Insecure Agents — Episode 63: Josh Woodruff, Co-Chair, Zero Trust Working Group at CSA and Founder & CEO of Massive Scale AI
Podcast: https://insecureagents.com
Transcript (auto-generated, lightly edited for clarity).

Allie Howe: Alright, welcome to another episode of the Insecure Agents Podcast. I'm your host, Allie Howe, and today I'm super excited to be here today with Josh Woodruff. He is the co-chair of the Zero Trust Working Group at CSA, and he's also the founder and CEO at Massive Scale AI. He also helped create the agentic trust framework, Zero Trust Governance for AI agents. We're gonna talk to Josh today about how we can govern agents and how that's really the unlock in our adoption of agents and helping us to be able to. roll those out faster, be able to give them more autonomy and get our more ROA back from our agents.

So Josh, would you like to introduce yourself?

Josh Woodruff: Great. Yes. Thank you, Allie. Such a pleasure to be here. Appreciate you having me on the show. you've already said a lot. so I'll keep it short. I really my whole world today is focused on helping leaders say yes to AI agents and keeping the power to stop them. as you mentioned, I wrote the Agentic Trust Framework, which is zero trust for AI agents. It's I donated it to CSA's AI Foundation, their nonprofit CSAI, as it's called, so anyone can use it for free, fully open source. And through my company, Massivescale.ai, I teach security teams hands-on and help companies get agents into production without losing control.

Allie Howe: Amazing. Very cool. Tell us more about the Agentic Trust Framework. How long ago did you create it?

Josh Woodruff: Yeah, I originally published it in a book I published last September of twenty five. It was a book called Agentic AI plus Zero Trust, a guide for business leaders. And it was jargon-free, no buzzwords. I was a little frustrated with every article of guidance coming out for AI or agentic, which was very low at the time, or even Zero Trust was, go read this archive paper and like sort through the gobbledygook and buzzwords and jargon that all of us know in engineering and security. But I felt bad for the business leaders. I work with a lot of CISOs, CTOs, CEOs, and they're just like, I don't know what how like I have to trust my engineers.

So when I wrote the book, it was to really break down what zero trust is, what agentic AI is, because not a lot of people knew in middle of 2025. Some did. So what they are, why it's a match made in heaven. And in that book, I introduced the agentic trust framework, which I can talk about. It's really zero trust for AI agents. Since then, as the co-chair of the Zero Trust Working Group for Cloud Security Alliance, I published this framework through a blog in February of 2026, this year, and got a lot of traction. So it seemed like it was meeting a market need.

And that's when I donated it to CSA and CSAI specifically. But it's really it's zero trust for AI agents. And the easiest way to see it is to treat every AI agent as a new employee, right? As a digital colleague or a digital coworker. So, like a new hire goes on the roster and gets a badge. They start as an intern and they earn more freedom as they prove themselves through demonstrated reliability. one manager should answer for them. ATF writes that down as five questions that you have to be able to answer about every AI agent. These may seem silly and they're simple on purpose.

The five questions is is who are you? Who were your agents? So who are you? What are you doing? what are you eating or what are you serving? Is data input, data output, data governance? What data flows through you? Where can you go? And what if you go, rogue? And then in addition to the five questions, it gives the four levels an agent moves through, four autonomy levels. It's an autonomy progression ladder. Intern, you get promoted to junior, then you get promoted to senior, and then promoted to principal. And the demotion is instant if they do anything bad.

Allie Howe: Yeah, that makes a lot of sense. it just feels like directionally similar to some of the concepts outlined in agent baseline. It's a reference architecture for production agents, building them, deploying them and operating them. and this was created by like KeyCard, Docker, Sneak, and then a few other companies as well have contributed. It's like totally vendor neutral, but we got like the as many people as we could like from the community involved to create just like a practical like roadmap for like what are the six outcomes we thought like teams should work towards when building production agents and we called out you know you should be able to discover what's running you should know what their capabilities are and then you should be able to like dis constrain the agents validate their inputs and outputs so a lot of similarities here but yeah the best work I feel like comes in security when like a bunch of people in the community get together and create something like this.

