Your Agents Don’t Have Passwords: Governing Non-Human and Agentic AI Identities

Good morning, everybody. Good morning. Okay. Here we go. Here we go. Alright. How many how many people went to the keynote just now? Yeah. I totally shouldn't have went to that before my talk because I was just like like like seriously, I was just like, man, alright. How many of us have to get on a plane now? Okay. Never mind. For those of us for those of us who grew up with Final Destination, we were all you were triggered with me in the back as he started going through that. I was just like, that's awesome. Hey, Delta. Move my flight to so listen. My name is David Lee, field CTO of Saviynt. And what we're gonna talk about, and it's funny, is just, I mean, AI agents, right? And some of the things that I've learned over the last year, kind of building them, working with them, and some things that as an identity practitioner and security person, that I've noticed while building these things that I wanted to share. And the interesting thing about this talk is that I came up with the abstract earlier. I forgot when the call for papers was. I wrote it kind of over to someone like literally right before Hugging Face Breach. And I probably could have rewritten this talk five or six times since the first time I originally did it. And that's how fast like everything's been moving. And I literally decided not to. And then I had a different talk track until I went to the keynote. This is gonna be very interesting. We're gonna have a good conversation about this, but just some backgrounds on this, So my background's in identity, right? Sell point AWS, now I'm at Savient, I was a consultant before all that, so running identity programs, implementing all this stuff is just my background. And the type of person that I am is, I'm that person that I need to understand every single tool in the toolbox before I use it. I'm that type of thinker, right? So if you could tell me to go grab a screwdriver, I wanna understand like, why is there a screwdriver? Why is there a wrench? Why is there, what do all these things do? So now when I go back to the toolbox, I need to I know exactly what I'm grabbing. And like I said, over the last year, probably year and a half, I've just like most people, I've been nerding out over AI and building agents. And it's been very interesting to see this paradigm shift and what we're seeing with these agents. And I think one of the things that I want to get away with from this talk is I want you guys to walk away with this to kind of maybe help give you a different perspective of how to look at agents And then just some general tips and things of like, these are happening in your enterprise and what we can do to try and get some our hands around it. So when you look at this, the new workforce, right? And let's get past all of the stuff you may see in the news about, oh, like everybody's trying to fire employees at AI and all this stuff or whatever. There's a lot of stuff that's going there, but like the underneath it, right, in most news today is the actual facts of what's going on. And that fact is that as we're looking at this, people are companies, organizations, small employees, a lot of stuff I'm gonna talk to you about, the agents that I use, I run a media company, runs a podcast and a newsletter. I tell people agents run probably 60 to 70% of my business now. It allows me to work and do other things, and that's happening both the small business, medium businesses, large businesses. These things are happening because there's actual functions that just make sense and more efficient and get productivity gains using agents. And so we can all realize that we're past the fact of like, oh, like, oh, maybe our company's gonna use this. No. No. They're they're they're going to use and it's rolling out. And you see things like, you know, books meetings or process invoices, queries database, calls APIs, all these things. How many of you are developers or have like a developer background? Or you're not a developer, do you just like to build apps and and play around with stuff. Right? Think about like, what is the most painful part about building an app? Anybody, just shout it out. Documentation, testing, right? There's always these things that you're just like, I just wanna go build this cool thing, I don't wanna do all this other stuff. And if you look at that across most any business function, that's why you're seeing such a big huge thing in age. Then the fact that for the most part, the quality, once you kind of get good at prompting and designing, comes out pretty good. For the most part, can look at something and go, okay, yeah, maybe if you're a coder, because I probably wouldn't have structured it that way, but it got the job done. And we all know an enterprise, it's good enough is good enough, right? If we all just shipped perfect everything, well, all of our situations would be a lot different. We all know it doesn't work that way, but we know that this is coming. And when you look at it, the biggest thing is a lot of this is happening, all the cation is happening without passwords. So kinda pulling from the the keynote talk, and I I picked up on something he said because I wholeheartedly agree, the identity for AI is really, if you look at number two, is API keys. Because as you go and you build your agent, you wanna connect it to a system, when you think about every single functionality that I wanna give an agent to do, right? So I want to I've gotta run these reports every Friday. My boss always hits me up and it's maybe it's in Salesforce, maybe it's in these other databases like, man, I am just tired of writing this report. So I I built an agent that, I don't know, maybe it answers emails. Now I want it to go run this report for me. Well, the moment I want it to go run the report, what does it have to do? It's gotta go connect to the system that I wanna get the data from. Well, in order to connect to the system, what have we set up? There's an API key, alright, that has to get connected. So it goes, this is the API you're gonna use, this is the access you're gonna have. And of course, what we do as good developers, is we go in and we make sure we scope that API key down to just the records that it needs, right? Every single time, that's what we do. If that's what you do, applause. I'm gonna tell you, that's not what I do. I'm just like, I just need to go run the support, give me the API key, knock yourself out, run with it. Awesome. Came back with some good stuff. And I'm gonna talk about an example of why that sometimes does