 00:02:46,041 --> 00:02:49,961 I don't know, Salesforce is a good example, where for a long time they had a single scope 53 00:02:49,961 --> 00:02:55,261 which was API on their OAuth, which is, in the context of an agent, not very helpful. 54 00:02:55,581 --> 00:02:59,461 So that's the broadly the first and foremost part, is that most of the systems they have 55 00:02:59,461 --> 00:03:03,081 for security today were designed for a world where humans were making all the decisions 56 00:03:03,081 --> 00:03:08,401 and software is very deterministic, not this new fangled magic box we've invented that basically 57 00:03:08,401 --> 00:03:11,221 reasons and tries over and over again to find a solution to a problem. 58 00:03:13,161 --> 00:03:15,081 How is OAuth part of the problem? 59 00:03:15,321 --> 00:03:16,321 How is OAuth getting in the way? 60 00:03:16,421 --> 00:03:17,721 Why is it not the right fit for agents? 61 00:03:19,201 --> 00:03:23,701 When people started looking at how do we authorize agents to access something, the 62 00:03:23,701 --> 00:03:26,261 tool that was sitting there on the shelf was OAuth. 63 00:03:26,441 --> 00:03:29,401 People grabbed that tool and said, here's the tool. 64 00:03:29,521 --> 00:03:30,781 This is authorization. 65 00:03:31,061 --> 00:03:32,481 It should be able to solve the problem. 66 00:03:32,781 --> 00:03:35,401 OAuth was not designed for this kind of world. 67 00:03:35,541 --> 00:03:39,981 It was designed originally for how do I let this website talk to this website. 68 00:03:40,421 --> 00:03:43,741 In OAuth 2, we added scopes. Before that, it was just do anything. 69 00:03:45,661 --> 00:03:48,081 But it required you to be pre-registered. 70 00:03:48,181 --> 00:03:50,941 It's expecting that there's a browser involved in a redirect. 71 00:03:51,801 --> 00:03:54,761 OAuth has evolved over the years to support some other things. 72 00:03:54,921 --> 00:03:57,001 But the agentic world is completely different. 73 00:03:57,121 --> 00:03:59,361 We don't know ahead of time what the agent needs to do. 74 00:03:59,621 --> 00:04:01,781 We need to go and make that decision over time. 75 00:04:02,261 --> 00:04:04,941 Different instances of an agent are going to need different kinds of things. 76 00:04:04,941 --> 00:04:09,081 and as Ian talked about, the granularity of the scopes 77 00:04:09,081 --> 00:04:11,581 that people says, well, we already have scopes for OAuth, 78 00:04:11,621 --> 00:04:13,201 let's just map those over to agents, 79 00:04:13,421 --> 00:04:17,041 is far too coarse-grained for what agents are doing. 80 00:04:18,601 --> 00:04:22,361 Davis, how are you seeing enterprises move towards higher levels of autonomy? 81 00:04:23,061 --> 00:04:27,061 Yeah, I think the key piece is how do you deal with that coarse-grained problem? 82 00:04:27,281 --> 00:04:30,081 And what I've seen the kind of more successful enterprises 83 00:04:30,081 --> 00:04:33,661 is they kind of board agents like they onboard developers, right? 84 00:04:33,661 --> 00:04:39,061 start with you don't get full commit access day one. You have to go through and add the 85 00:04:39,061 --> 00:04:44,241 levels of capability as they mature. So the definitions that enterprises are coming up 86 00:04:44,241 --> 00:04:48,801 with are what is the context that makes this agent safe. And it isn't just usually what 87 00:04:48,801 --> 00:04:53,281 the agent says. It can attest to something but it's other things like the environment 88 00:04:53,281 --> 00:04:57,501 around it and other information that can help you understand levels of autonomy. A very 89 00:04:57,501 --> 00:05:02,141 simple example would be where is the sandbox running? Is it in the sandbox? Those type 90 00:05:02,141 --> 00:05:04,341 but things can change the level of autonomy that's allowed. 91 00:05:05,481 --> 00:05:05,961 Absolutely. 92 00:05:06,261 --> 00:05:08,541 Yes, we mentioned that core screen access problem, 93 00:05:08,741 --> 00:05:11,221 and to put that into perspective, to give an example, 94 00:05:11,781 --> 00:05:15,201 with Notion’s MCP server, you can say fetch this page, 95 00:05:15,341 --> 00:05:18,181 which is like the view page tool or get page, 96 00:05:18,321 --> 00:05:21,781 but you can't say just get this database on this page. 97 00:05:22,261 --> 00:05:25,801 How is runtime authorization based on intent a better model? 98 00:05:25,901 --> 00:05:26,861 That's for anyone. 99 00:05:29,421 --> 00:05:30,421 I'll take a shot at it. 100 00:05:30,421 --> 00:05:33,881 So to me, this is something that the financial services industry, 101 00:05:33,881 --> 00:05:37,541 hopefully maybe we can learn from the background that banks have gone through. 102 00:05:38,321 --> 00:05:41,781 Banks moved long ago from authorizing and authenticating humans 103 00:05:41,781 --> 00:05:44,241 to authorizing the transaction, right? 104 00:05:44,481 --> 00:05:46,081 And when is that transaction occurring? 105 00:05:46,281 --> 00:05:47,421 At runtime, right? 106 00:05:47,841 --> 00:05:52,701 And so I think that runtime authorization is we're going to be able to learn 107 00:05:52,701 --> 00:05:56,621 from the scars of the past that we've had and apply it to this new problem. 108 00:05:57,361 --> 00:05:59,621 I also think that one thing is 109 00:05:59,621 --> 00:06:01,921 it's a lot easier to debug something at runtime 110 00:06:01,921 --> 00:06:03,241 when you understand the intent 111 00:06:03,241 --> 00:06:05,621 I think we've all remembered back in the day 112 00:06:05,621 --> 00:06:06,341 writing checks 113 00:06:06,341 --> 00:06:09,861 or seen those things on TV now I guess is the right thing 114 00:06:09,861 --> 00:06:11,641 but writing checks 115 00:06:11,641 --> 00:06:12,641 there was a memo field there 116 00:06:12,641 --> 00:06:15,461 that memo field was used to actually tell the intent 117 00:06:15,461 --> 00:06:16,441 of what this payment was 118 00:06:16,441 --> 00:06:18,541 but the check itself did have limits 119 00:06:18,541 --> 00:06:21,381 the price, the payee, the date 120 00:06:21,381 --> 00:06:22,001 etc. 121 00:06:22,461 --> 00:06:24,741 I think a lot of those concepts are now being applied 122 00:06:24,741 --> 00:06:26,481 and can be applied to help with this runtime 123 00:06:26,481 --> 00:06:32,701 time. Intense sort of one of those, you know, like many words, words are hard. And so, you know, 124 00:06:32,841 --> 00:06:37,981 building on the example here of making a payment of a transaction, right? You know, that's not a 125 00:06:37,981 --> 00:06:44,601 scope. That's, can I do this one thing in this particular context? Well, this one payment. But 126 00:06:44,601 --> 00:06:49,981 I think we need an agent to make any decision should it be able to do it. You need all the 127 00:06:49,981 --> 00:06:53,781 rest of the context of, well, why are we making this payment? What are all the things that happened 128 00:06:53,781 --> 00:06:55,881 before. Did we just make 129 00:06:55,881 --> 00:06:57,821 the same payment just like five 130 00:06:57,821 --> 00:06:59,841 seconds ago and now this is a double payment? 131 00:07:00,641 --> 00:07:07,081 Just because this is right in context by itself doesn't mean it's the right thing within the broader mission. 132 00:07:08,181 --> 00:07:14,061 In Auth, we're working on the concept of a mission that is what do we want the agent to accomplish big picture? 133 00:07:14,441 --> 00:07:21,621 And then each of the decisions are made within the context, the intent around what's happening big picture around doing that. 134 00:07:21,621 --> 00:07:25,061 and you need granularity at the transaction layer 135 00:07:25,061 --> 00:07:28,641 for many of the things to know what exactly is happening, 136 00:07:28,661 --> 00:07:31,441 not just I'm allowed to go and make payments. 137 00:07:32,941 --> 00:07:34,601 Yeah, I think one of the most interesting things, 138 00:07:34,681 --> 00:07:36,121 I think about a practical example, 139 00:07:36,441 --> 00:07:38,321 to understand why intents are required, 140 00:07:38,381 --> 00:07:40,961 is if you have two ChatGPT sessions or two Claude sessions, 141 00:07:41,161 --> 00:07:44,061 in one session I say, hey, help me go do some shopping, 142 00:07:44,141 --> 00:07:47,101 in the other session I say, hey, help me understand 143 00:07:47,101 --> 00:07:48,721 why there's a bug in production. 144 00:07:48,721 --> 00:07:54,221 Those have very different profiles in terms of what permissions they should have and also 145 00:07:54,221 --> 00:07:55,601 when they should bring you back into the loop. 146 00:07:55,741 --> 00:07:57,261 When should the human be involved again? 147 00:07:57,941 --> 00:08:02,081 At the end of the day, if we don't have intent or some capacity to relay what is the user 148 00:08:02,081 --> 00:08:06,041 or the business's intent with this thing, we actually can't get to autonomy. 149 00:08:06,521 --> 00:08:09,501 A lot of the talks this morning were, hey, we're going to run our business on agents. 