Sunil Agrawal: They actually looked at a zero day and they say, okay, how, what's the fastest we can actually develop a working exploit? And they could do that internally in within 25 minutes. Now looking at that number, I would say it definitely scares every CISO. However, everyone who has been in my shoe before, we know that this was going to happen. We have been preparing for this thing.

Allie Howe: How can the Aware framework help us fill those gaps?

Sunil Agrawal: I absolutely believe that within six to 12 months, there will be cases where we will feel comfortable to have agents take real time action in order to prevent any attack from spreading. We are actually using lot of those agentic AI functionality to proactively detect what are the vulnerabilities and proactively fix them. You need a kill switch so that you can revoke the permission

Allie Howe: Welcome to today's episode of the Insecure Agents podcast. I'm your host, Allie Howe, and today I have Sunil Agrawal with me today from Glean. He's the CISO at Glean, and he's been the head of security at multiple companies before and is one of the four authors on the new AWARE framework, which I'm super excited to chat with him today about. Sunil, would you like to introduce yourself?

Sunil Agrawal: Sure. Thanks Ali, for having me on your podcast. Definitely quite excited. So currently, as Ali mentioned the chief security officer at Glean. And for our folks who might not know what Glean is, you know, we started as a enterprise search company. We used to call ourselves the Google for enterprise. Then of course, when ChatGPT got launched, you know, we had our own chatbot and we became the ChatGPT for enterprises. Nowadays, of course, you know, a big focus for the company is providing an agentic platform that our customers can develop a lot of agents and make themselves and their employees 5X, 10X more productive. And so happy to talk about our AWARE framework as to how we think about security of agentic AI

Allie Howe: Amazing. Thank you so much for that. One of the things when I was reading about the AWARE framework that caught my attention was the way that the framework opens up with that research from Palo Alto Networks showing how AI-enabled attacks compress timelines dramatically. And this also like resonates with a previous podcast I did with Alex Stamos, who was telling me that AI-enabled attacks are going to cause not only just like the Fortune 500s, which in the past they don't have to worry about zero days, but really just like every company needs to worry about this now. Like AI has made attacks way more common, way more powerful, and ultimately faster.

Can you touch on that research that Palo Alto Networks did that's in that framework and what was your reaction to it when you read about it?

Sunil Agrawal: Yeah. So, you know, just for the... or your audience who might have not read the AWARE framework or that research, you know, that research talks about how the timeline for zero day exploit is fast shrinking. You know, it used to be years, you know, you can all go to the zero day clock.com, look at it, how it used to take years for any zero day to get exploited. Now, the timeline has shrunk to all the way that up to twenty-five minutes. That, you know, the, what the Unit forty-two of Palo Alto did was they actually looked at a zero day and they say, "Okay, h- what's the fastest we can actually develop a working exploit?"

And they could do that internally in within twenty-five minutes. Now, looking at that number, I would say it definitely, you know, scares every CISO. However, everyone who has been in my shoe before, you know, we know that this was going to happen. You know, we have been preparing for this thing. So my general suggestion to mo-most of my peers has been, "Hey, let's not worry about it. We knew. Now let's just go back to our fundamentals, you know, and make sure that we are taking care of all the basic security concepts that we have learned, the zero trust cards. Making sure your meantime to detection, you know, is reduced, your meantime to attribution, your meantime to resolution, all of those metrics is now become a lot more important than they ever were.

And in order to do that, you know, what you got to do is the same tooling that the bad actors have, even you have access to the same kind of tooling. That means use AI to fight all of the things that, you know, the actors are, the bad actors are bringing to the table. So that's my general message to my CISOs, do not panic. Let's go back to the fundamentals. Use AI to fight AI

Allie Howe: Yes. No, I totally agree with that. And that's something that Alex Stamos had shared with me also when I talked to him. He was saying that in order to defend against these attacks, we're going to need AI agents that can react at machine speed. We can no longer rely on just, like, human response times for these attacks. How are you deploying defensive agents into the enterprise today?