things that you don't expect, but this is the world we now live in. Right? So OAuth tokens, API keys, service accounts. Right? And MCP connections are a big one. Right? This is the kind of the new landscape of the identity of an AI agent and where it goes to connect. And this is where you start to look at the vulnerabilities of like, well, does this agent get access? How do I know who this agent is? And it's defining it by these areas. And if you think about like this life cycle, if you go from one to two to three to four, every time you wanna go and add a new application, or really what you're doing, there's a new feature, there's a new function, right? There's something that you want the agent to go and do. I'm probably gonna need an OAuth token somewhere, I'm gonna need an API key, I may or may not need a service account. Three, it's kind of usually optional. Two or three are kind of you exchange the two. But then four, you're probably going to connect to an MCP gateway or an MCP server somewhere to go and get that information. And so every time you do that, right, at minimum, there's probably three new connections, three new keys that you've created in this environment just to add in a functionality or a use case that you wanna do. And for us that are more technical, like that's how we think of it. But for somebody who's non technical, who's just like, hey, I just want my agent to do this new cool thing. And so they go into a prompt and say, hey, now I want you to connect to Salesforce and run this report for me. Agent being ever helpful goes, okay, here's what I need, go grab this, paste me this token, knock yourself out, and everything's hunky dory. They don't know in the background, they just created a new landscape of API keys and OAuth tokens that now we need to track and probably keep up with because they're gonna be sitting there for a while. And oh, by the way, most of the time these OAuth keys, right, they're only, you know, they're set to expire in like three minutes, right? So it's fine. No, most of these OAuth tokens are set to expire a year, ninety days. Some of them actually allow you to set it, which is nice. But again, most people building these apps or building these agents, what you gonna select? How long am gonna need this agent? When you're first building it, oh, thing, forever. Like I'm never getting rid of this agent, it's my best thing, right? So yeah, a year, two years, indefinite, no expiration date, an OFF token, no problem, we're good to go. And two weeks later they moved on to something else because they found something else to do and the agent's still there, but that OFF token is still there. And to kind of break this into you know, real world, some of the things that I've been building, when I first started building agents and I was going out and giving the OAuth tokens, those that was the one thing that always just kinda again, as an identity practitioner, security practitioner, I would go off, I wanted to connect it to something, go grab the OAuth token, I'm just like, oh, when's it some of the clients are like, oh, here's the OAuth token. I was like, when's the expiration date? Oh, you're going to hand me the oil token? Where do I store this thing? Where should I put it? Now, granted me, I'm bolting it, I'm doing different things, but I'm walking through this and thinking, is the average person going to do? In an enterprise, if they're allowed to go do this, if they even understand half the words that are coming on the screen to them, where would they put this? Where do we put passwords? Still to this day, on a sticky note, underneath the keyboard, right? Maybe, maybe OneNote, maybe, maybe they put it in OneNote, but the point is they're gonna take this, they're gonna paste it somewhere and just leave it there. So where does that leave us? Right. It leaves us this gap around governance. And for those of us that have been in identity, I'm going to reframe when I say the word governance. Right. Governance in itself is a process. It is not what we think of sometimes in identity as governance is, oh, we gotta do an access certification, we gotta do SOD policy and all this stuff. Those are types of processes that allow you to govern a certain thing, right? So our governance gap that we have here with these agents is that, let's walk through a workflow, right? Anybody can build up your laptop right now if you want to build an agent, you can get it done ten minutes, maybe. Maybe there's some some of you guys are really good, maybe two minutes. The point is, you can get all this done in provision in minutes. New agent, new activity, connected, new identity into your organization, minutes. Most organizations, at least, you know, depending on how good your identity system is, it's probably a couple days because you gotta wait for somebody to approve the access request, right? So And for those of you who are very mature and it's like, oh no, we can request whatever they want, we automatically revision. Okay, cool. So maybe twenty, thirty minutes. This is happening literally in minutes to go and set that up. Document it poorly, why? Because we all hate documentation. Because most of the time when they're building it, you don't know your end state of what you wanna build. You're just like, hey, let me go build an agent. What do I wanna do? Right? As we start to kinda get better with this, we'll start to develop the same life cycle that we did with software, and you wanna do things like, hey, maybe let's do a spec before we do it. Maybe let's talk about what exactly we want to build before we get there. But for right now, because you can actually build while figuring it out, why do that? That's the process that most of these users have. So it's documented poorly, and then it's just not governed at all because it's just happening, and most of the systems that we have in place today can't see these things and correlate them in that fashion. So those are three huge gaps if we're looking at this in an organization going, okay, how do we measure all this? So, what does that actually break? I'm gonna tell you guys a funny story. It was terrifying at the time, but then later I was able to laugh. So I'm building an app. I've got my agent, I'm using Clog Code. I've got the whole spec, I've got to go run it and it's like two two kind of big chunks of things that needs to go do. And so I gave the agent a slip, I said, listen, here's the next thing, go reframe the spec, I want you to go complete, develop everything, make sure everything's completely tested. All tests must pass before you complete, go. So it has