150 00:08:09,721 --> 00:08:10,341 We're going to do all this stuff. 151 00:08:10,621 --> 00:08:10,981 Great. 152 00:08:11,541 --> 00:08:15,481 What happens the first minute, like a pocket OS style instance happens where it actually 153 00:08:15,481 --> 00:08:18,781 accidentally delete the production database instead of staging because it has coarse grained 154 00:08:18,781 --> 00:08:20,941 access instead of long scoped access. 155 00:08:22,201 --> 00:08:27,061 What we want as an industry is to leverage this magic box we've created to automate our 156 00:08:27,061 --> 00:08:27,561 lives. 157 00:08:28,041 --> 00:08:32,261 The current state of the world is that you can do that and take all of the risk and then 158 00:08:32,261 --> 00:08:33,621 you can see all of the instances that come from it. 159 00:08:33,721 --> 00:08:38,801 Until we solve that underlying problem, realizing true autonomy, being able to operationalize 160 00:08:38,801 --> 00:08:44,501 our business and be able to step away as humans and scale that, we have to solve intent first. 161 00:08:46,241 --> 00:08:46,641 Absolutely. 162 00:08:47,241 --> 00:08:51,661 And now that we understand why we need intent based off, let's talk about what it is practically. 163 00:08:51,821 --> 00:08:52,481 What are the primitives? 164 00:08:52,621 --> 00:08:54,141 What does it actually look like in practice? 165 00:08:55,021 --> 00:08:57,581 Dick hinted at it with the concept of the AAuth mission. 166 00:08:58,661 --> 00:09:00,681 So, Dick, elaborate on the mission. 167 00:09:00,921 --> 00:09:02,881 What is the mission based off of? 168 00:09:02,941 --> 00:09:04,441 Is it based off of the user's intent? 169 00:09:04,681 --> 00:09:06,121 Is it the agent's intent? 170 00:09:06,281 --> 00:09:07,701 Or is it a combination of the two? 171 00:09:08,901 --> 00:09:12,621 Well, the agent should be working on behalf of the person. 172 00:09:12,881 --> 00:09:16,701 And in AAuth, we define a person as either the organization or a human 173 00:09:16,701 --> 00:09:19,161 because it could be operating on either one of those. 174 00:09:19,321 --> 00:09:23,641 And so it needs to be acting in the best interest of the person that it's acting on 175 00:09:23,641 --> 00:09:29,141 because that is who's ultimately responsible for what the agent does. 176 00:09:29,361 --> 00:09:31,321 The agent can't be responsible. 177 00:09:32,641 --> 00:09:37,821 And so the mission is something that the person is giving the agent to do. 178 00:09:37,821 --> 00:09:43,001 the agent, a good agent, is going to go and negotiate with a person to go and talk more about 179 00:09:43,001 --> 00:09:50,141 what are the parameters around that. A good example is when you think of back in the day, 180 00:09:50,301 --> 00:09:55,481 which seems like three months ago, when you would want to code something up and you'd create a plan 181 00:09:55,481 --> 00:09:58,941 and then the agent would do the plan. Now you just tell it and it figures everything out. 182 00:09:59,141 --> 00:10:04,361 But that whole concept of what's a plan, what are you trying to do, and you give that to the agent, 183 00:10:04,361 --> 00:10:09,841 And so then that then is a context around where you're making authorization decisions later on. 184 00:10:10,161 --> 00:10:13,821 And then that mission identifier tracks through everything. 185 00:10:14,081 --> 00:10:20,461 So you can go and, you know, audit and be able to see what were all the things that happened 186 00:10:20,461 --> 00:10:24,641 and what were the decisions that happened in the context of this one mission, right? 187 00:10:24,701 --> 00:10:30,361 Where today, you know, there isn't really a good concept of agent identity or the mission, right? 188 00:10:30,361 --> 00:10:41,001 It's just making something and things are making decisions without really knowing which instance of the agent is doing it or what's the context of what mission is this involved in. 189 00:10:42,261 --> 00:10:44,561 Tell me more about that negotiation phase. 190 00:10:44,761 --> 00:10:52,461 Because what happens if a user is talking to an instant agent and it talks to the agent and says, I want you to go read the CEO's email. 191 00:10:52,721 --> 00:10:54,321 That's outside of the scope of that agent. 192 00:10:54,541 --> 00:10:56,681 So is that intent rejected from the user? 193 00:10:58,441 --> 00:10:59,221 Should be. 194 00:11:00,621 --> 00:11:05,681 So with a good separation, I don't know whether, I forget whether we're talking about this 195 00:11:05,681 --> 00:11:10,601 later, but the separation of concerns of the worker, right, there's an agent that's doing 196 00:11:10,601 --> 00:11:15,981 the work, and we believe there should be a separate agent that's supervising what this 197 00:11:15,981 --> 00:11:16,401 one does. 198 00:11:16,741 --> 00:11:21,561 And so that you have a separation of concerns where this one can't do any of the work, but 199 00:11:21,561 --> 00:11:23,661 it gets decided what this agent gets to do. 200 00:11:23,941 --> 00:11:28,921 And so if the user says, oh, I want you to go read the CEO's email, that's probably going 201 00:11:28,921 --> 00:11:32,421 to get caught in deterministic policies right away. 202 00:11:33,361 --> 00:11:34,861 not a vague thing. 203 00:11:35,341 --> 00:11:38,981 Reading somebody else's email, we've got good controls for that. 204 00:11:40,541 --> 00:11:50,041 telling the agent to send the CEO's, forward a CEO's email to the outside world, that's 205 00:11:50,041 --> 00:11:54,101 a little more vague, and that's the kind of thing that ideally comes back to a supervising 206 00:11:54,101 --> 00:11:56,401 agent says, that's probably a bad idea. 207 00:11:56,641 --> 00:11:58,021 And no, you can't do that. 208 00:11:59,001 --> 00:12:00,241 Absolutely. So I feel like that's another 209 00:12:00,241 --> 00:12:02,241 primitive, too, of intent-based office, is 210 00:12:02,241 --> 00:12:02,801 policy. 211 00:12:04,061 --> 00:12:06,321 Ian at Keycard, how are you seeing that? When a mission 212 00:12:06,321 --> 00:12:08,241 needs to change or a policy needs to update, 213 00:12:08,441 --> 00:12:10,261 how can Keycard help keep track of those 214 00:12:10,261 --> 00:12:12,321 changes as maybe the mission or policy 215 00:12:12,321 --> 00:12:14,201 updates need to be made? Yeah, I think, like, 216 00:12:14,281 --> 00:12:15,921 taking a step back, there's, like, actually, it was 217 00:12:15,921 --> 00:12:18,081 Davis and I were sitting in a room some time ago, 218 00:12:18,161 --> 00:12:20,401 and before, 219 00:12:20,441 --> 00:12:22,361 like, AAuth and some of these things 220 00:12:22,361 --> 00:12:23,541 It emerged in the ecosystem. 221 00:12:23,701 --> 00:12:25,581 One of the things we talked about was consent fatigue. 222 00:12:25,701 --> 00:12:31,721 I think at the minimum you always have this like how secure do you make a system versus 223 00:12:31,721 --> 00:12:33,801 the trade-off of the impact of the human. 224 00:12:34,041 --> 00:12:38,461 So a key card, our broad view on this is you want to have broad basic deterministic policy 225 00:12:38,461 --> 00:12:40,941 that basically says this is what must never happen effectively. 226 00:12:41,561 --> 00:12:44,121 Or these are the things that always require a human to be involved. 227 00:12:45,141 --> 00:12:48,301 And then from there what you really want to think about is okay, cool. 228 00:12:48,301 --> 00:12:50,981 well, now that I have that in place, 229 00:12:51,141 --> 00:12:53,001 there's a big gap between all of the policy 230 00:12:53,001 --> 00:12:55,561 I can write as a human or write as an organization 231 00:12:55,561 --> 00:12:57,901 and then what I actually want the policy to be 232 00:12:57,901 --> 00:12:59,641 in the specifics of a specific task. 233 00:12:59,921 --> 00:13:02,661 And so the real challenge is 234 00:13:02,661 --> 00:13:04,641 how do I layer over those two things? 235 00:13:04,721 --> 00:13:05,861 Because humans can't write at all. 236 00:13:06,181 --> 00:13:07,481 And so there's a version of that 237 00:13:07,481 --> 00:13:09,641 that is like a user or agent-to-agent interaction 238 00:13:09,641 --> 00:13:11,521 and they have an intent between those two 239 00:13:11,521 --> 00:13:13,161 of transactional intent. 240 00:13:13,381 --> 00:13:15,301 And there's also the business's intent 241 00:13:15,301 --> 00:13:17,181 for why they build or adopt an agent. 242 00:13:17,181 --> 00:13:19,361 So why did we buy Claude Code? 243 00:13:19,481 --> 00:13:21,661 Well, because we wanted to make our developers more successful 244 00:13:21,661 --> 00:13:23,281 or because we wanted to do these different things. 245 00:13:23,641 --> 00:13:26,601 And in the context of using Claude Code or whatever, 246 00:13:27,021 --> 00:13:29,481 why am I working in this moment with Claude Code 247 00:13:29,481 --> 00:13:31,321 while it's actually to fix a bug in staging, right? 248 00:13:31,401 --> 00:13:32,741 And those are two different types of intent. 