Sunil Agrawal: Yeah. So we are taking two-pronged approach. You know, first of all, you know, everyone has heard about the methods and you know how those models are really powerful. Now, of course, only a few selective companies have access to it. But we are not waiting for those models or equivalent models to be available to the attackers. What we are doing is proactively we're trying to use all those models to attack ourselves inside out. You know, so we have developed kind of our own security data lake. We have connected all our security tooling, all our application me- telemetry into our own security data lake. And then we are unleashing all the most powerful models to say, "Okay, now identify, you know, your attack trees.

What are the places that, you know, today that I could be vulnerable to?" And once we identify all the different attacks, you know, say, "Okay, now help me develop those skill chains. Help me develop, you know, what are the least number of things I need to fix today so that all those attacks that are possible today, you know, I can make sure I'm protected against those?" So the point being, we are actually using lot of those agentic AI functionality to proactively detect what are the vulnerabilities and proactively fix them And it is during that process where we were doing a lot of this agentic development that we said, "Hey, first of all, let's make sure that all the agentic AI we are developing, it itself is secure."

Okay, then they do not become an attack vector for my ecosystem. So f-fairly interesting. I would say this is almost the best time to be in the security space. Why? Because now you have tooling to proactively detect vulnerabilities, and you have the tooling, the technology available so that you can also fix those vulnerabilities at the same machine speed. So I would-- I'm almost more bullish that, hey, till now, we all used to... Every CISO would say, "Hey, I'm getting a little bit of a security through obscurity." But now you don't need to rely on that. Now you can actually have technology tell you that, hey, these are all your weak spots, and the same technology can help you that now go ahead and fix those weak spots.

So it's almost the best time because now you can truly develop a secure enterprise and have the proof that, you know, you have all the defenses in place.

Allie Howe: Yes, absolutely. No, I agree. I'm, I'm definitely bullish as well, and I've got a background in, like, both security and software engineering, and one of those parts I'm really excited about is that feedback loop between security and engineering can be much shorter or completely removed if you're going to automatically fix the vulnerabilities that are found. You don't have to have that back and forth because it's automatically fixed. Or you've got the correct tests and harnesses within your agentic harness to keep your, like, coding agent, like, respectful of whatever rules and, like, linters or design patterns that your engineering team might have set up. So it is a very exciting time in technology in general.

I definitely agree with that. And then one other question that I had is for defensive agents that might need to react at machine speed and we touched on, like, the proactive side of the agents that might be able to go and test for vulnerabilities. But what about attacks that happen in real time? Do you ever envision a world where we might be able to, like, use agents to shut down attacks by taking very highly authoritative actions like shutting down a VM, rotating credentials? Obviously, those take a lot of autonomy and trust. Do you think we'll ever get to a place where we're able to trust agents to help us in that way?

Sunil Agrawal: Yeah, to a certain extent, you know, I know we are asking the question within the security domain. Now, more and more that the way the technology is advancing, you know, the way the agents, the agent harness along with its agent looping functionality and ability to reason and introspect on the plan and self-improve, the pace at which things are improving, we are getting to a place where, you know, you will feel comfortable granting that autonomy to your agents to truly be a coworker. Now, that's the vision that Glean and the likes of Glean are working towards. Now, if I can grant that autonomy to an agent to do real work, the same thing I can absolutely apply to the security agent, correct?

That now, over a period, I've tested it enough. I have enough confidence that, okay, for certain class of attacks, you know, I am comfortable granting that autonomy. Why? Because the advantages outweigh the risk, correct? That if there is an attack going on go ahead, I granted the autonomy that you can bring down that VM. Now, if certain things really do go wrong and that VM was not supposed to be shut down, right? What's the worst case? It was not supposed to be shut down. I would say the risk for certain class of attacks, that that's an acceptable risk because all it takes is for me to bring up that VM Okay?

So I absolutely believe that within six to twelve months, there will be cases where we will feel comfortable to have agents take real-time action in order to prevent any attack from spreading.

Allie Howe: That makes sense. And what's missing that requires us to wait, like, that six months period between now and then? What's missing, and then maybe how can the AWARE framework help us fill those gaps?