I think this is really, really valuable. Can you tell us more about the behavior piece of like, hey, like you if you're able to discover what's running or you know what's there, which is the who are you, which is like probably the identity piece, if you have that, what is the identity piece and knowing who an agent is, what does that allow you to do next?

Josh Woodruff: Yeah, it's a great question. And I completely agree. I think it's very similar to agent baseline. And I keep coming across this through a number of efforts that we're all out doing individually, especially within the security space, of finding ways to secure and govern the use of AI in our own way. And then we all get together and we're talking about the same things, just slightly different language. And agent baseline's a really good example. they fit together perfectly. I know with agent baseline it's got the outcomes and the controls. and I think it's just such a great signal, as you said, of convergence, right? so as far as behavior, it's really, you know, behavioral monitoring is establishing a norm and identifying anomalies, right?

At its simplest form. Are you doing something that you should be doing, or have you run off the rails and done something horrible? because they will run off the rails and do something horrible. We have to design for this. It's a feature, not a bug. it's unpredictable. So, behavior, the reason why the identity is that the who are you and the identity of an AI agent, or as a lot of my customers will call to be more generic, an AI use case should have its own identity. Is that identity is gonna look different than a human. The behavior is gonna be significantly different. It's gonna chain together API or tool calls. like a thousand at a time and it's gonna do things that will completely throw off any behavioral monitoring or anomaly detection that you have for your humans.

So when they run as a human, or they run under the human's identity, all of your anomaly detection and behavioral baselines get thrown in the garbage 'cause it's doing something totally wild and your kill switch is to disable the human. And that's a work stoppage issue, right? So i it's different behavior. you have to establish the And it the behavior is different per AI use case. So you need individual identities for each AI use case to establish individual behavioral baselines. And then the anomaly detection will only work after you've got those baselines. And then when they when the anomaly happens and you need to kill it, you just want to kill that one single use case.

You don't want to have a work stoppage issue. You want to have a business process, you know, a disaster recovery event of hey, how do we do this before AI? It's time to do that for a minute while we disable this AI use case and see why it went off the rails.

Allie Howe: Absolutely. Yes, no, for sure. Having that stable identity across you know, different clouds, different resources, different legacy systems, super important because the S that gives you the ability to enforce controls on that agent wherever it is. how do you see teams enforcing this today? I know like when we talk to like certain like enterprises or I have like on the podcast, they'll talk about the interoperability problem of okay, I've got an agent, but then that agent might talk to MCP. servers deployed on render or fly or Brussel and I'm like on different or just deployed loc on different clouds that we own or we operate over or different legacy systems.

And the data that it's touching is from so many different resources. And I know in a later question you talked about the data governance piece of like, okay, like what are you eating, what are you serving kind of a thing? What's that agent consuming? How do you, how are teams like using that identity or struggling to access data across all these different interoperability points and then like having that delegation hop, like using that stable identity, be able to trace back and look at, okay, I was able to, you know, access this data and then like on behalf of this user or this agent go fetch maybe more data? is that audit trail something like most teams have today, or is that something that's like still kind of a gap for most people?

Josh Woodruff: It's such a great question. I think inventory is still an unsolved problem, right? Do we know what all is out there before AI? And the answer is typically no, right? Our inventory, no matter how much we try to follow ITSM and CMDBs and you know change control, it's hard, right? It's hard to keep up with inventory and knowing what you have. And AI is moving so quickly and has made it so easy that Trying to keep track of all the different AI use cases across your organization is is even harder. And the other thing is is how good have we been with access reviews? I think a lot of the regulatory compliance bodies have forced us to get better at IGA or, you know, the life cycle of a human, the onboarding and the joiner and the mover and the lever, and we manage the life cycle of a human through systems and we do monthly or maybe quarterly reviews.