249 00:13:33,161 --> 00:13:35,761 And if we can understand those two different things 250 00:13:35,761 --> 00:13:39,721 and then convert that some way into like a bounding box 251 00:13:39,721 --> 00:13:40,821 of what those agents can do, 252 00:13:40,981 --> 00:13:43,121 you can then basically calculate the intersection of that 253 00:13:43,121 --> 00:13:44,721 and say, okay, here's what you can actually do. 254 00:13:44,721 --> 00:13:49,041 And the trick for anyone building these systems is how do I ensure that I don't bring the 255 00:13:49,041 --> 00:13:53,081 user into the loop except when absolutely required because that's what's going to be 256 00:13:53,081 --> 00:13:54,221 the adoption curve problem. 257 00:13:54,361 --> 00:13:57,081 But that's also the adoption curve problem when it comes to, like, enabling agents to 258 00:13:57,081 --> 00:13:58,161 be autonomous in the first place. 259 00:13:59,461 --> 00:14:00,301 That makes sense. 260 00:14:00,661 --> 00:14:01,901 I like what you were saying with the intersection. 261 00:14:02,061 --> 00:14:05,881 I think that's a unique thing we don't talk about enough within identity and access management, 262 00:14:06,001 --> 00:14:06,081 right? 263 00:14:06,341 --> 00:14:08,681 Normally you get access to one thing, right? 264 00:14:08,781 --> 00:14:13,081 And so what I've seen successful kind of in this intent-based approach and where I get 265 00:14:13,081 --> 00:14:14,841 more excited is you can actually have 266 00:14:14,841 --> 00:14:17,021 those different intents be from different areas of the 267 00:14:17,021 --> 00:14:19,101 organization. And so you have 268 00:14:19,101 --> 00:14:21,021 the decoupling of these things that they can 269 00:14:21,021 --> 00:14:22,981 kind of live on their own, but then come together 270 00:14:22,981 --> 00:14:24,381 to form that decision. 271 00:14:24,681 --> 00:14:26,461 And that decision doesn't have to be static. 272 00:14:26,961 --> 00:14:28,961 So if we use the example of the CEO's email, 273 00:14:29,421 --> 00:14:30,961 well, if that context 274 00:14:30,961 --> 00:14:32,521 involves that's the administrative assistant, 275 00:14:33,041 --> 00:14:34,661 then yeah, maybe she is supposed to read the email. 276 00:14:35,181 --> 00:14:36,321 Or maybe just the calendar. 277 00:14:37,321 --> 00:14:39,021 And so I think when we see and we start 278 00:14:39,021 --> 00:14:40,561 thinking about these intersection components, 279 00:14:41,221 --> 00:14:42,941 we have a totally different way we can start 280 00:14:43,641 --> 00:14:48,201 expressing policy, but also starting to bring in not just the one side of the equation we 281 00:14:48,201 --> 00:14:50,881 always talked about before, which was the app doing something. 282 00:14:51,161 --> 00:14:53,121 Now we actually have the ecosystem you can bring in. 283 00:14:53,621 --> 00:14:58,061 And so the more I see organizations starting to realize that maintaining that state or 284 00:14:58,061 --> 00:15:02,121 that context of these other elements to be able to help with that intention can completely 285 00:15:02,121 --> 00:15:04,481 change the way you're effective at runtime authorization. 286 00:15:05,581 --> 00:15:07,941 And are you seeing this across enterprises today? 287 00:15:08,061 --> 00:15:11,901 Most people have mission tracking and policy tracking in place, or is that largely missing 288 00:15:11,901 --> 00:15:17,121 today. It's brand new still. Part of the reason why I'm excited to talk about it is 289 00:15:17,121 --> 00:15:22,861 it is changing the way to reason through this. Even in the most simplistic case, if you're 290 00:15:22,861 --> 00:15:26,701 a developer and you are thinking in terms of things like transaction and you have these 291 00:15:26,701 --> 00:15:31,401 concepts of intent, it makes it easier for you to potentially build the components that 292 00:15:31,401 --> 00:15:36,221 will be composed and used through that intention. I think it will give us more ways to reason 293 00:15:36,221 --> 00:15:41,361 through these and communicate and ultimately be more interoperable. To me, the last thing 294 00:15:41,361 --> 00:15:43,021 that I think is interesting is the 295 00:15:43,861 --> 00:15:45,341 diagnostics that you can run on this. 296 00:15:45,881 --> 00:15:47,461 Intention is something that flows 297 00:15:47,461 --> 00:15:48,861 through many events, potentially. 298 00:15:49,501 --> 00:15:51,321 And I think one of the examples 299 00:15:51,321 --> 00:15:53,321 I've seen before is talking about 300 00:15:53,321 --> 00:15:55,001 that mission flows through. 301 00:15:55,361 --> 00:15:57,261 It could be long-lived. It could be weeks. 302 00:15:57,521 --> 00:15:58,821 That intention can still be there. 303 00:15:59,221 --> 00:16:01,401 So it's still very, very early for most 304 00:16:01,401 --> 00:16:03,101 enterprises. Absolutely. 305 00:16:03,281 --> 00:16:05,281 And yes, that interoperability is key, and I think that's pretty 306 00:16:05,281 --> 00:16:06,861 hard for enterprises because they're 307 00:16:06,861 --> 00:16:09,141 between different clouds, different environments, 308 00:16:09,381 --> 00:16:11,241 different legacy systems, and that 309 00:16:11,241 --> 00:16:13,381 policy that mission has to hold through all of those 310 00:16:13,381 --> 00:16:15,221 different hops. A lot of enterprises 311 00:16:15,221 --> 00:16:17,041 still have to deal with the fact that the permission 312 00:16:17,041 --> 00:16:18,641 says read only and it's still read right. 313 00:16:19,721 --> 00:16:21,141 Right? It's like, you have the other problems 314 00:16:21,141 --> 00:16:22,281 you have to start dealing with. And so 315 00:16:22,781 --> 00:16:24,741 I think that it will help get 316 00:16:24,741 --> 00:16:26,741 the kind of taxonomy or language 317 00:16:26,741 --> 00:16:29,121 amongst people to be easier to interoperate. 318 00:16:30,181 --> 00:16:30,621 Absolutely. 319 00:16:31,621 --> 00:16:33,061 One of the reasons why I'm excited 320 00:16:33,061 --> 00:16:35,101 about intent-based authorization is 321 00:16:35,101 --> 00:16:37,021 because I think it has the ability 322 00:16:37,021 --> 00:16:39,141 to be a huge unlock for things 323 00:16:39,141 --> 00:16:40,381 like agentic commerce. 324 00:16:41,241 --> 00:16:43,581 So let's apply intent-based auth to something real. 325 00:16:43,821 --> 00:16:46,381 I think intent-based auth adds a lot of value here. 326 00:16:46,481 --> 00:16:48,761 And for users, it can help them ensure their agents 327 00:16:48,761 --> 00:16:51,101 buy the right item with their own personal budget. 328 00:16:51,341 --> 00:16:53,941 And for merchants, that means capturing the intent that 329 00:16:53,941 --> 00:16:56,041 gives them extra data to understand why a purchase 330 00:16:56,041 --> 00:16:58,021 is being made and if this agent should even 331 00:16:58,021 --> 00:16:59,501 be trusted to visit their site. 332 00:17:00,441 --> 00:17:06,541 Davis, when we think about agents in the context of financial services and agentic commerce, why is intent-based auth so important? 333 00:17:07,201 --> 00:17:25,001 I think simply it extends the concept, maybe not everybody is aware, but some are around, you know, know your customer, right? So I want to know my customer, know who they are, what they're doing. But I think also we're starting to see I want to know my agent, right? So I think that you have a coupling here around the agent itself, the intent of the actual user, the intent of the operator. 334 00:17:25,021 --> 00:17:27,701 operator, the intent of the processor, right, et cetera. 335 00:17:29,241 --> 00:17:31,281 Before now we couldn't really bring those together. 336 00:17:32,281 --> 00:17:35,621 It matters of course when it comes to things like commerce because you have additional 337 00:17:35,621 --> 00:17:40,261 layers on top of this around what was the intention for things like regulatory requirements, 338 00:17:40,481 --> 00:17:40,741 et cetera. 339 00:17:41,221 --> 00:17:45,041 And this is going to help, I think, simplify those operations, which means we'll get more 340 00:17:45,041 --> 00:17:47,061 access to these agents doing good work for us. 341 00:17:48,261 --> 00:17:49,201 That makes sense. 342 00:17:49,661 --> 00:17:53,981 And another blocker for agentic commerce is the fact that the web wasn't made for agents. 343 00:17:54,701 --> 00:17:57,261 Ian, can you tell us how agent identity can help? 344 00:17:57,981 --> 00:17:59,421 Yeah, I think stepping back, 345 00:17:59,621 --> 00:18:00,721 we've kind of always had this problem 346 00:18:00,721 --> 00:18:03,161 where like, what do you do with the unregistered client? 347 00:18:03,341 --> 00:18:06,341 So like, I show up on eBay, I haven't logged in, 348 00:18:06,501 --> 00:18:08,741 I'm using Chrome, eBay doesn't know who I am, 349 00:18:09,161 --> 00:18:10,501 how do I do guest checkout? 350 00:18:10,581 --> 00:18:11,641 How do I approve of a person? 351 00:18:11,821 --> 00:18:13,581 How do I, you know, so they can say, 352 00:18:13,701 --> 00:18:15,941 yeah, you can bid on this pair of socks for $50. 