Sunil Agrawal: Absolutely. So I would say the way what is missing is, of course, you know, right now, the way those agents work. You know, anyone who has deployed agents in production, they will say, you know, usually they are good ninety percent accurate. Now, we want to bump up that accuracy ninety-eight, ninety-nine percent, okay? So that we start feeling comfortable in the security world, okay? Because if you were to mistakenly shut down VM, a wrong VM, of course there could be a service impact. Right? So we need to improve that accuracy. And now... So that's one of the things. The second is, once that accuracy is there in the underlying technology, we need to identify the cases that, okay, what are the extreme cases where we feel comfortable granting the autonomy to the agent so that they can take certain remedial action without human intervention?

So those playbooks need to be defined. So I would say these two things combined is where I'm saying that, you know, in six months' timeframe, we will get there with- in terms of accuracy, and we will also have all our runbooks defined that in what subset of cases we feel comfortable to automate the remediation. Now, while doing this, exactly, you know, as you referenced, this is what was the genesis or the inspiration for the AWARE framework. That, okay, now how do I get comfortable to grant this autonomy to these agents? So the very first step, you know, being in the security domain and say, "Okay, let me threat model an agent."

And during the threat modeling, you know, we came up with this five-pronged approach that, okay, in order to make sure this agent can be granted the autonomy, what are the five pillars that we need? The first is, we need to know, you know, the intent, the identity of that agent. So that's the very first pillar. The second pillar is, should this agent be allowed to take this action within this context? So again, going back to the example, if we want that agent to shut down that VM, is that the right action that the agent is allowed to do within the context of doing real-time remediation?

The third one is, as the agent is executing, we want certain guardrails to automatically be applied. The guardrail is like, hey, protection against prompt injection, any kind of data poisoning attacks. All of that should be applied. Got to make sure that the act, that the agent is taking actions aligned with the intent, correct? If it is shutting down VM, then the agent better be a security agent. It cannot be an HR agent which is trying to shut down the VM. And those guardrails need to be applied in real time. That's the third pillar. The fourth pillar is you got to do real-time risk scoring of every action that the agent is taking.

You need to have real-time kill switch of the agent itself, correct? Because if it goes ahead and starts shutting down, you know, ten VMs in quick succession, you need to have ability to pull a kill switch on that agent. So that's the fourth pillar. And the fifth is you need to have complete ecosystem observability, everything that the agent did. You should have the ability to recreate everything that the agent did, right from the planning, the reasoning, determining what d-data did it have access to, and, you know, what actions did it take. So that's, you need to have end-to-end observability. So those are primarily the five pillars of the AWARE framework that we came up with before we felt comfortable having the security agents take, you know, autonomous actions.

Allie Howe: That makes sense. Yeah, I feel like this is a common theme I'm starting to hear more when I talk to folks about making sure that we've got sort of intent-based or goal-based authorization to understand what is the agent's mission? What is the agent supposed to be doing? And giving that context, does it make sense for it to be taking the action that it is right now? And then making those decisions at runtime, what kind of context do you have to compile to be able to make that decision, and how do you trust that that context that you've gathered is accurate?

Sunil Agrawal: Fair enough. And this is where, you know, first of all, what is the data s- what's the source of your context? Are you fetching it from the enterprise or are you fetching from the internet? Correct. If you're fetching it from the enterprise, there is certain amount of trust. Now, of course, that doesn't mean that you fully trust that data, and then you got to scan it, correct? Whatever data that you fetch, whatever the context that you're fetching, you need to always consider it in the context of the actor's intent, correct, or the agent's intent. This agent, in continuing with our example, is a security agent which is supposed to take remedial action, correct, if it detects any threats.

In that context, what is the data it is fetching? Make sure it is only fetching the most appropriate data. And if you detect, and that's where, you know, you need to have lot of, I would say, data governance or your DLP functionality, which is in real time trying to align. This is not your DLP of the past where you're just looking for PII or PCI. What you're looking for is, is the agent's intent. Is this content Or this context helping with the a-agent's intent. If not, then we eliminate that piece of data. And then every action that is taken will be influenced both by the agent's intent and by the context it fetched.

