Insecure Agents is a podcast that curates the most important conversations and trends in AI security. AI engineers, CISOs, and security practitioners listen to learn how to give their agents the security they need to reach higher levels of capability and autonomy.

Allie Howe

ALLIE HOWE HOST

Allie Howe is a Member of Technical Staff at Keycard and has a background in security engineering. She is a core contributor to the OWASP Agentic Security Initiative and has spoken at AI Engineer World's Fair and AI Agent Security Summit.

𝕏 @vtahowe in /allisonhowe

© 2026 Insecure Agents Podcast / Keycard

Back to episodes
Herman Errico — Product Manager for Technical Research at Vanta
#38 Jun 22

Episode 38 · Jun 22

From Spec to Standard: How AARM Became the Conformance Bar for Agent Runtime Security, with Herman Errico (Vanta, AARM)

Herman Errico · Product Manager for Technical Research at Vanta

--:--

We sit down with Herman Errico, Product Manager for Technical Research at Vanta, to dig into AARM (Autonomous Action Runtime Management), the spec he wrote to define a new security category for agents that take real actions rather than just generate text. We get into why the action boundary is the security boundary, why the model, prompt, and orchestration layers are the wrong places to enforce it, and why a runtime needs five authorization decisions, allow, deny, modify, step-up, and defer, instead of a binary yes or no. Herman also explains why he shipped a spec instead of a product, then donated it from Vanta to the Cloud Security Alliance so the industry can compete on execution instead of marketing, and how to reason about which context an agent can actually trust.

Listen on