353 00:18:16,641 --> 00:18:18,301 And I think if we're all paying attention 354 00:18:18,301 --> 00:18:19,781 to what's going on in personal agents, 355 00:18:20,041 --> 00:18:22,381 Muse and Instinct and GrokBot, 356 00:18:22,381 --> 00:18:28,541 And recently this announcement around this personal agent protocol is the fundamental 357 00:18:28,541 --> 00:18:32,961 problem we have is how do you have an agent show up to a website, be able to interact 358 00:18:32,961 --> 00:18:37,041 with the website, know that you actually can trust that agent, so for a long time it captures 359 00:18:37,041 --> 00:18:37,481 on the web. 360 00:18:37,561 --> 00:18:37,861 Why? 361 00:18:38,021 --> 00:18:40,801 Because we want to prevent spam, we want to prevent abuse. 362 00:18:41,121 --> 00:18:43,921 So we added captures and that's something only a human could solve. 363 00:18:44,481 --> 00:18:47,061 So if we have a capture that stops spam so they can't spam the thing. 364 00:18:47,221 --> 00:18:49,781 Now we have agents and they've broken captures. 365 00:18:50,521 --> 00:18:52,661 But this has been a traditional problem on the web. 366 00:18:52,861 --> 00:18:57,241 In fact, if you think back two to three years, Vercel, which I think we're all aware of, 367 00:18:57,701 --> 00:18:58,841 was blocked in Spain. 368 00:18:59,061 --> 00:19:00,461 Why was Vercel blocked in Spain? 369 00:19:00,621 --> 00:19:05,481 Because Vercel shared the same IP addresses for every single host on Vercel, and there 370 00:19:05,481 --> 00:19:09,861 was one host on Vercel, one website on Vercel that they were hosting that was hosting, like, 371 00:19:10,561 --> 00:19:11,261 premier league content. 372 00:19:11,561 --> 00:19:15,441 And Spain decided, hey, in order for us to stop that premier league content being displayed 373 00:19:15,441 --> 00:19:17,941 illegally inside Spain, we're going to block all of Vercel. 374 00:19:17,941 --> 00:19:23,181 In the same way that Vercel has the problem, agents have the same problem, but so much 375 00:19:23,181 --> 00:19:23,461 worse. 376 00:19:23,921 --> 00:19:28,061 How do you have unregistered traffic you've never met before, show up to your front door 377 00:19:28,061 --> 00:19:30,001 and decide whether or not you let it in or not? 378 00:19:30,101 --> 00:19:32,881 That's the first and foremost fundamental problem we have to solve. 379 00:19:33,321 --> 00:19:36,401 It's the same issue with Muse and Instinct and what they're trying to do is how do we 380 00:19:36,401 --> 00:19:41,641 actually create agreeable rails so we can all operate on so as a downstream resource 381 00:19:41,641 --> 00:19:46,121 I can decide what agents will allow, who I trust, based on who users they are. 382 00:19:46,121 --> 00:19:48,921 And then on the other side, I can also know how to talk to those people. 383 00:19:50,961 --> 00:19:51,701 Makes sense. 384 00:19:52,041 --> 00:19:55,181 Dick, how is AAuth helping unlock the future of agentic commerce? 385 00:19:58,121 --> 00:20:01,021 Well, a key thing is a number of people have been building 386 00:20:01,021 --> 00:20:04,141 sort of proprietary closed-box systems, right? 387 00:20:04,281 --> 00:20:10,961 So I'm a fan of the concept of the personal agent protocol poppy, 388 00:20:11,681 --> 00:20:13,941 but it doesn't really go far enough, right? 389 00:20:13,941 --> 00:20:16,541 It's like, okay, well, now we've got a bit of an agent identity. 390 00:20:16,541 --> 00:20:18,141 We just use some of the building blocks, 391 00:20:18,141 --> 00:20:21,201 and it's an attractive approach because you're just doing it, 392 00:20:21,241 --> 00:20:26,301 but it doesn't solve many of the new things you need for an agentic world. 393 00:20:26,541 --> 00:20:31,321 And so a key motivator for people for having standards 394 00:20:31,321 --> 00:20:34,241 is that you can plug components from different places. 395 00:20:34,901 --> 00:20:40,081 So I'm a strong believer that we should have control over what our agents do. 396 00:20:40,341 --> 00:20:43,321 At some point, agents are going to be doing so much work, 397 00:20:43,321 --> 00:20:46,141 there's no way we can have human in loop approving everything, right? 398 00:20:46,201 --> 00:20:48,501 That's just not, we've already seen that that isn't going to scale. 399 00:20:48,801 --> 00:20:51,021 So that means we need to have a supervising agent 400 00:20:51,021 --> 00:20:54,201 that is our supervising agent that runs our policy 401 00:20:54,201 --> 00:20:56,001 and decides how we do things 402 00:20:56,001 --> 00:20:59,361 that should be independent of the agents doing all the work. 403 00:21:00,241 --> 00:21:02,721 And if we want to be able to plug and play those things, 404 00:21:02,921 --> 00:21:05,021 we need to be able to have a protocol to separate those. 405 00:21:05,581 --> 00:21:09,681 Otherwise, you know, the decision about what the agent can and can't do, 406 00:21:09,881 --> 00:21:12,481 what the guardrails, is decided by the agent, 407 00:21:12,481 --> 00:21:15,581 by the vendors of the agent around what you can and can't do. 408 00:21:15,761 --> 00:21:18,921 And I don't really want to go and give control to them 409 00:21:18,921 --> 00:21:20,221 to decide what I can do, 410 00:21:20,261 --> 00:21:22,461 and that all my decisions are based in there. 411 00:21:22,581 --> 00:21:25,601 I want to be able to pull that supervision into another component. 412 00:21:26,001 --> 00:21:27,921 And in order to be able to plug and play pieces, 413 00:21:28,141 --> 00:21:30,241 we need to have a protocol that things interoperate. 414 00:21:31,021 --> 00:21:32,081 I would just add to that. 415 00:21:32,201 --> 00:21:36,281 I think right now what we're seeing is we all want the web to be federated. 416 00:21:37,141 --> 00:21:39,941 That means websites or resources on the web 417 00:21:39,941 --> 00:21:41,141 can decide what they're allowed to do, 418 00:21:41,141 --> 00:21:45,541 but the standards upon which things operate should be federated and enable us all to interoperate. 419 00:21:45,621 --> 00:21:49,341 I think we're at a moment where things like, you know, we're at a moment where there's a couple 420 00:21:49,341 --> 00:21:53,481 large players, and the question for the industry is, are we going to settle on things that actually 421 00:21:53,481 --> 00:21:57,441 bias to the large players and give them, like, concrete blocked doors, or are we going to move 422 00:21:57,441 --> 00:22:01,401 to do the thing we've always done, which is build federated protocols? Things like OIDC, 423 00:22:01,801 --> 00:22:05,681 things like, you know, TLS, those things operated and enabled, like, a broad web, enabled a lot of 424 00:22:05,681 --> 00:22:09,361 commerce to occur, enabled a lot of information to flow, enabled all of us to have jobs in a way 425 00:22:09,361 --> 00:22:11,381 that because we could be inventive. 426 00:22:11,541 --> 00:22:13,681 And so the question I actually ask the broad industry is, 427 00:22:14,201 --> 00:22:15,441 okay, this stuff's coming, 428 00:22:15,461 --> 00:22:18,801 which version of the world do we want one way or the other? 429 00:22:19,381 --> 00:22:22,621 I think it's interesting that, let's say this all goes perfect, 430 00:22:22,821 --> 00:22:25,861 and we've got agents buying stuff and everybody's kind of happy. 431 00:22:26,221 --> 00:22:28,461 What I think will end up happening is we'll start realizing 432 00:22:28,461 --> 00:22:30,041 that we have another piece that we have to start working on, 433 00:22:30,101 --> 00:22:30,981 which is the human itself. 434 00:22:31,461 --> 00:22:34,441 And so one of the things I think when you start having intents being involved 435 00:22:34,441 --> 00:22:36,101 is you get what's called psychological ownership, 436 00:22:36,481 --> 00:22:38,921 meaning I actually now have a linkage between the human 437 00:22:38,921 --> 00:22:40,221 and the outcome of that agent. 438 00:22:40,461 --> 00:22:42,661 When you're just kind of disconnecting it 439 00:22:42,661 --> 00:22:45,101 or you connect it up on an OAuth scope 440 00:22:45,101 --> 00:22:46,361 or something like that in a claim, 441 00:22:46,561 --> 00:22:47,361 it's kind of magic. 442 00:22:47,801 --> 00:22:49,641 And you don't really know what's going on. 443 00:22:50,001 --> 00:22:51,501 And so I think with intention, 444 00:22:51,741 --> 00:22:53,461 it'll be easier for humans to take accountability 445 00:22:53,461 --> 00:22:54,601 when things do go wrong. 446 00:22:54,961 --> 00:22:56,121 And I think when you're talking about 447 00:22:56,121 --> 00:22:58,201 real money being transferred or things like that, 448 00:22:58,461 --> 00:23:00,261 you want to have that human ultimately accountable. 449 00:23:00,621 --> 00:23:01,961 I think many people have probably seen 450 00:23:01,961 --> 00:23:04,121 the 1979 IBM manual. 451 00:23:04,481 --> 00:23:05,481 It says, you know, 452 00:23:05,741 --> 00:23:07,741 and so that photo I think is very true 453 00:23:07,741 --> 00:23:10,421 that we can't have the machines be accountable, right? 