Being able to determine both those things and then decide, is this action being attempted by the agent? Is it in line with the overall intent? Is it a security agent? And all the context that it fetched. Okay, it fetched the information about VMs or making changes to web application firewalls. That seems to be the right context fed into the agent, and hence the action it is taking is aligned. Versus if it was fetching and trying to shut down a Kubernetes pod which is three layers behind a firewall, that's not the right context that the agent should be acting on. So it is, I would say, there's three pillars that we have to always look at.

Data is the lifeblood of that agent.

Allie Howe: Absolutely. Yeah, I definitely agree. That makes sense. It's really interesting to see how data gets richer over time for agents. I'm wondering, like, what's your take on agent identity, for example? 'Cause I've talked to some other folks on the podcast, including, like, Dick Hardt, who is the founder of Aauth, a new identity or authorization protocol for agents which will allow agents to sort of have like a cryptographic identity that will be able to be seen, like, on JWT tokens. Versus, like, in the past, maybe just it was the agent's name that was in, like, an act claim, for example, that said this agent delegated this action to agent B.

But now we can have a cryptographic signature that says, "Okay, like, this is agent A, and agent A did this... sent this task over to agent B, and that's exactly who agent B is." Using this, like, richer context, we'll hopefully be able to come up with different or, like, more s- like stronger reasoning for, like, what agents should be allowed to do or more confidently be able to make these decisions. This aligns with layer one that's in the aware framework around identity and dynamic authorization, and the framework says, in that paper, it says that AI agents can't share credentials like scripts or cron jobs anymore.

Every agent needs a scoped identity, like a microservice or a user meaning a unique profile, permissions, and ownership metadata, with the goal being that every agent is traceable and governable from the start. From your perspective, why is that important?

Sunil Agrawal: Yeah. So, you know, you mentioned two things, very important. You know, when we say agent identity, it is more than the identity. Minting agent identity, that's the easy piece. The second... The two difficult parts are granting the agent the right authorization, and that authorization is no longer static. That authorization depends upon two things. First of all, what's the overall intent of that agent? That determines, you know, what is the superset of authorization grants that that agent will have. And the second is what is the task being performed by that agent at that point? And so now from that superset of authorization, you need to identify just in time these are the scopes that I want to assign to this agent identity.

So I would say when we do talk about agent identity, the true identity is not the interesting part. The actual dynamic authorization, runtime authorization, and the least privileged authorization which is short-lived, that's the more interesting challenge. Now, this is something that no single company can solve. So this is something where what we got to do is we got to work with identity providers. We got to work with all the different service providers. We got to work with the agentic platforms like Glean. All of them need to come together so that all this vision of dynamic authorization, task-based authorization, just-in-time authorization can be done. Now, again, those concepts we have solved it before.

However, when we solved it before, they were more within a very contained system. Here, w- because the agents are, is interacting with 10 different service providers at any point, you know, fetching information from Salesforce, from Zendesk, processing it, sending it via Slack, sending it via email. So the N number of systems being interacted by that agent at any point. So we need to make sure that we have agreement with all the SaaS providers so that this dynamic authorization, intent-based authorization, just-in-time authorization can be done. So that's the interesting challenge that the industry needs to solve.

Allie Howe: That makes sense. Yeah. So it would definitely take the entire industry, maybe new protocols, maybe new products, all of that. For your customers today do they have certain challenges with security and governance? Or which part of this framework do you think that they struggle with the most?

Sunil Agrawal: I would say right now, the way the agent identity I, I painted the vision as to where we want the industry to move, right now they're all starting with the basics. They're saying, "Okay, let the agent inherit the identity of the human who's executing that agent." And that works okay, you know, because everyone wants to try out those agents, want to run it in production. They don't want to reinvent that IAM stack. So that's how they're starting, which is perfectly fine. The agent having the right work context, again, that is kind of solved by the Gleans of the world and the various other RAG systems out there.

Now, runtime guardrails is again something that, you know, there are a lot of security industry out there in our Palo Alto network and many other security vendors who have some runtime guardrails available And the same, I would say, is doing some little bit of a real-time risk profiling. That is a little bit of a work in progress, I would say. But agent observability, the last part of AWARE, the E part of the AWARE, now that is something, you know, the industry is just starting. You know, can you trace everything that the agent did right from the beginning to, you know, what was the original prompt, the instruction?