All of that we kind of good at. How good are we at doing that for non-human identities? We're typically not great from what I find, right? There's the this is new. it's a shared service account we've used for 20 years. Nobody dares change the password because we have no idea what's going to break. And that's the perfect thing we'll use for our AI use case because it's easy and I don't need security in my way to turn this on, right? So these are the conditions managing the lifecycle of non human identities becomes an important thing. But I always start I just start with a spreadsheet.

Like and one rule. If the row is not on a spreadsheet, it doesn't get a badge. And when I say badge, this is the identity. So I would say to get started, you need five things. the first is is is a roster. It's a lift, it's a list, right? Of every agent. it a registry in technical terms or in vendor products. You need the badge, which is each agent gets its own ID. We call this identity. Different vendors saw this different ways. The checkpoint is the every action passes through a checkpoint, typically with a gateway. The label you need to know which data is sensitive so that the checkpoint can guard it.

This data classification And you need a record, right? You need observability. Everything passes through the checkpoint. You get observability that kind of falls out of that. So you build the first three, you build the roster, you build the badge, you build the checkpoint. And then the label and data classification is something that you need to do as well. And some companies have already started on a data governance journey. And the ones that haven't, they're very It's interesting. We run into these clients that think they need to solve world hunger and data governance before they can use AI or the other end of the spectrum. They're everybody's using AI and they have no data governance in place.

Once you get the spreadsheet, just let's find out what you have. Start with a spreadsheet, no row, no badge. every agent needs a badge or a credential to take action. So if you Immediately say my identity provider is going to give a token for each of these new AI agent identities, but it will only give a token if it's on the spreadsheet. Now you've got a forcing function and you don't want to block on day one. But I always say just start the spreadsheet, come up with these five things. I heard an episode you did recently with a shift from pets versus cattle. And I love that episode. and that shift is why the roster comes first.

Like one personal agent fits in your head, but a company's worth of them doesn't.

Allie Howe: Absolutely. Yes. No, I'm glad you like that episode. That resonated a lot with me as well, that analogy of like, okay, like everyone's kinda got their artisanal open claw or pet agent, and now we're moving to this shift, or people are hoping to move to the shift with agents as cattle where they can be spun up, spun down. one person's winter one person's like use of this agent could be used to improve the agent such that someone else in the company could pick up that session or talk to that agent as well. but that's really only possible if we have governance over our AI agents, like you were saying.

Saying, be able to have full confidence that it's only gonna have the access needed for the task at hand. It's gonna expire also when the task is done, and it's gonna be able to interface with multiple users. Such if you think of like an agent in a Slack channel, for example, talking to so many different folks that I might have different purviews and different access, different points of data, and you don't want that agent, even though it's in that Slack channel with a bunch of different users, to always use one person's permissions or just always act as itself, it should only disclose. the information that the user is asking for that based or based on that user's like actual permissions.

And that's possible when we are able to track that user's identity and be able to say, okay, this agent's working on behalf of this user. And therefore it should be able to act as Ali or whoever when accessing Notion or accessing like different data sources. Is this something teams have like a good handle on today or does this feel like a challenge as well?

Josh Woodruff: It's it is a challenge. I think it does it comes back to these managing non human identities and the life cycle of those. but getting into the habit of always assigning a sponsor or it's acting on behalf of what human and making sure when you build the roster, if you will, and that roster needs to get a badge to go do something. it doesn't get the badge. It does not get the credential unless it's in the roster, and it's told you what the tool scope is and who the human is. So it's got required pieces of data. that's the forcing function. It's a build though.

It's usually a build. A lot of folks aren't there. Microsoft's trying to solve this with their E7 life, their agent 365. That's their version of a registry. Okta and Ping have a f shipped a few this summer. So I think there are some products out there, but I would prefer to stay vendor agnostic and abstract it to a pattern. but trying to get to the point where you know what agent did what thing at what time with what data based on whose authority, I'd like to bring it down to those, those, those three primitives, those, those, those three things that you build, the roster, the badge, and the checkpoint. but nobody's thinking this way that I can find a lot of cases.