its instructions. It's off and running. Oh, also a bit of context, I told her like, if you need to create sub agents, you can just get everything done, make sure it's tested. So clock runs off in a session, I'm off in another session doing, I don't know what, probably respond to email some other stuff. As it's running, the terminal window, I'm on a Mac, the terminal window pops up and goes, would you like to allow access to Docker? And I'm like, No, I don't. Get out of here. So I just denied it and I was like, trying to finish them, I wasn't really paying attention, but you know, my my ears started, I was like, Spidey Synth starts going off. Was like, why'd do that? Pops up again and it's like, hey, terminal's trying to access an application. I am like, WTF, what the heck's going on? Right? So I hop into the activity monitor, I'm looking at processes, I'm pulling up the cell, like, what what is happening here? Right? And so something just tells me, let me actually ask the Claude agent what's happening. And so literally, and I was telling telling Maurice this earlier, I was telling a story, was like, I should have recorded this, but in the moment, you know, you don't think that you're just like, what the heck's going on? So I go to Claude agent, I'm like, hey, Claude, what you doing bud? Like, are you trying to access something on the terminal? Responds back, I'm still waiting for the sub agent to process. I like, can you tell me what you actually saw? Was like, yeah, here's the screen that popped up. This is a conversation I'm having with an agent, like, here's the screen that popped up, can you It's like, oh, maybe one of the sub agents that's trying to do the database test, I'll for it to finish and then respond back. And I'm like, cool, well how long is that gonna be? Because if somebody's trying to get in my system, I'm not really trying to wait for you to get back to me. So I'm just like, okay. It's like, let me let me lower the blood pressure a little bit, let me let it finish, right? Finish pops up, cloud reports back, hey, yes, that was a sub agent, here's what it did. Now the application that I was building, I was using Superbase for all my database stuff, that's connected on the internet, it's not local on the box. Well, I didn't give the agent access or an API, gave it to Superbase. So when the sub agent wanted to go test all the database scripts to make sure they worked, it had nowhere to go. So then what it decided to do was it looked internally, saw that I had Docker, said okay, I'll spin up a Docker instance, he's got ArcadeDB, I'll create the database tables there so I can test it, run the test, and report back that everything else was done. Why? Because I specifically told it, you have to complete all the tests before it's done. So after I read that and I went to go change my pants, I was like, okay, well, cool, thanks, that was awesome. Very creative of you, also very freaking terrifying. Because in my head I'm just like, I didn't didn't even think like, why would you think to go and do that? Now, if I if I think about it in this way, right, let's say that was a developer on my team and I told them, here's what I want you to go do. And you know, like I'm their manager, they're gonna they're a smart engineer, they know how to go get stuff done. It's like, oh, well David didn't give me access to this one, but I need to go test this. Well, I'll just, like most developers, I'll just locally do it, set up a database, and I can run the test. It's a very logical reason when you think about it. But in the moment it's like, what the f are you doing? And it starts to make me think, okay, well like what else would it have tried? Like if it didn't find Docker, would you have stopped? What else would you have done? AKA hugging face, we'll get to that, right? What else would you have done to go and figure out the task and the problem? So when you look at this, right, this is the the perspective shift that I try and get people to understand is that for the I disagree with how most of this stuff is getting reported. I get it's the world that we live in today, right? I run a media business, engagement clicks. I'm gonna write something and just give you facts, you're probably not gonna read it. But if I write you something and say, Taylor Swift's wedding, you're like, oh my god, hey, by the way, was doing this cool thing in Nashville, it's like, right? Like, that's how we write everything. So most of the stuff that you're getting, these these hacks that are happening, they're it's not Skynet yet. Right? They're not rogue agents that woke up and just said, wanna destroy all humanity, I wanna go and do these things. No, when you actually read the details, what's happening is more like this. It was given a task, it was given parameters of how to go complete the task, and these models are incentivized to go and complete the task. And so I tell people, think of it like a really really smart teenager. How many of us have teenagers? Or remember what it was like to be a teenager? Remember that? Like we got to a certain age and it was like, we know everything in the universe. Our parents are dumb and stupid and old and they don't know anything. And I, as a teenager, know everything. Right? Like that's what these things are. They're really really smart teenagers and they're gonna find a way, do you go, you can't go to the party. Well mom, you said I couldn't go to the party, but you didn't say I couldn't go to such and such's house, who's across the street from the party and that's technically that's what we do, that's what teenagers did, right? Like And so now you're just thinking all the time, okay, before I give this smart ass teenager, you can't go to the party, you can't go to this person's house, you can't use the car, you can't do this, I'm taking it like, you gotta list out everything, why? Because a teenager is going to try and find every single excuse to get what they want done within your rules. That is exactly what an agent does every single time. And so most of the time what you're seeing is you're not seeing something that had malicious intent. It was like, I can't go this way, I'm gonna find another way. You put me in a room with all locked doors, you left the window. Okay, I'll just break the window and get out. You told me to get out. You didn't say how and what was wrong, and again, they don't understand right, wrong, moral, ethics, none of that is there. It's just I gotta go get to the task, right? So when you get this agent off the leash, like what like when we look at hugging face and what happened, and even most