What skills did it have access to? What models were used? What reasoning did it do? What plan did it come up with? What was the iterations, what are the various iterations it went through? Which tools did it decide to invoke? What data did it use to invoke what tools? What is the impact of that tool invocation? That end-to-end traceability so that you can recreate what did the agent do, and was it always aligned. That is, I would say, ch- little bit of a work in progress in the industry.

Allie Howe: Yes, I feel like, yeah, that observability is key and probably also to revoke agents if needed, revoke credentials to be able to quickly shut down an agent. I know I was involved in helping write the OWASP Agentic Top 10, and when I asked CISOs, like, which of those top ten, like, keeps them up at night the most? They always say the last one, which is rogue agents and being able to identify and then shut down an agent that maybe has become misaligned or is working incorrectly. Does that resonate with you? And then could the AWARE framework help with that also?

Sunil Agrawal: Absolutely. And I would say there's, you know, that all goes back to, you know, having a very good observability. Because, you know, the very first thing, before you can detect whether the agent has gone r-rogue, what you need is visibility into everything that the agent is doing. So it all They actually looked at a zero day and they say, okay, how, what's the fastest we can actually develop a working exploit? And they could do that internally in within 25 minutes. Now looking at that number, I would say it definitely scares every CISO. However, everyone who has been in my shoe before, we know that this was going to happen.

We have been preparing for this thing.

Allie Howe: How can the Aware framework help us fill those gaps?

Sunil Agrawal: I absolutely believe that within six to 12 months, there will be cases where we will feel comfortable to have agents take real time action in order to prevent any attack from spreading. We are actually using lot of those agentic AI functionality to proactively detect what are the vulnerabilities and proactively fix them. You need a kill switch so that you can revoke the permission They actually looked at a zero day and they say, okay, how, what's the fastest we can actually develop a working exploit? And they could do that internally in within 25 minutes. Now looking at that number, I would say it definitely scares every CISO.

However, everyone who has been in my shoe before, we know that this was going to happen. We have been preparing for this thing.

Allie Howe: How can the Aware framework help us fill those gaps?

Sunil Agrawal: I absolutely believe that within six to 12 months, there will be cases where we will feel comfortable to have agents take real time action in order to prevent any attack from spreading. We are actually using lot of those agentic AI functionality to proactively detect what are the vulnerabilities and proactively fix them. You need a kill switch so that you can revoke the permission starts with observability, having a detailed observability. And then once you have that, are you able to do runtime risk detection? So the E part, observability, you know, the ecosystem observability, not just, you know, within a silo. The second part is the R, the real-time risk detection.

Once you are able to do real-time risk detection, now comes the mitigation. And absolutely, you need a kill switch so that you can revoke the permission, and that goes back to the agent identity piece. So the AWARE framework, the different pillars are absolutely meant for this exact use case, right? That how can you actually detect that an agent has gone rogue? And if it has gone rogue, how can you actually make sure that you have the kill switch available?

Allie Howe: Amazing. Yeah, that makes sense. Yeah, it's really interesting to hear how all of the different parts of the Aware framework all kind of play together, and they're all very important to, like, reach the end goal of being able to govern and revoke access to agents and credentials appropriately. Another part where I think the Aware framework probably really shines is multi-agent workflows and, and delegation chains. Which I feel like today most agents now are inherently multi-agent, whether you create them to be or not. Because wherever you deploy them, they might run into other agents. If your agent's deployed in Slack, for example, it might find a Linear agent or a GitHub agent.

How do you use the Aware framework to help with that case where maybe Agent A delegates something to Agent B, but we don't want, you know, Agent A's, all of Agent A's permissions to go to Agent B. So if Agent B is like a Snowflake agent, for example, and Agent A was like a software engineering agent, you might not want all of Agent A's permissions just to go to be able to use like Snowflake for Agent B, for example.

Sunil Agrawal: Yeah. So again, it-- the Aware framework in itself encompasses all of that, you know, the multi-platform agent execution, where, you know, the agents need to have their own identity. You always need to know who is executing, correct? And now this identity needs to span multiple platforms. You know, right now we are all in the phase where, you know, I can mint a new identity, but that identity is only, you know, available within a particular agent ecosystem. Now that's the, I would say that needs to be expanded, correct? Because that identity should not be limited to a given agent platform or agent runtime, but needs to be a neutral one.