I mean, we've had API gateways, we've had microservices for a while now. I think, and everything we see out here is an evolution, right? Between we move to cloud and then we move to microservices and then we move to containers and well, I did that in the wrong order, but this we've resulted in our ability to do this level of abstraction, but nobody's had to do it. the quote unquote the most the right way, the most secure way. IAM, I think is still something folks are trying to learn. IGA itself, I mentioned IGA I identity governance administration. I think a lot of shops don't have that.

And it's out of reach for a lot of shops because it's so expensive to buy the solutions that that help you do that. so we're not great at doing this for humans. the fact we're trying to do this for AI is, yeah Everybody's struggling that I see. So trying to start simple, trying to start that spreadsheet, trying to say, let's think about these and in these three things that we're gonna build. And then let's just start iterating and interviewing and identifying what's happening, what they're trying to do, and really understand and interview and listen, I think is the biggest thing to combat the nobody's doing this because the business is moving forward with AI.

And as most things, security is behind. The evolution of technology and the business, speed of the business. But I feel like while most folks aren't doing this great, Allie, I feel like it's such a great opportunity for security to be a producer of value, to for security to get in the driver's seat and do this the right way with these three primitives, like with these things that you build, with these concepts. Because if you do it that way, governance becomes an accelerator. Governance is allows the business to move faster with AI agents. that's what I really like about this whole approach and what the Agentic Trust Framework tries to do when we find success in doing that.

But it's a long-winded answer to your question of are folks struggling? Yes. Almost every one of them that I work with are certainly struggling to get this done.

Allie Howe: Yeah, good thoughts for sure. I think another reason why folks are struggling is because it's hard. Even if you like, you know, sit down and you're like proactive, you do the interviewing and you think through okay, what exactly should this agent operate over? What's its use case? Who should have access? What should the agent have access to at different times? most tools, like downstream tools, are very like coarse grained, like MCPs and APIs. And so like for Notion, for example, you can't say, just I want to be able to only look at this database on This page, you just can only say, I want to be able to get pages from Notion.

And then also like the environment around the agent may change. So what you want to allow access to you know ahead of time in this moment may not be true later on. It's also really hard for humans just to think through perfect policy ahead of time, just because you know humans like have human error and get tired and might not think through every single edge case or thing the agent needs. which is why like I'm really excited about intent based off. I've talked about it a couple times recently on different like panels at events, and I'd had Dick Hardt on one of the panels. I know you're friends with Dick as well. and yeah, I just feel like that's probably maybe where like the future's headed because you can be able to like look at intent and say, okay, based on the intent of this agent or what AAuth calls it like the mission, what this agent's mission, does it make sense in this moment for this agent to access this resource on behalf of this person, or based on this agent's identity? do you think intent-based auth is kind of an unlock maybe for this as well?

Josh Woodruff: Absolutely. Absolutely. And I love the whole mission concept within AAuth. I think it's desperately needed. And I want nothing more than to help Dick and Carl and everybody else get this, get these IETF standards shift. But as they always say, you gotta make it easy, right? You gotta make it easy for people to do to use these things for them to work. And I think we're getting there. but I completely agree. I think with in I mean, I don't know if you know, I'm sure you've heard the story, the summer you posted about. head of AI security research and I think governance at Meta. She was kind enough to post her open clause story, right?

About she had given an AI agent access to her email box. Started out on a test mailbox, worked great. So she started as an intern. And the intent was clear, right? The intent was read my email, never delete, help me manage this stuff. Worked fine in tests, she shipped it to production. And the intent, you know, was there, the agent had every right to her inbox, but then it just started to delete emails that she said, wait, I told you not to do that. So even with the right intent, damage could happen. And to your point of like Notion and some of these other vendors and these tools reducing the offering more fine grained privileges and tool scopes to where it's not so coarse grained.