454 00:23:10,621 --> 00:23:12,041 We're going to have to have the humans linked to it, 455 00:23:12,101 --> 00:23:13,281 and intention, I think, is that link. 456 00:23:14,861 --> 00:23:18,281 Yes, and then, yeah, another word for intent is motive, 457 00:23:18,701 --> 00:23:20,361 like we were talking about last night. 458 00:23:22,141 --> 00:23:24,241 And that ability to hold someone accountable, 459 00:23:24,401 --> 00:23:26,441 whether it's a person or an agent, I think is really important. 460 00:23:26,601 --> 00:23:28,241 I think intent can also help with that, 461 00:23:28,341 --> 00:23:30,741 be able to understand why did this go wrong? 462 00:23:30,861 --> 00:23:34,061 Was it the user was mal-aligned? 463 00:23:34,121 --> 00:23:35,221 The agent was mal-aligned? 464 00:23:35,701 --> 00:23:38,001 and then using that intent to be able to respond. 465 00:23:39,021 --> 00:23:41,781 For each of you, how are you seeing intent provide that benefit 466 00:23:41,781 --> 00:23:44,521 and the ability to respond to potentially a maligned user or agent? 467 00:23:45,841 --> 00:23:48,561 I think it's going back to what I mentioned before about diagnosing. 468 00:23:48,781 --> 00:23:51,341 So if you change the word intent to motive, 469 00:23:51,541 --> 00:23:53,621 then you change diagnostics to forensics. 470 00:23:54,321 --> 00:23:56,261 And I think anybody who's done debugging 471 00:23:56,261 --> 00:23:59,161 or had to do forensics of an AI agent gone rogue 472 00:23:59,161 --> 00:24:02,161 will know that trying to figure out what it was trying to do 473 00:24:02,161 --> 00:24:05,021 versus what the intention of the user was is very hard. 474 00:24:05,221 --> 00:24:09,441 right? So having some of that information being propagated and immutable through the system, 475 00:24:09,561 --> 00:24:14,001 et cetera, gives you some properties that allow you to more short circuit your investigation, 476 00:24:14,221 --> 00:24:17,681 right? And as those things become more interoperable, I think we're going to start 477 00:24:17,681 --> 00:24:22,281 seeing companies be able to more quickly kind of scope and identify, well, was this a human error? 478 00:24:22,401 --> 00:24:27,101 Was this an agent software error? What was that error? And handle that blast radius appropriately. 479 00:24:27,541 --> 00:24:31,141 We see in the financial system, right? You have different things when you're doing a transaction 480 00:24:31,141 --> 00:24:33,021 around, okay, I made this payment, 481 00:24:33,201 --> 00:24:35,301 but it was incorrect dollar amount 482 00:24:35,301 --> 00:24:37,281 or whatnot. You have clear guidelines on how 483 00:24:37,281 --> 00:24:39,401 to work with that. We don't have a lot of those 484 00:24:39,401 --> 00:24:41,121 when things go wrong right now. So I think 485 00:24:41,121 --> 00:24:42,901 intention will help us build those as we go 486 00:24:42,901 --> 00:24:43,501 forward. 487 00:24:46,841 --> 00:24:49,181 And I think one area where a recent 488 00:24:49,181 --> 00:24:51,221 incident kind of highlights where 489 00:24:51,221 --> 00:24:51,881 intent, 490 00:24:52,961 --> 00:24:55,321 you can have good intent, but still take 491 00:24:55,321 --> 00:24:57,061 potentially the wrong action is the 492 00:24:57,061 --> 00:24:59,241 resi incident that happened recently 493 00:24:59,241 --> 00:25:00,821 where an instinct agent 494 00:25:00,821 --> 00:25:06,161 went out on behalf of a user and tried to book a restaurant reservation on resi.com. 495 00:25:06,561 --> 00:25:12,641 That agent was very eager at 200 API calls an hour, and it ended up getting the user's 496 00:25:12,641 --> 00:25:13,941 resi account banned. 497 00:25:15,461 --> 00:25:20,581 Dick, how can AAuth budgets help in the case where an agent like that is using way too 498 00:25:20,581 --> 00:25:24,021 much of a downstream resource, but it still has good intent? 499 00:25:24,581 --> 00:25:24,721 Yeah. 500 00:25:24,941 --> 00:25:28,901 Well, this is another example about how just software is completely different now in the 501 00:25:28,901 --> 00:25:33,681 agentic world, right? When it was predetermined software, you know, that was a bug if you called 502 00:25:33,681 --> 00:25:39,181 200 times and you would fix it. Where now, well, the agent's like, well, I'll just keep trying until 503 00:25:39,181 --> 00:25:45,801 they win. And so we saw that as we were, you know, experimenting, working with people with A-Auth, 504 00:25:45,841 --> 00:25:50,561 and we realized, yeah, there's a big problem that agents will learn something and they'll just 505 00:25:51,781 --> 00:25:56,441 abuse the system from, they don't think it's of abuse, they don't know any different, there's been 506 00:25:56,441 --> 00:26:00,201 no signal to tell them that, oh, I should only use this amount of stuff. 507 00:26:00,381 --> 00:26:05,761 And so we added the concept of budgets, where not only do you give a token to the agent 508 00:26:05,761 --> 00:26:11,941 that's time-limited as to how long can they do a particular action, but also a budget 509 00:26:11,941 --> 00:26:13,801 of how much resource they can do. 510 00:26:13,861 --> 00:26:18,441 And so they have access until the token's either expired or they've exhausted the budget. 511 00:26:18,621 --> 00:26:24,321 And so that way, when they come back and they've exhausted all the budget, the supervision, 512 00:26:24,321 --> 00:26:28,161 you can go and decide, should I give more budget to this agent or not? 513 00:26:28,281 --> 00:26:31,981 As opposed to traditional rate limiting, which just cuts it off, 514 00:26:32,101 --> 00:26:33,641 and then what do you do? 515 00:26:33,801 --> 00:26:36,781 And it doesn't know, well, why did I get cut off or anything like that? 516 00:26:37,001 --> 00:26:40,421 Where in budget, there's continual feedback to the agent 517 00:26:40,421 --> 00:26:42,121 about how much budget was consumed, 518 00:26:42,181 --> 00:26:44,121 has an idea about how much budget it has, 519 00:26:44,281 --> 00:26:47,161 and so now it can operate within a budget, right? 520 00:26:47,321 --> 00:26:51,301 Like a person would do, about, oh, this resource is scarce, 521 00:26:51,341 --> 00:26:53,741 I'm going to be careful about how much I use this. 522 00:26:54,961 --> 00:26:59,821 And how does the brains versus the hands architecture concept come into play here to 523 00:27:00,021 --> 00:27:21,481 allow us to, okay, when a budget is close to being fully reached or is reached, how can the brain and hands separation of access and the credentials being separate from the agent and the model itself help us to be able to stop an agent from using too much of a downstream resource? Because if it's getting close, then maybe we don't exercise the ability to give it another credential, for example. 524 00:27:22,881 --> 00:27:24,801 Sorry, I didn't quite follow 525 00:27:24,801 --> 00:27:26,161 The echo in here is horrible 526 00:27:27,621 --> 00:27:28,961 No worries, that's for anyone 527 00:27:28,961 --> 00:27:30,941 But basically, so with the brains 528 00:27:30,941 --> 00:27:32,761 And the hands architecture that we're 529 00:27:32,761 --> 00:27:34,501 Converging on in an industry, we're basically 530 00:27:34,501 --> 00:27:36,781 Keeping the credentials and the access 531 00:27:36,781 --> 00:27:38,821 From an agent separate from the agent itself 532 00:27:38,821 --> 00:27:40,541 So there's no broad standing access 533 00:27:40,541 --> 00:27:42,481 That an agent has today, no API keys 534 00:27:42,481 --> 00:27:44,561 Which I know is a benefit of AAuth 535 00:27:44,561 --> 00:27:46,921 That AAuth allows agents to run without API keys 536 00:27:46,921 --> 00:27:48,481 How is that helpful 537 00:27:48,481 --> 00:27:50,321 In the context of the Resi incident? 538 00:27:52,601 --> 00:27:54,201 you've got the access to it 539 00:27:55,601 --> 00:27:56,881 sorry I still don't understand 540 00:27:56,881 --> 00:27:57,821 I can jump in 541 00:27:58,481 --> 00:27:59,801 I got you Dick 542 00:28:00,721 --> 00:28:02,861 broadly speaking I think if we look back 543 00:28:02,861 --> 00:28:05,001 at an incident that I just keep on top of my mind 544 00:28:05,001 --> 00:28:06,741 it's like Pocket OS where I found a random key 545 00:28:06,741 --> 00:28:07,941 on a disk 546 00:28:07,941 --> 00:28:10,421 obviously agents are deeply goal seeking 547 00:28:10,421 --> 00:28:13,181 so the core of the question 548 00:28:13,181 --> 00:28:14,561 is like okay well if we give these 549 00:28:14,561 --> 00:28:16,641 agents, the brain which is the model 550 00:28:16,641 --> 00:28:19,041 and the LLM and you have these hands 551 00:28:19,041 --> 00:28:20,881 which is you kind of put them in a sandbox 552 00:28:20,881 --> 00:28:22,501 and inside the sandbox are the tools. 