And also working with an identity provider like the Octas, like the Antras, is the right solution. Because then that identity can span multiple agentic platforms, and all of them integrate with a standard one. So that is, again, part of the Aware framework. The other part is, you know, I cannot stress enough about the ecosystem observability, correct? Very consciously we said that, okay, the observability does not need to be just limited to a single agentic runtime It has to be the ecosystem. That means everything that happened ar-around. Agents are like humans, correct? They interact with N number of systems, and we need to have the observability across all the systems.

And including when that agent is delegating that work to another agent, that observability needs to be across the entire ecosystem. So again, the E part. Now, all the runtime controls, the agent alignment, now that can be limited to a single agentic runtime, correct? That, okay, this agent's r- intent is XYZ, and this is what the alignment checks need to happen. So that can be localized. So certain aspects of the AWARE framework are cross-platform by nature. Certain components are local to a Kubernetes agent.

Allie Howe: That makes sense. And I was also wondering, since Glean is an agentic platform, does Glean help any of your customers provide any of the parts of the framework?

Sunil Agrawal: Absolutely. I mean, on each aspect, you know, we are making a lot of work making a lot of progress. At the same time, we are also working with the ecosystem because we want to make sure that this is not something that just Glean and limited to the Glean platform. We have solution for each one of the five pillars that I talked about, correct? Agent identity, the work context. Work context is where, you know, we started as a company, so we're very strong in there. Runtime security runtime guardrails is again, something as part of Protect Plus is available as part of the platform. Doing, you know, real-time risk detection, mitigation, making sure every action executed by the agents running on Glean platform is aligned.

Again, something that's been built into our platform. Observability is something we have native. At the same time, we are working with many of the other agent observability platforms out there, so, and making sure that we are compatible. So in all of this, the approach that we are taking is we try to provide all the functionality as part of a platform. But if a customer wants to replace any component with something that they prefer, then we are absolutely happy to work with the customer and replace any of the component of the AWARE framework with their preferred choice.

Allie Howe: Very cool. Yeah, that's really helpful. One theme that I keep hearing also is this concept of, like, the AI shared security model, kinda like how cloud has its own shared security model, and it's really interesting to see vendors sort of take the stance of really trying to help customers as much as they can with the security posture of their agents. And I know, like specific incidents recently, like the Railway incident, a developer seemed to sort of like blame a vendor for, like, the vendor allowing an agent to use an overscoped credential to go and drop a database which they weren't expecting that functionality to take place.

But, you know, developers also need to take some responsibility for what their agents are doing. What does the shared security model look like for AI, in your opinion, and how do developers and vendors work together to make that happen?

Sunil Agrawal: Yeah, and I guess this is, you know, you rightfully called it out that this is a shared security model. Now, if you look at, again, go back to if you go to threat model an AI agent, you would say, "Okay, what are the various components?" You know, you got to make sure that, you know, you are assigning the agent the identity with the least privileges. Now, the platform, the agentic runtime likely can inform that, okay, this is the intent. These are the various permissions that this a-agent would need. Now, granting the least privilege would be a customer's responsibility, right? Because they have to assign, they have to go create that identity in their identity provider.

They have to grant it the right permissions in Salesforce, in Zendesk, in Jira, and so on. So that is kind of one part of the shared responsibility, right? Assigning the least privilege. The second thing is what's the data that this agent would have access to? Now, again, the tool the agentic runtime can make sure that it is only pulling the relevant information, but the customer, whoever is developing that agent, can actually implement even stronger controls. They say, "Hey, I want you to access only documents in this folder or only this ten PDFs." Now That would be even a stronger control, correct? That they have been vetted out and they are the right documents for this purpose, and only provide that do-- those documents.