I think that's the other side that's needed to match with intention. I mean the intent is it's a good signal for the checkpoint to read. I if you know coming back to this whole model, and the checkpoint has to be able to say no to the action itself, whatever the intent was. and it's funny because Zero Trust taught us to check who you are and what you can reach on every request, right? That's the foundation. But agents need one more check on top of that. What are you doing right now? And is that allowed right now, at this moment? So so this check moves from the front door to every single thing the agent's trying to do, even with intent.

Allie Howe: Yes, no, I totally agree. And on the one of the panels I gave on attempt based off, we talked about the Resy incident of where that I think an instinct agent went out and was trying to book a Resy reservation, a restaurant reservation on Resy.com on behalf of a user and it made two hundred APA calls an hour and ended up getting the user's account banned. good intention to go book a you know, a restaurant reservation. That's what the user wanted, so that was like all aligned, but yeah, bad action took place. They too many requests and the account got banned. so it needs to work.

Hand in hand with deterministic controls and like hard boundaries. And we talked about AAuth budgets and how AAuth budgets helps you limit the amount of times a downstream resource may be called. And if you have like an architecture model, like the brains and the hands architecture where the model is separated from the tools, or you have your credentials, your access separated like from outside the sandbox the agents running in, then you can able you can look at okay the signal of the amount of times that I'm allowed the budget for like an AOS. Of calling a downstream resource is now completely spent. It's gone. And you can choose at that point not to issue another credential because you have that lever to pull.

You are able to have deterministic control there. So lots of exciting things coming down the pipeline from AAuth and other like technologies and solutions as well. So I think like some of these things are on the horizons, but yeah, teams need them now and they need them today.

Josh Woodruff: Yeah. And the Resy case is so interesting. It's the intent was there, right? The agent was using the real login. just nobody told it how many times it could knock, right? Like you said, it was exceeded. And look who paid for it. I mean, Resy gave the account back with a warning. but next time they s I think American Express said they're gonna close his Resy account and his Amex card. So The agent misbehaved. He got the warning like a manager answering for a new hire. It's funny. I have a story in this book about Kevin, logistics manager, deployed AI, deployed it as an insurance.

It's somebody that we worked closely with a while back. And this agent did everything wonderful, processed orders for manufactured perfectly for three months. And so they gave it a promotion. So the intention was, okay, you're gonna do more. You've earned a bit more autonomy, and it got a fifty thousand dollar spend limit and it was incentivized to take advantage of discounts. It found some 15% discount on floor cleaner. And the company only found out the next morning when they're doing the order reviews. If thank God they had a 24-hour order review, $1.4 million of floor cleaner this thing had been trying to order. The intent was there.

It had earned its autonomy. It just didn't realize the company didn't need forty years worth of floor cleaner. It's kind of interesting.

Allie Howe: Yes, absolutely. And that ability that you're talking about of like creating for agents we need that additional control of at runtime be able to say, should this agent be able do this action right now? that I know that's something that AARM, which is part of CSA as well, is helping with. d can you give us your thoughts on the AARM conformance standard as well?

Josh Woodruff: Yes, I love AARM. yeah, it's autonomous action runtime management. It's great work. it's also a CSAI standard now that came from another shop. a good friend of mine, Herman. It's great work. It controls each action at runtime and it says either let it through, block it, I think it's change it or ask for a person or hold it for more context. and it's interesting because ATF, Agentic Trust Framework, is kind of framework around that. It covers how much freedom an agent has earned and what happens when it slips. So it really fits nicely with AARM. I think AARM is at that action runtime management. It's a little bit more of a micro where the agentic trust framework is around how much autonomy the given agent.