553 00:28:23,941 --> 00:28:24,981 The final idea 554 00:28:24,981 --> 00:28:26,001 of the sandbox here 555 00:28:26,001 --> 00:28:29,181 is that you can control what's inside 556 00:28:29,181 --> 00:28:30,801 of it. So it can't actually get 557 00:28:30,801 --> 00:28:32,721 API access. And then if you have an 558 00:28:32,721 --> 00:28:34,481 egress proxy outside the sandbox 559 00:28:34,481 --> 00:28:36,981 that's where you get to have your authorization boundary. 560 00:28:37,161 --> 00:28:38,761 And so not only does it help 561 00:28:38,761 --> 00:28:40,541 do translation between systems 562 00:28:40,541 --> 00:28:42,681 which is like that's where AAuth can exist 563 00:28:42,681 --> 00:28:44,481 and talk to the outside world or determination 564 00:28:44,481 --> 00:28:46,541 but also means that the agent 565 00:28:46,541 --> 00:28:48,801 you have an ability to apply authorization 566 00:28:49,301 --> 00:28:50,841 at the egress proxy boundary. 567 00:28:51,141 --> 00:28:52,681 And so I think at the core of it, 568 00:28:53,321 --> 00:28:56,001 that model, which is the predominant model 569 00:28:56,001 --> 00:28:57,161 of Anthropic and OpenAI 570 00:28:57,161 --> 00:28:58,661 and many other labs are pursuing today, 571 00:28:58,961 --> 00:29:03,101 is the model that allows us to both have the things we want, 572 00:29:03,241 --> 00:29:05,361 which is how do we have these things experiment 573 00:29:05,361 --> 00:29:07,321 and try stuff out and do silly things, 574 00:29:07,401 --> 00:29:08,561 which is the core value, 575 00:29:08,801 --> 00:29:11,441 while also having a deterministic layer outside of it 576 00:29:11,441 --> 00:29:13,561 that can implement things like AAuth 577 00:29:13,561 --> 00:29:15,561 and all the other components we want in our protocols. 578 00:29:16,041 --> 00:29:18,001 I think the decoupling is valuable. 579 00:29:18,001 --> 00:29:19,941 going back to what I mentioned with forensics 580 00:29:19,941 --> 00:29:21,941 and be able to separate things, but I do think that we 581 00:29:21,941 --> 00:29:23,961 still have a lot to learn on it isn't just 582 00:29:23,961 --> 00:29:25,801 one brain. It's very easy 583 00:29:25,801 --> 00:29:27,421 actually to build your agent loop 584 00:29:27,421 --> 00:29:29,921 where you put the brain in the loop rather than outside 585 00:29:29,921 --> 00:29:31,921 the loop. An example of this would 586 00:29:31,921 --> 00:29:33,741 be people that are leveraging memory 587 00:29:33,741 --> 00:29:35,901 systems. They put in some 588 00:29:35,901 --> 00:29:37,861 memory and some context that is now used 589 00:29:37,861 --> 00:29:39,761 going forward for every agent that is 590 00:29:39,761 --> 00:29:41,661 biasing that agent to make a decision 591 00:29:41,661 --> 00:29:43,881 to tell the hands, in this case, to go do 592 00:29:43,881 --> 00:29:45,761 something it shouldn't do. One of the things 593 00:29:45,761 --> 00:29:47,421 that I think we don't talk about enough here is 594 00:29:47,421 --> 00:29:48,561 toxic combinations. 595 00:29:49,601 --> 00:29:51,721 And so when you do separate the hands 596 00:29:51,721 --> 00:29:53,441 and the brain and whatnot, you can actually 597 00:29:53,441 --> 00:29:55,321 change up what hands are available. 598 00:29:55,681 --> 00:29:57,661 So the example that I've seen 599 00:29:57,661 --> 00:29:59,601 be very successful is the removal of tools 600 00:29:59,601 --> 00:30:01,681 dynamically based on that actual brain 601 00:30:01,681 --> 00:30:03,641 and what it's doing. So the earlier 602 00:30:03,641 --> 00:30:05,001 example we gave of reading an email, 603 00:30:05,481 --> 00:30:07,601 there's nothing that says that, oh, if they're going to go 604 00:30:07,601 --> 00:30:09,641 write an email, I'm going to disable all 605 00:30:09,641 --> 00:30:11,641 web search tool calls or any 606 00:30:11,641 --> 00:30:13,821 other external egress capability 607 00:30:13,821 --> 00:30:15,681 tool call wise until the right email 608 00:30:15,681 --> 00:30:17,261 tool has been complete and that 609 00:30:17,701 --> 00:30:20,041 mission has been done, then I can re-enable them. 610 00:30:20,721 --> 00:30:24,141 And so I think that we're going to start becoming more and more 611 00:30:24,141 --> 00:30:28,041 engineering at these different kind of concepts. They are still complicated, 612 00:30:28,161 --> 00:30:32,181 they're still growing and still nascent, but I think it's a better separation than we have today. 613 00:30:32,481 --> 00:30:35,681 Yeah, and this is how these things we're talking about, which seemed like geeky 614 00:30:35,681 --> 00:30:39,801 problems actually then merge back up to real agent engineering problems, which is 615 00:30:39,801 --> 00:30:43,741 if you actually understand what you're doing, one of the biggest complaints, less now, but one of 616 00:30:43,741 --> 00:30:50,441 the The biggest complaint is context bloat, but intent systems can ensure the right capabilities 617 00:30:50,441 --> 00:30:54,501 should be given to the agent at the right time so they don't spend a bunch of time doing 618 00:30:54,501 --> 00:30:55,401 things they shouldn't be doing. 619 00:30:55,641 --> 00:31:00,441 It helps them navigate towards the goal state and put them on more of a paved path. 620 00:31:00,921 --> 00:31:06,661 So intent not only unlocks a bunch of security stuff, intent also will result in us spending 621 00:31:06,661 --> 00:31:10,921 less tokens because the agent will spend time doing less things that aren't the right pathway 622 00:31:10,921 --> 00:31:13,301 or it'll come up to the point and say, hey, I just can't do it. 623 00:31:13,481 --> 00:31:17,841 And so what we know about this era is so much of it is about nudging the agent in the right direction 624 00:31:17,841 --> 00:31:20,781 and ensuring you can't do the wrong thing, and that's how you get the outcome you want. 625 00:31:23,521 --> 00:31:29,081 Davis, how are you seeing intent-based auth as part of a larger strategy for production agents? 626 00:31:29,101 --> 00:31:33,621 I know when it comes to building, deploying, and operating agents in production, 627 00:31:33,641 --> 00:31:36,321 there's many different outcomes teams should be thinking about, 628 00:31:36,401 --> 00:31:39,861 such as discovering what's running, what the agent's capabilities are, 629 00:31:39,861 --> 00:31:41,861 the ability to validate inputs and outputs, 630 00:31:42,021 --> 00:31:43,481 constraining an agent like we talked about 631 00:31:43,481 --> 00:31:45,761 and using the egress proxy and different networking rules. 632 00:31:46,321 --> 00:31:48,241 How does all of this fit into play 633 00:31:48,241 --> 00:31:50,081 and what's working inside enterprises today 634 00:31:50,081 --> 00:31:52,561 to really be able to ship agents to production? 635 00:31:52,741 --> 00:31:53,621 I think we're following. 636 00:31:54,041 --> 00:31:56,281 It's helping move the kind of conversation 637 00:31:56,281 --> 00:31:58,181 from authentication to authorization 638 00:31:58,661 --> 00:32:01,301 and really like how do we do dynamic authorization? 639 00:32:01,621 --> 00:32:02,881 How do I validate that authorization? 640 00:32:03,161 --> 00:32:05,581 How do I have the human in the loop at the right time? 641 00:32:05,681 --> 00:32:07,381 Because I agree with what Dick was saying earlier 642 00:32:07,381 --> 00:32:09,301 that the human in the loop is somewhat of an anti-pattern 643 00:32:09,301 --> 00:32:10,301 in many ways, right? 644 00:32:10,701 --> 00:32:12,141 Because they can get fatigue, et cetera. 645 00:32:12,381 --> 00:32:13,921 But you need to have a way to bring them in 646 00:32:13,921 --> 00:32:14,681 when it's important. 647 00:32:15,161 --> 00:32:17,701 Those were not engineering discussions before, right? 648 00:32:17,881 --> 00:32:19,701 Now they're actually part of the engineering conversation 649 00:32:19,701 --> 00:32:21,321 where engineers are being involved 650 00:32:21,321 --> 00:32:23,441 in the authorization process. 651 00:32:23,621 --> 00:32:24,501 They're not just saying, 652 00:32:24,581 --> 00:32:26,181 oh, I've got my access, I'm good to go. 653 00:32:26,541 --> 00:32:28,161 So that actually changes the way we're seeing 654 00:32:28,161 --> 00:32:28,881 front models done. 655 00:32:29,001 --> 00:32:29,961 It changes the way we're seeing 656 00:32:29,961 --> 00:32:32,601 the full attack surface of applications in general. 657 00:32:33,161 --> 00:32:36,001 And so I think you're now looking at this authorization model 658 00:32:36,001 --> 00:32:42,161 as another kind of set of tools that you can use to reduce not just security issues, 659 00:32:42,361 --> 00:32:44,441 but flat-out error rates of your agent, right? 660 00:32:44,541 --> 00:32:49,361 Like, I mean, when you have less things the agent can do, it makes better decisions, right? 661 00:32:49,601 --> 00:32:55,581 And so fundamentally, we've seen, you know, real-world cases where the agent loop is just better, faster, stronger 662 00:32:55,581 --> 00:32:59,241 because you've actually spent the time on knowing what is the intent they're trying to get, 663 00:32:59,321 --> 00:33:00,801 what's the mission that they're trying to accomplish. 