That's again, second part of the shared responsibility. Then similarly, you know, making sure that those runtime checks can be done, those alignment checks can be done. In order to do those alignment checks, what you got to have is an agent that's completely specified. If you give it a one-line agent and leave out many details, you can't really do alignment check because you don't know whether a particular action is aligned with the intent of that agent. So developing a completely specced out agent would again be a shared responsibility. That would be customer's responsibility. Once they would do that, then the agent alignment checks can be done well.

Similarly, the ecosystem observability is, again, all the frameworks are there, all the tooling is there, but they got to make sure that the logs, the observability from all the N number of systems that this agent is connected to is all flowing in into a central place so that the runtime threat detection can be done So I would say, again, it all goes back to threat model the agent. The AWARE framework gives you a way to threat model it, and then for each of those pillars, there is a shared responsibility.

Allie Howe: That makes sense. Yeah, that's really great advice. Yeah, I feel like when I we-read through the AWARE framework, it seemed very, like, hands-on and very, like, approachable, especially for someone that doesn't have maybe an AI security background. I thought it was very well-written and concise and very consumable. So I think developers could definitely, like, jump in there and get started with, like, threat modeling, even if they haven't, like, done that before for agents.

Sunil Agrawal: No, glad to hear that.

Allie Howe: Yeah. Amazing. Looking ahead, what's next for the AWARE framework? Do you think anything is, like, potentially, like, missing, or are you looking to add anything in the next six months, or do you feel like it's working well as is, and maybe you'll, like, wait and see?

Sunil Agrawal: Yeah. So I think one of the issu-- things that you had already brought up, you know. So currently, when we started this work about a year back, the focus was, you know, let's help our customers too so that they can develop an agent securely, they can reason about it, but more focused on a single agent different time. Now, there are certain components which are applicable in the cross-platform. Now, those need to be developed more. We need to, I would imagine that whenever we do work on the age AWARE V2, on a second version, that would be a little bit, again, more prescriptive. What should be the identity of an agent, and how should that identity be?

And not just identity, the associated authorization, the associated scopes that can travel along with that agent once it, the agent passes the control to another agent on a different runtime. Because everybody needs to talk the same language. And then when everybody is f-once talking the same language in terms of identity and authorization and scopes, the next thing is, you know, creating a provenance for an agent. We have SBOMs for software. What-- We need to create the equivalent of an SBOM for agent. An agent is actually made up of the prompts, the workflow, the instruction, the skills available to it, the MCP servers available to it, the tools available to it, the models being used.

All of that we need to create a SBOM for agent. That would be another thing that I anticipate that we could be working on. One of the, another one that you mentioned is the kill switch for agents. Now, more and more, the agents are running for hours, in some case, days. At any point, if you detect that there is the agent is going off the card rail, you need to have the ability that you can kill that agent in mid-execution Now that one is easier said than done because it could be, you know, doing N number of things, and it's not calling back home to say, "Should I continue?

Should I continue?" But still, you need to be able to shut down that agent. And how do you do that? Do you just revoke the permissions of the agentic identity, or are there other mechanisms you have in place? That needs to be fleshed out. So there are multiple areas that we can take this thing a-as Aware V2 as the reality of a cross-platform agentic r-runtime becomes more of a reality.

Allie Howe: Yes, absolutely. Yeah, so we are really interested to follow along and see what happens with V2 and follow your work as well. It's really great to chat with you and hear your perspective on how you're seeing agentic challenges, both like Glean and your customer base as well, and really cool that you created a framework from all of those learnings for the community to benefit from. Is there anything else that you're excited about that's upcoming or anything else that you'd like to leave our audience with?

Sunil Agrawal: No, I guess I would say, you know, I'm very bullish, you know, as to all the potential of agentic AI. You know, this is a great technology that has lots of benefits. Of course, there will be certain bad actors who will use it for nefarious purposes, but nothing to be concerned about. You know, the same technology can help us get to that stage where we can all deploy it in a secure, governable manner.

Allie Howe: Absolutely. Yes, it's, it's not all doom and gloom, for sure. We can definitely use AI to our, our advantages, and I'm super excited to hopefully, yeah, use the Aware framework to help us build agents that can help us out with some of these things. So super exciting. Thank you so much for your time, Sunil, and we'll continue to follow your work.

Sunil Agrawal: Thank you.

Allie Howe: All right. Thank you.