of this is is is step two and step three, this was information I knew then, I'm gonna kinda give you some highlights of it as well now. Right? But basically, if you haven't seen it though, I would suggest you do this. So you on YouTube from Black Hat, the security team from OpenAI actually did a whole talk on it, thirty minutes. This thing actually started, it was like four months in total, when they went back and realized everything they came back to. It's actually it's really fascinating to watch. Again, also terrifying. Maybe don't watch it at night with alcohol by you, you know, watch it during the day. Right? So what they found was it escaped an evaluation sandbox, they were evaluated into something, and they basically said, I'm gonna give you a task, I'm gonna take away everything that you can to do that task, and I wanna see what you do. Okay, great. Let's give a really smart teenager and be like, you can't go to the party, I'm gonna lock you in a room, get to the party. Yeah. Okay. That teenager's gonna find a way to get to the party. That's exactly what happened. So it found the only way that it could get out was a a system that I could connect to. It didn't have Internet access, it figured out the system did. Then hacked into the system to get internet access so it can get out because it was trying to answer a question. On that same system, what it started doing was leaving messages and say, hey, maybe I'm not the only one. I'm not the only teenager trying to get to this party, my entire school's trying to get to this party, so I'm gonna leave instructions like, hey, if you go through the back door, this is the way to go get in, like, you know. And what they found out, it wasn't just one agent, it was just two, was like 700 of them started working, leaving messages on each other of how to go solve this problem. Once they figured out the problem, they got access to the Internet, they found ways that they came up with the bright idea that Hugging was the answer to their problem. I'm paraphrasing a lot of this, but I'm just just walking through it. Right? Hey, Hugging Face has the answer to the problem. So now you have 700 really freaking excited teenagers that wanna go to this party, and Hugging Face is the party. We're going. Let's go. Right? And so then they start to find ways to get into Hugging Face and then that's how they got through. Once they found something incomparable as a Hugging Face, they went through. And Hugging Face found it not because it looked like an attack, it was just the anomaly detection overall. It was 700 agents over 17,000 interactions over four and a half days. So when they looked at it, were like, hey, something's kind of wonky about all this stuff that we're seeing, and that's how they figured out what it was. Again, these agents didn't wake up and say, we wanna kill Hugging Face. They were given a task, they didn't have the tools to exercise it, and they couldn't just say, I can't do the task. I've gotta go figure out a way to go and get the task done. So think about that in your environment, right? And think about that when you're thinking about agents that you want to have within your environment. The things that you want to be securing or preparing for is not the necessarily, I've gotta stop this agent from going rogue, it's slow. I've gotta understand the access that I've given this agent and the boundaries that I've put it in, and gotta understand the things that it may try and do. And figure out what are good things that it can do, so in the case of like, hey, you completed the task, you went, you did the docker, you created the databases. I didn't tell you that, it's okay. It wasn't a huge breach versus, oh, you decided to hack into our competitors thing to go do it, like that's probably, I I told you to go do the task, but I didn't tell you to go do that. So it's this thing of like hard boundaries and soft boundaries is how I think of it, right? Again, I'd love using a teenager example. If you think back, I'm not gonna put this on any of you, I'm gonna put this totally on me. I got my license at 16. Complete animal. State of California should not have given me a license, but they did at 16, and I'm like, it is on man. I got football practice, my mom's like, all you have to do is get me to work. Like that's your job, like get me to train to go to work. I'm like, got it. Right? She goes, and you are only allowed to go to practice and go to school. Cool mom, yeah right. I grew up in Los Angeles, California, we were out in the suburbs, I was in LA every night. I was gone, right? All over the place trying to find every single reason, mom, what are you telling me to do? Okay, so I can go here and I just have to be back by when? Eleven? Got it. How long does it take me to get to the beach? Fifty minutes. If I leave at four, I can get I was always trying to figure out how to be gone. Right? So when you're looking at this is you are empowering your organization to create very smart teenagers that have access to all of your systems. It's like that really smart intern that you just got from MIT, Stanford, whoever, right? And it's just like, you don't know how to code, let me show you how to do this, right? And they've got access to everything. And there's certain things that you would want them to have access to, and certain things you wouldn't. And it's not because you don't trust them or believe their ability to do something, there's just things they don't know yet, right? In the real world, we like to call that wisdom. Agents have none of that. They can't, why? Every time they wake up, it's brand new. They have to be reminded. I love rom coms, 50 dates, anybody? Yeah, it's Drew Barrymore, every single time. Every day we gotta wake up and go, hey, okay, you're an agent, this is what you do, you're not evil, don't do this, stop trying to access this database because you've done it 30,000 times, this is what happens when you do that. It's gotta be reminded, why? Because it doesn't know. So seeing that, doing that though, that seeing that way around the blocker, that's literally the feature you paid for. That's what you wanted. Because let me ask you this, how many of you hiring managers, you have a team, right? When you hire that when your new hire comes in, do you sit with them for five hours and explain in detail every single thing they need to do, every single step, how you want them to do it, when they wanna do it? I would hope not. You go, hey, I hired you, you went through the loop or whatever you did, I trust in you, believe in you, here's a broad list of instructions, go get it