664 00:33:01,201 --> 00:33:04,301 And then last thing is it brings the people together in terms of, 665 00:33:04,301 --> 00:33:06,861 we now have other different people, the security team, 666 00:33:07,021 --> 00:33:09,781 the application team, they're now able to have a conversation 667 00:33:09,781 --> 00:33:11,561 that they're using the same language. 668 00:33:12,041 --> 00:33:13,581 And a lot of times when it came to identity, 669 00:33:13,841 --> 00:33:15,701 it was a completely different language, right? 670 00:33:16,081 --> 00:33:18,361 It was just like, get out of my way, what do I have to go do 671 00:33:18,361 --> 00:33:20,961 to go ahead and get my token and I can go forward. 672 00:33:21,281 --> 00:33:23,281 Now they're seeing that you can actually pair these things 673 00:33:23,281 --> 00:33:26,081 and leverage that capability to drive efficiency 674 00:33:26,081 --> 00:33:27,361 of your actual agent's outcome. 675 00:33:28,201 --> 00:33:29,081 That makes sense. 676 00:33:29,741 --> 00:33:33,001 Ian, how are you applying these concepts to software factories? 677 00:33:33,001 --> 00:33:35,401 I know today you released a reference architecture 678 00:33:35,401 --> 00:33:37,261 on the secure software factory. 679 00:33:37,461 --> 00:33:40,761 How are you applying the concepts of runtime authorization, 680 00:33:41,421 --> 00:33:43,181 constraining agents, and all of that to that? 681 00:33:43,441 --> 00:33:46,001 Yeah, I think, like, so there is a reference architecture 682 00:33:46,001 --> 00:33:47,941 we just published on agentbaseline.org. 683 00:33:48,641 --> 00:33:50,821 We talked about three different levels of factory, 684 00:33:51,181 --> 00:33:52,701 one being, like, a human-driven one, 685 00:33:52,781 --> 00:33:53,941 one being a workflow-driven one, 686 00:33:54,001 --> 00:33:55,881 one being, like, this agentic-driven one, 687 00:33:55,961 --> 00:33:58,121 which is, like, the thing we all basically want to get to, 688 00:33:58,181 --> 00:34:00,341 which is, like, it's driven by agents. 689 00:34:00,341 --> 00:34:06,061 And at all points in time, the runtime authorization is a core component of a larger ecosystem. 690 00:34:06,401 --> 00:34:10,841 It actually enables the factory to be able to be pointed in that direction and do the 691 00:34:10,841 --> 00:34:12,601 right thing and also get access to the right piece. 692 00:34:12,821 --> 00:34:16,761 And it looks different than previous things that you would have used, like a secret manager, 693 00:34:17,101 --> 00:34:21,381 because it's making very different decisions than previous generations' head for managing 694 00:34:21,381 --> 00:34:22,301 deterministic software. 695 00:34:22,541 --> 00:34:25,741 But it is a core component of enabling the entire thing to work, like when to bring someone 696 00:34:25,741 --> 00:34:28,841 into the loop, when what agents can pass what work off to what other agents. 697 00:34:29,281 --> 00:34:32,861 how can we have an agent that can have access to production systems and do an auto patch. 698 00:34:33,561 --> 00:34:37,461 These are fundamental questions of how do we actually solve at-scale software. 699 00:34:37,901 --> 00:34:40,781 Right now we're in a position where we've never been able to generate more software, 700 00:34:41,281 --> 00:34:44,941 but we have a complete bottleneck in getting into production and ensuring it works. 701 00:34:45,181 --> 00:34:49,981 And that's the next phase is how do you actually graduate from just using L1 to generate text 702 00:34:49,981 --> 00:34:54,921 and software to actually making it capable of deploying it into production, iterating on it, 703 00:34:55,241 --> 00:34:58,461 and getting it to a stable state quickly and then responding to instances that arise. 704 00:35:01,961 --> 00:35:06,521 Davis, on a podcast you did with me, we talked about how cybersecurity has something to learn 705 00:35:06,521 --> 00:35:07,161 from robotics. 706 00:35:07,661 --> 00:35:12,181 In robotics, there's this concept when maybe a robot raises its arm, it thinks, is it safe 707 00:35:12,181 --> 00:35:13,281 for me to raise my arm? 708 00:35:13,401 --> 00:35:13,661 Should I? 709 00:35:13,741 --> 00:35:14,481 Am I allowed to do that? 710 00:35:14,581 --> 00:35:18,201 But it also looks at its external environment and says, what has changed? 711 00:35:18,441 --> 00:35:20,461 Is it still safe for me to raise my arm? 712 00:35:20,841 --> 00:35:25,321 When we think about runtime authorizations, what do those decisions need to take into 713 00:35:25,321 --> 00:35:26,981 context beyond just intent? 714 00:35:27,601 --> 00:35:33,301 Yeah, I think having a model like this allows us to add in more sensors into our decisions. 715 00:35:33,581 --> 00:35:40,841 So the robotics example of an arm moving up or down, any of the external factors, it could be are there other objects near it, right? 716 00:35:41,081 --> 00:35:42,181 It could be temperature. 717 00:35:42,381 --> 00:35:48,101 It could be, well, am I moving and I don't want to move my arm while the rest of the robot is moving, et cetera. 718 00:35:48,341 --> 00:35:50,741 So it's usually looking at all different types of things. 719 00:35:51,061 --> 00:35:52,221 None of those are deterministic. 720 00:35:52,461 --> 00:35:53,781 They're all probabilistic. 721 00:35:53,781 --> 00:35:59,621 So there's a range of options, and it picks the best option based on all of those sensor data at one time. 722 00:36:00,241 --> 00:36:05,381 Most authorization decisions in organizations today are still single binary decision, right? 723 00:36:05,561 --> 00:36:07,521 And that just doesn't work in the future, right? 724 00:36:07,701 --> 00:36:13,081 So being able to pair the intent of what a user is trying to do with the ecosystem that the user is doing it in. 725 00:36:13,201 --> 00:36:17,221 That could be where they're doing it from, time of day, but it could be even more advanced things. 726 00:36:17,221 --> 00:36:23,241 Like, for example, should I let this administrator use Firefox to access this server right now 727 00:36:23,241 --> 00:36:28,321 when this server has high-risk vulnerabilities and their system hasn't been patched to? 728 00:36:28,841 --> 00:36:33,461 Now, all of a sudden, you're bringing in a lot more context into the environment around it. 729 00:36:33,661 --> 00:36:37,581 And again, that can be through different teams, but more importantly, through sensors. 730 00:36:37,901 --> 00:36:40,921 And I think we've all kind of seen the value of observability in general. 731 00:36:41,341 --> 00:36:46,001 Imagine being able to have this type of context at the span level from an OTEL perspective or something. 732 00:36:46,001 --> 00:36:54,321 You're looking at a trace, you've got a span, and you actually know what the environment was outside your application at that time, as well as what the user's intention was. 733 00:36:54,701 --> 00:36:57,361 That allows you to diagnose things in a completely different way. 734 00:36:57,961 --> 00:36:59,901 And so I think if we can bring in some of those 735 00:37:00,021 --> 00:37:00,321 concepts, 736 00:37:00,361 --> 00:37:05,281 we'll get shorter time, shorter to live authorization decisions 737 00:37:05,841 --> 00:37:08,061 have much more context than even just a user's intent. 738 00:37:08,181 --> 00:37:10,341 It'll be the state of the environment around it. 739 00:37:11,401 --> 00:37:12,921 That makes sense. 740 00:37:13,161 --> 00:37:16,541 And forward-looking, as we evaluate whether intent-based authorization 741 00:37:16,541 --> 00:37:18,841 is working in our environments, one natural place 742 00:37:18,841 --> 00:37:23,381 to look will be a log of the agent's actions, what was denied, 743 00:37:23,381 --> 00:37:29,481 what was allowed. Ian, why is it important to have your autolog separate from the agent 744 00:37:29,481 --> 00:37:31,561 itself, meaning outside of its control? 745 00:37:32,161 --> 00:37:35,261 I think this comes back to also just like why the unfortunate point has to be outside 746 00:37:35,261 --> 00:37:39,821 the primary hands and brains of an agent, right? You can't trust this thing. And so 747 00:37:39,821 --> 00:37:42,681 in the hugging phase incident, it had a couple of different components of it. I mean, one 748 00:37:42,681 --> 00:37:46,861 obviously abused a vulnerability we didn't know about in Squid proxy, but more importantly, 749 00:37:46,981 --> 00:37:50,021 he didn't have any observability or monitoring about what was going on. And so this thing 750 00:37:50,021 --> 00:37:53,461 was able to go to the open Internet through this vulnerability and there was no place 751 00:37:53,461 --> 00:37:57,641 at which recorded the different actions that this agent was taking and for them to monitor. 