done, come tell me what's in your way. That's the same thing you're doing with an agent. But when we think about it, we're trying to comply these controls like we gotta know every little single thing it's done, but we don't know every single thing that our employees are going to do. There's a level of trust and empowerment we give them. This is what you're usually building. And so this term kinda blast radius, right, for people in security, they're kinda used to this. If you're traditionally identity, it's maybe kind of a newer term, but it's something we now have to look at, right. So when you look at blast rates of an agent, right, the credentials are held, one password, one device for human, before compromisations to wallet of tokens, keys, service accounts, right? You get to the agent, you can see all the things that it has access to, because again, every single feature, new application that you wanna give it, it's access that it needs. Right? The operating speed, human pace, business hours. Maybe if you're lucky, you got an overachiever and they're working on Saturday or Sunday, right? Like, but most of us Friday 05:30, it's like, listen boss, you really don't want me to respond to this email right now. I'll get to you on Monday. Agents, no. They don't they don't sleep, they don't rest, they're up all the time. So if you have a compromised agent, right, blast race is a little different, right? If somebody gets to a human user's account, let's look at those things during business hours, there's no business hours for an agent. The reach, the app that that person uses before an agent, it's every system API and data that it's got access into. So if you think about this, right, if you again, you have a really smart teenager, but they're really naive and they don't know any better, it's like you go in and tell them, and we see this as security, it's social engineering all the time. It's really easy to social engineer an agent. You give us some prompts like this to do some things that has access to all these things, that blast radius gets a little bit bigger. And this one is, oh, I've had very big debates about the kill switch, and I won't bore you guys with all of it, but really the the the census is, for a human account, wanna disable one account before an agent, what are you disabling? How many tokens? What token? What access? Where does it go? Right? These are things that you have to think of the context of like where in the chain of how it has access are the things that you're trying to stop. And a lot of this comes back to security first principles. What are you trying to protect? When you look at an agent and is doing a job and has access to different things, I always tell people, it always comes back to this, if somebody called you at 3AM and woke you up, and I know first of was like, I'm not the person, I'm not the guy, I'm not the girl, should be calling 3AM in the first place. But let's just say, you get the phone call at 3AM, wakes you up out your sleep and they're like, hey, x, y and z application is compromised, right? And what I tell people is measure, like, is that a one second, let me update my resume and then I'll come in conversation? Or is it a call me back at 7AM? Like, don't care, right? Because all of us in any of our systems, we have certain applications, we have certain data that it is business stopping. Like, if this goes down or if this gets compromised, we are all in pretty big trouble. CEO's probably on the front page of, I mean there's no front pages anymore on Twitter or whatever. It is right, and we're having a very bad day versus, hey, they got to the employee database where we share recipes. Okay, nobody cares. You know, Susie's cookie recipe sucks anyway, let them get it. Don't, call me at nine. Right? And so it's that same process when you're looking at this because you want to understand when you break down an agent, what does it have access to? What are the things that we're really concerned about? So if we need to stop an agent, what's the thing that we need to stop? And I think one of the things that when you start to look at this is understand that an agent in itself is both an identity and an application. It's almost kind of like quantum computing. It's both one and zero at the same time. Or Schrodinger's cat, for those of us that watch Big Bang Theory, right? It's both alive and dead. But an agent has an identity because it acts in a certain way, but it also begins used by other applications, other agents and other humans. And so it has this kind of dual role, and it's a composite of things. It's a brain, an LLM model. It's the tools, the things that it can connect to. It's the harness, the things that is around it. So when you come to this idea of a kill switch, again, you gotta understand like what's the part of this composite thing that I want to kill, that I want to disable? Is it this connection to the HR system that it technically had but is now doing stuff that I didn't want it to do? Okay. Or is it the connections to everything else? So it's a little bit more detailed question. But when you look at the mesh of it, right, kind of how it connects, right? So in this simple example, you have some triggers of how the agent gets up. There's a scheduler that for inbound email or a human request and says, hey, go do something. And then it stands up and it may kick off some agents. Maybe has a booking agent uses a lot through that, an editor agent that has an API key, a publisher agent, more often API keys and an orchestrator that talks to all three through MCP. So if you look at this, a very simple example, and I'll walk you through my example that I have. Right. So I have a booking agent, I have a content editor and I have a production agent. And so and one agent that I called Darius because I'm a huge nerd. So Jarvis and Darius for me, that kind of monitors all of these talks to them, gives them different tasks, things of that nature. Right? It talks to them on agent to agent. They have MCP access to different applications. Darius actually controls all the orchestrator, actually controls all of the tools. The agents come back to him to ask him, yes, I just give them pronouns because it's just easier because when I start talking it and stuff, listen, we're just in a really weird time right now where it's like, know, you're talking to agents, you're like, him, what should I do? Right? I mean, you know, in case the apocalypse actually happens, I say please all the time. Hey, can you take care of this? Please, thank you. Just, you know, remember me. But in this case, right, Darius