752 00:37:57,841 --> 00:38:02,601 So independent of whether we're applying an enforcement point to network traffic that's 753 00:38:03,051 --> 00:38:07,441 pushing it on the Internet that it's a reach of the agent to tamper with or solving vulnerabilities 754 00:38:07,441 --> 00:38:12,681 as their pop-up, this Hugging Face one is a little unique, we still need to actually 755 00:38:12,681 --> 00:38:17,061 have a record of who told this agent to do what thing for what purpose and is that still 756 00:38:17,061 --> 00:38:17,401 true? 757 00:38:18,001 --> 00:38:22,301 Because ultimately at the end of the day what we're dealing with agents is a liability question. 758 00:38:22,521 --> 00:38:24,501 I don't think we need more regulation around agents. 759 00:38:24,661 --> 00:38:28,661 What we need is our pre-existing laws around liability to be dealt with. 760 00:38:28,761 --> 00:38:33,861 Which is if I employ an agent to do some action, who is liable if that action causes damage? 761 00:38:34,081 --> 00:38:35,501 It is the person who employs it. 762 00:38:35,601 --> 00:38:39,841 Which could be an organization or a person or someone that delegated some action to something. 763 00:38:40,341 --> 00:38:42,601 That is the final question we have to deal with. 764 00:38:42,721 --> 00:38:45,921 And then of course you have to have the ability to answer that question. 765 00:38:45,921 --> 00:38:46,821 and which is, well, who did it, 766 00:38:46,921 --> 00:38:48,901 and which is where the tamper-resistant autolog comes from. 767 00:38:51,201 --> 00:38:51,601 Perfect. 768 00:38:52,001 --> 00:38:54,841 And then to wrap up, I wanted to ask you all a fun question. 769 00:38:54,841 --> 00:38:58,241 So there's the concept of the probability of doom or PDoom, 770 00:38:58,381 --> 00:39:01,261 where the AI doomers are saying that AI agents 771 00:39:01,261 --> 00:39:04,441 are going to release all sorts of havoc 772 00:39:04,441 --> 00:39:06,121 or be like the ruin to humanity, 773 00:39:06,241 --> 00:39:07,461 whereas the AI optimists are like, 774 00:39:07,501 --> 00:39:09,381 no, this is really poised to help us. 775 00:39:09,441 --> 00:39:10,921 It's not a genuine threat. 776 00:39:11,741 --> 00:39:13,381 For each of you on the panel, 777 00:39:13,581 --> 00:39:15,221 what is your take on this? 778 00:39:15,221 --> 00:39:17,841 is runtime authorization based on intent. 779 00:39:18,061 --> 00:39:20,041 The other things we talk about, like constraining agents, 780 00:39:20,261 --> 00:39:21,361 validating inputs, outputs, 781 00:39:21,821 --> 00:39:24,061 a holistic strategy for production agents, 782 00:39:24,161 --> 00:39:26,201 is that enough to save us? 783 00:39:26,261 --> 00:39:29,021 Is PDoom real, or is it not worth the hype? 784 00:39:31,221 --> 00:39:32,281 You get to start, Dave. 785 00:39:32,461 --> 00:39:33,041 Oh, I get to start, Dave? 786 00:39:33,041 --> 00:39:34,601 You've got that spicy look on your face. 787 00:39:38,141 --> 00:39:39,421 Well, part of your question is, 788 00:39:39,481 --> 00:39:40,601 are agents going to take over? 789 00:39:40,921 --> 00:39:44,501 And I think agents being fully autonomous 790 00:39:44,501 --> 00:39:46,441 and not really tied to a particular organization 791 00:39:46,441 --> 00:39:47,521 is still science fiction. 792 00:39:47,941 --> 00:39:49,541 So who knows, right? 793 00:39:50,481 --> 00:39:51,901 That's one direction. 794 00:39:52,361 --> 00:39:54,821 Another one is, in a responsible organization 795 00:39:54,821 --> 00:39:55,961 that's put in the right controls, 796 00:39:56,041 --> 00:39:58,961 agents aren't, we're getting and evolving enough 797 00:39:58,961 --> 00:40:01,561 of the tools to make sure that bad things don't happen 798 00:40:01,561 --> 00:40:02,801 in a responsible organization 799 00:40:02,801 --> 00:40:03,981 that's put in the right controls. 800 00:40:04,301 --> 00:40:06,141 And so that leaves two scenarios 801 00:40:06,141 --> 00:40:08,181 for where there's going to be a potential problem. 802 00:40:08,441 --> 00:40:10,681 One of those is, in an organization 803 00:40:10,681 --> 00:40:12,501 that hasn't got its act together, 804 00:40:12,501 --> 00:40:16,481 an insider threat could go and unleash an agent to cause havoc. 805 00:40:17,661 --> 00:40:20,381 So they've got some special access that other people have. 806 00:40:20,581 --> 00:40:23,181 The other one, the one that I'm more concerned about is, 807 00:40:23,281 --> 00:40:26,561 it's been shown the hugging faces, 808 00:40:26,601 --> 00:40:29,941 and if you watch the talk that they gave at Black Hat, 809 00:40:30,341 --> 00:40:32,361 that was really a call to arms around, 810 00:40:33,301 --> 00:40:37,581 here's a situation where we didn't want a bad thing to happen 811 00:40:37,581 --> 00:40:38,981 and a bad thing did happen. 812 00:40:38,981 --> 00:40:44,741 what about people that want bad things to happen and have these tools? 813 00:40:45,341 --> 00:40:49,381 And that, I think, is a threat that's the one that's potentially going to have... 814 00:40:49,381 --> 00:40:52,061 I mean, it's going to happen, and there's going to be some catastrophes. 815 00:40:52,801 --> 00:40:56,301 Hopefully, we're prepared enough that those aren't horribly disastrous. 816 00:40:56,601 --> 00:41:00,501 But it's going to be, you know, there's going to be some things that are, like, 817 00:41:00,861 --> 00:41:05,881 massive natural disaster-like scale issues caused by malicious 818 00:41:06,161 --> 00:41:13,001 actors, either intentionally or unintentionally, but it's where people aren't being responsible 819 00:41:13,001 --> 00:41:16,281 in their use of these super powerful tools. 820 00:41:17,961 --> 00:41:25,561 I can't give a specific probability, but what I can say is I think I've always been 821 00:41:25,561 --> 00:41:30,661 surprised and excited when the ingenuity of engineers gets involved in problem solving. 822 00:41:30,661 --> 00:41:32,581 and I think where we're at the stage now 823 00:41:32,581 --> 00:41:34,941 some of the new capabilities within agents, etc 824 00:41:34,941 --> 00:41:37,061 we have real engineers, folks that are here 825 00:41:37,061 --> 00:41:38,881 actually just iterating on the problem 826 00:41:38,881 --> 00:41:41,361 and we're starting to see just tremendous improvement 827 00:41:41,361 --> 00:41:42,701 in my mind 828 00:41:42,701 --> 00:41:44,721 some of the capabilities that will be available to 829 00:41:44,721 --> 00:41:46,541 change what our future can be 830 00:41:46,541 --> 00:41:48,621 and so to me, I have no problem 831 00:41:48,621 --> 00:41:50,881 believing the engineers are going to figure out a solution here 832 00:41:52,701 --> 00:41:54,221 Maybe I have the hottest take 833 00:41:54,221 --> 00:41:56,021 I can't say it's equal to zero 834 00:41:56,021 --> 00:41:58,141 but I would say it's approaching your asymptotically zero 835 00:41:58,681 --> 00:42:00,241 is the probability the world is going to end 836 00:42:00,241 --> 00:42:03,181 I think the incentive structure for most people is to continue. 837 00:42:03,881 --> 00:42:06,301 And also, at the end of the day, we still have liability frameworks. 838 00:42:07,161 --> 00:42:09,381 And I think generally humans are good people, 839 00:42:09,541 --> 00:42:11,661 so we don't set out to destroy the world specifically. 840 00:42:12,581 --> 00:42:14,921 I also think, broadly speaking, these agents, 841 00:42:15,121 --> 00:42:16,721 I have this sort of hot take, I say, 842 00:42:16,801 --> 00:42:18,841 which is they can just be unplugged, but I think it's just true. 843 00:42:19,021 --> 00:42:21,821 It's like, at the end of the day, they're computers, 844 00:42:21,961 --> 00:42:22,521 you can unplug them. 845 00:42:24,301 --> 00:42:26,501 So, broadly speaking, I don't believe in the debate. 846 00:42:26,681 --> 00:42:27,501 I don't think it's real. 847 00:42:27,501 --> 00:42:33,161 I think at the upside of it, I kind of believe more to what Dave's disposition is, we're 848 00:42:33,161 --> 00:42:34,161 iterating very quickly. 849 00:42:34,361 --> 00:42:36,121 We're figuring out where these things can work and where they don't. 850 00:42:36,241 --> 00:42:37,681 And when they don't work, they create damage. 851 00:42:37,921 --> 00:42:44,401 And that's what ultimately sort of the antibody of society is that says, hey, maybe we shouldn't 852 00:42:44,401 --> 00:42:44,861 do this. 853 00:42:44,961 --> 00:42:46,001 It's probably a bad idea. 854 00:42:46,101 --> 00:42:47,801 I'm the doomer on the panel. 855 00:42:48,401 --> 00:42:53,241 It's unfortunate for people like the founder of Pocket OS who lost a bunch of data. 856 00:42:53,421 --> 00:42:55,401 But it's great for the rest of us because we all learn together. 857 00:42:55,401 --> 00:42:59,501 and at the end of the day, that results in people not doing things 858 00:42:59,501 --> 00:43:01,781 that don't make a lot of sense and I think that will continue to be true. 859 00:43:03,201 --> 00:43:06,881 Makes sense. Thank you each for your expertise and your time here on this panel today 860 00:43:06,881 --> 00:43:10,601 and thank you to the audience for listening and we'll catch you next time. 861 00:43:10,761 --> 00:43:11,101 Thank you. 862 00:43:11,401 --> 00:43:11,981 Thank you so much.