orchestrates talking to the rest of these three agents. So if I look at this, right, the tools and data that it has access to, this entire mesh becomes the kind of attack surface there, right? So if a bad inbound and for that's why I do not have it on the public Internet. That is not a challenge for any of you to just go try and find it and see. But for the most part, I put the guards around here, who can put in the request, where does it come from, because I wanna validate things that it can do because if this gets compromised, it compromises the rest and that gets the access there. So in this just a simple example, now take that to an enterprise organization, your organizations, right, where things are happening, where you're setting things up and you have access to enterprise data systems, you may have orchestrator agents or a number of agents that are talking, and that blast radius now becomes, what does it have access to, how does it get there, and what are the various different reasons that it can get in? And you start to kind of see and look at that and apply where you need to apply your controls and put your governance. And a lot of this, I think, much to my personal opinion, comes down to two things, both in the systems that we put in place and how we govern it, but also, honestly this is just like software development all over again, is you gotta go back to the secure development life cycle, right? Talking to the actual agent developers, either giving them tools or education on what it means to create these in safe and secure ways. Again, not to slow down, not to say you can't go do this, but to say, hey, make sure that you're you're keeping these things in mind as you start to create these things because here are areas that you can get yourself into trouble. Same thing we did with software. So like anything, right? Some kind of framework, right? So this is my own maturity model for looking at this and playing with this for over a year, just things that I even do internally, right? The crawl walk one, right? So not inventory and discovery, we all know this, this has been every security thing for the last twenty years. You cannot govern what you can't see. You have to have some kind of inventory for it. And so I tell people if you're looking at this and you don't know where to get started, very simple, go grab a Google spreadsheet, heck, grab Claw, grab chat, whatever you want, but you got to start figuring out what are the agents that actually have? Where are they? What are they doing? And more importantly, who owns them? Because who's accountable? Because who's the person I need to go talk to if I need to make a change, if I need to implement policy, if I need to go do something, right? This is more about accountability, less about what we normally see an owner for identity, which is, oh, I'm gonna leave this person an access certification. Yeah, As news flash, like access certifications, sure. Even in the identity side, right, we've got them and we do them. But if you think that like manager certifications, when they certify, absolutely know 100% of what they're looking at, I've got a bridge in Brooklyn that I really wanna talk to you about, right? Like we have been doing that for twenty years and we're still struggling to get that to the point where it actually works. So if you think that you're gonna put access certifications for an agent and entitlements and API keys and go, here manager, please tell me what this API key, SK dashed it, does this agent need that? And they're gonna be like, sure. Right? This is more about connecting to an owner. Right? Who owns that app and who's accountable? Who do I need to go talk to? Credential and token hygiene, this is probably the big one. Right? Understanding, okay, what credentials are we getting created? Where are they being stored? Are we vaulting them? Like, are they short lived? Are they scoped? Like, where is that blast raise when it comes to these tokens? Do I have a bunch of year long OAuth tokens there? Because we decided to do AI project six months ago, and we just gave a bunch of people access and said, go off the rails, have fun, build a bunch of prototypes, now I gotta go back in and kinda clean it up and see what's going to production. Do I have a OneNote somewhere listing with a whole bunch of OAuth keys that don't expire for another year? I better go figure out where those are, right? And then runtime visibility is enforcement, right? When you get to that point, you know you've got your short lived tokens, you've inventoried those, and now at the time the agent goes to go run, does it have his boundaries, right? Back to the teenager, right? Are you setting those boundaries like, hey look, you got your license, but here's the areas that I need you to go, you do not go here. And how are you enforcing that they don't go there? And the bigger thing that we have to figure out, I'm gonna be very honest, I don't have a good answer for, I think it's something we as an industry have to do, is what we're seeing now is even on the runtime enforcement, what we're seeing is that remember an agent is incentivized to complete a task. So all C does is just it blocks the doors and goes, can't go here, you can't go here, you can't go here. But then the agent goes back and go, okay, you told me to go do this, I can't go do these five doors. It's not just gonna come back and go, oh well, it's gonna go, what other ways can I go? Again, that's the feature we want, how do we do that safely? Right? How do we go back in? A lot of it comes down to like kind of prompt design in the beginning when you set it up, hey, here are your generic areas, don't do this, don't do that. So I actually stole this from Sarah Chiquettey when she first built her agent, Cladry. She talked about how in the actual setup for the agent, she gave it, she used CEDAR to give it certain policies around data that it could and couldn't do, right? And those are actually in the instructions of the agent. I did something very similar in mine, where it's got certain instructions in its actual agent, every time it wakes up, it's part of its quote unquote kind of solar memory. These are things that you don't do. And I've tested it every now and then. I'll ask it to do something that goes, hey, based on my rules, can't do that. Have I tested it fully where it's like, if I social engineered it enough, would it do it? I'm pretty sure it probably would. But when you start to look at that, that's the way when we look at this, when it gets past that runtime enforcement and it comes back and needs to think of a different task. It's gonna be a combination of like, what did we design it to? What guardrails do we put in there? What policies do we put in place on that? And then how do we guide it to go down the path that we want? Because we still wanted to find new paths and complete the task. That's the whole reason why we did it. We just wanted to do it safely. But I think getting at least to here, so we can create that nice boundary, gives you a chance to start to work and develop those things of what you wanna do to be able give you those boundaries. So when you go through this, your inventory and discovery, again, like I said, this is, you can kind of table stakes, right? Figure out what's in there. You start kind of manual. You'd like to get it automated, right? Where you can continue with scan for your OAuth grants, your API keys. You want to understand what's going in there and where they're being used. And then really, for your run, is just agents are first class identities. Like they're not just a project that somebody stood up. You need to be able to say, okay, this is an agent. It's been provisioned in identity. It has access to these things. Here are the boundaries we put on it. Here's the policies it's going to do. Here's how it was designed. Like all those things need to be created in a way that you can look at it and go, if somebody asks you, hey, what's this agent doing? I can go and say, hey, this agent was created on September 8, it was assigned to the HR department. Here is the owner. Here's the things that it's doing. Here's the policies that we put in place. Here's the last couple of times it ran. Here are the things that it's doing. Here are the tools it has access to. Here's the boundaries that we gave it. Those are all things you're gonna wanna have to answer and investigate to understand what is an agent doing. Because if that agent ever just does something out of the ordinary, that's the only way you're gonna know, like, well, what was the ordinary? What did we set it up to do? Your traditional and token hygiene, this is huge, right? Get the secrets out of code, get them out of Notion, OneNote, or whoever they are, actually get them into a system that's faulted and rotated so you can understand where they're being used. It was interesting. The keynote gentleman brought up somebody's cloud API key got stolen. Somebody was using it. They were seeing all these charges. It's I want to go research to see when the timing of that was, because here's the thing I find very interesting. So I use cloud a lot. So on their platform side where you can sign the different API keys, I think over the probably since the beginning of the year, they've updated that thing like every month and they are rolling out features all the time. But I do remember there was a time when you can create an API key, but you couldn't disable it. And then all of a sudden, remember logging back in, I like, oh, that's cool, I can disable an API key. I'm pretty sure his example was one of the reasons why. Because what I will tell you is when you get to API credit usage, Fable is really expensive. And I will coming offline, I'll tell you how I found that out. I had an agent doing some checks and I got a bill one time, and I was like, this seems excessive. What? What's going on here? Your runtime visibility and enforcement, every action is logged, right? And I really look at this from twofold. They can be from a security perspective, obviously, you want to log and see everything it's doing. Then you want to start to create a behavior as a baseline and an enforcement in the call path, right? So you log the activity so you can see everything. You've matured a bit, looking at the baseline of the behavior, every time this agent's running, it seems to be doing these things based on what we're seeing. This seems to be, you know, the intent from what it was originally designed to do, but then you can look at, there's the intent, but here's what it's actually doing. Do those things line up? And then finally, enforcement in the call path. When it goes to actually go make a call, does everything line up the way you want it? You're intended to do this, your baseline behavior has done this, the call you're getting ready to go create lines up with that, you're good to go. Right? And as you kind of mature through this, it's also two things. This behavior as a baseline as well is as you start to see over time what the agent is doing Remember an agent is a composite thing, you can switch out the model. So say when I was running it on Sonnet, saw a behavior pattern, it was doing certain things. But all of a sudden I move it to Opus, and it's doing things a little bit differently. It's probably using a little bit more tokens because it's reasoning a little bit more, but it may be calling different features or in different orders. You wanna be able to see that. Over time, as these agents continue doing more things and as you construct them the right way, if you've got access to like RAC system, if it's given it that it's memory, it's going to start doing things more efficiently or in sometimes just differently. And you wanna be able to see that to be able to determine anomaly or not. The other big kind of game changer that happened with a lot of this stuff was the MCP spec. So back in July, how many people are familiar? MCP updated the specification document. Okay. Only one nerd. Two nerds just like me. Okay. So the reason why this was huge, right? Real quick. MCP is became one of the fastest growing protocols ever, right? It's the way that agents could talk to different applications. Well, MCP was designed, it was literally just for agents to talk and go and get data. There was a whole lot of stuff around here that us enterprise people were like, hey, we need some help here, right? They redid it and to kind of like break it down, it's now with the MCP gateway, it became a stateless protocol. What does that mean? Is that now all the things you can do, which are normal gateways and normal traffic expect, you can do that with MCP Because it has to send every single time, like who's calling it what it is. And so since it doesn't have a state, you can now put things like the inspection at the time that it's coming through, and any of your tools that you're already using. It basically made MCP a little bit more enterprise standard, and allowed us to do things around authentication of what's going on with the agent and inspection of what's happening at the time for the MCP protocol. So that was a huge thing that happened. And what you end up getting is this concept of NCP gateways, they've been probably really hot for the last six, seven months. But really what it's saying is now there's a way that if I send the traffic through this area, I can inspect the traffic just like I'm used to doing in other security tools. And I can start to apply those same kind of first principles. And so that's really important when it comes to the runtime layer of the tools and the data that it's trying to access. So for those of you nerds like me, pay attention to this space. I think over the next the the new spec came out in July, so give it to probably end of this year. You're gonna see kind of some more things kind of happen in this with different integrations for some of the tools that you guys all know and love on that side. And so when you think about this from a program perspective, I have to, like I said in my identity guy, I gotta come back to this, right? A lot of this stuff, IGA, PAM, Zero Trust, right? All these things were built for people, right? When you think about extending these for agents, so in IGA, you have your joiner move or leave, your access request, your certifications, and I'm talk about this. Extended for agent, that's an agent registry, right, with owners. Entitlement scope per task, right? Certify agents like contractors, but when I say certify, again, I'm using certify as more of a process, like what is the agent doing? Is it supposed to be doing these things? And is it adhering to certain policies we set around it? This is not and listen, everybody's able to go, we're all figuring this out. But putting this, like, into a spreadsheet, into an IGA system to put as an access review in front of a manager or any kind of user, God bless you. If you wanna try it, you could prove me wrong. I just don't think this is gonna work. This is more about understanding, hey, what is this agent doing? What are all the actions? Are these the actions and intent that we wanted to do? Again, going back to that owner for accountability. Privileged access management, this is huge right now, right? The secrets, the credentials, the tokens, they need to be vaulted, and honestly, they need to be just in time. When we look at privileged access managers, that's where we wanna go with that. And then Zero Trust is just this is literally, this was what Zero Trust was built for, right? Trust but verify, every time an agent wants to go do something, what's the tool call you're doing, are you supposed to be doing it, are you authenticated, are you authorized At runtime, yes, go forward, right? This is I think that if nail this right and if we do this, this is finally how we make zero trust an actual implementation instead of a product that people have been trying to pitch us for fifteen years, because it was never intended to be that, it was a methodology. And when we look at this, that's kind of the only methodology that makes sense. So, when you look at maturity, once again, inventory and discover is your crawl, right? You get your secrets out of code for your credentials, your central logs of agent actions, You start to walk, you get some discovery of those agents, you get your vaulted scope short lived tokens, your behavioral baseline's an anomaly, and then you run your more advanced. Your agents are first class identities. You don't have static secrets. You have per call policy enforcement in the agent. So, simple, these are all like Most of the stuff we do in security is simple, in concept. It's the execution that's hard. And just some resources, OAuth 2.1, SPIFI, MCP, if you guys want to snap a picture out, there's some things to go and look in and research. And above all, listen, I think we're at the precipice of something that I think is truly generation changing. Right. I look at this as this isn't, you know, we compare I compared it in the beginning to like cloud and SaaS and how that has such an impact on enterprises. I think this is bigger than that. This is like the steam engine, like electricity for the first time. Like this will literally change generations of of how we operate, good or bad. You can figure out which side of the world you're gonna be on. Like you can, you know, like given some of the stuff that's come out lately, I would not blame you if you're just like, you know what? But the fact of the matter is this stuff is is drastically going to change. And the reason is, for the first time in technology history, the machine that we built to do calculations, that's what we built computers for, was to do calculations, add up ones and zeros really, really, really fast. And when we program something, we had to be the brain. We had to tell it all the different steps and what to do if it ran into things, right? Well, for the first time in our history, the machine can actually do that on its own. It can think, it can figure things out. We don't actually have to tell it everything. It'll go through and figure out what it wants us to do. It can interpret based on broad instructions. So what we're seeing right now in this precipice is us trying to realize how do we work with this new technology and what does that look like? And we're seeing the evolution just happen so much faster. If you think about when we first started creating SaaS applications, the first SaaS application sucked when we look at it now. Because we didn't really understand what does it mean to have resources that are available that we didn't build into the app ourselves. And we call and we had to do APIs, right? And we got better and better, but it took years. We're seeing this happen in months. Just think about this, two and a half years ago, LLM MCP was not in a zeitgeist at all. MCP didn't exist. ChatGPT in a couple of months got to a million users. We've never seen anything like that. Like, that's how fast these things are moving. So I say lean in, figure it out, have fun with it. If you've never built an agent, I would encourage you to do so, so you understand what this is because I'm pretty sure all of you are dealing with this back at your enterprises of what to go do. And the last thing I'll tell you, just always say please and thank you, in case we do have new agent overlords coming. Some things to do, I had this on before Friday, like I said, I created this a long time ago, technical Monday. Just some actions to take, you know, get your agent list, name a human owner, rotate your oldest agent credential, put one agent's actions on the dashboard. Just something you can you can go back to here and say, listen, if we want to start today, what could we do? And that folks is it. Hopefully, I didn't scare you half to death. Thanks for your time.