I think they go together so well. And again, Herman and myself, we donated, I had donated ATF and he donated AARM around the same time. Neither of us had ever talked. But they complement it so well. It's another great case of this convergence happening where a lot of like-minded individuals, even with agent baseline, I mean, you it's I think we're all finding the way. I think you see some patterns emerging that and hopefully we'll settle on a standard and folks can use AI with a lot more confidence and security, governance, explainability, auditability, and also to make sure when it's doing the wrong thing, it You know about it and it's gonna stop it.

I mean, that's I think what we're all trying to get to is AI is great. Granting autonomy is good when it's earned it. how do we know it's still doing what I'm allowing it to do? How do I know it's still behaving? and really constraining it is is the name of the game. And especially with like Mythos class, right? When discovery is outrunning remediation. Right. We're finding vulnerabilities and writing exploits faster than any human could enumerate their patch cycles. So this is comes back to why I think Zero Trust is a perfect fit for a gentic AI and how it fits into ATF and combines with AARM.

Is it's no longer about stack rank enumeration for patches, it's about containment. Assume breach, limit the blast radius. Once it gets in, how much damage can it do and contain it? So we like to say containment over enumeration. And I think AARM is a great example of that at the micro level, at the action level. And ATF is a little bit more broader around controlling when can they come in the house? And once they're in the house, where can they go in the house? And if something bad happens, how many rooms of that house are they going to damage?

Allie Howe: Absolutely. Yeah, it feels like thinking through those questions laid out by the Zero Trust Framework is important to making the runtime, like the whatever you know arm conformant solution you're using that much more effective because you have like the idea of what it should be able to do at runtime or not. so you can only it's way easier to enforce controls if you have thought through them in the first place, or if you've got, you know, the stable identifier in place, if you've got the you know, the badges that we talked about, the registries. talked about in place as well. And I agree it's really interesting to see some of these ideas start to converge.

I feel like a year and a half ago we had like all of these different frameworks. They were like really confusing in terms of like they were all over the place and users had no idea like which one to follow or use. And now like with agentbaseline.org and the agent trust framework and AARM they all sort of are saying that kind of like similar ideas and work really well together. And so I do I feel like it's hopefully clearer for practitioners.

Josh Woodruff: So yeah, it is really amazing to see the convergence. And it's funny when I you probably in the same boat with your history and with what Key Card went through. when I published the book, it was like crickets. Like, what's an agent and why do what's zero trust? Why do what do you mean? How do these even fit together? but I think a lot of us have been thinking about this for quite a long time, and that was the point of the book and the framework was to make it easy. And it's interesting because you look at a genetic trust framework, it's five questions, and that's an autonomy progression level of four, you know, intern, junior, senior principal, and very clear promotion criteria, five dimensions of promotion. so all of that's great.

I think that's fantastic. But what we're trying to do is really establish instead of securing access, we're trying to secure action and these patterns that have developed. And what we're trying to bring to market is the whole goal is just to make this easy for people to use AI in a safe and governed way. And the patterns that are converging, I think are pretty clear. So it's very exciting. I love to see all of this coming together.

Allie Howe: Yes, for sure. And from folks that I've talked to about, they've are really excited about that idea of like a fine grain kill switch of like, okay, like it may I'm able to identify behavior that suggests my agent is like thrashing, it's getting too creative, or maybe it's outside of the bounds that I wanted for it, and they are able to identify that behavior, then they can either shut down the agent or turn off access to like just notion, for example, or turn off access for just one user. and I think that's like really exciting for a lot of teams. Because that really helps with the like autonomy progression and that like peace of mind, the knowing that okay, like if this agent you know does start to call resi.com, for example, like 200 API calls an hour, and I notice that happening, I have observability there, which is key.

That's one of the six outcomes in agent baseline, for example, then having that ability to shut that agent down and provide that kill switch is super important as well.

Josh Woodruff: And without a broader impact to the business, right? The more fine-grained and tightly scoped it can be, the less of the impact it will be when you gotta kill it, right? Because you're it's not a work stoppage issue. You didn't have to disable the human, you just disable that one job that's only doing this one little thing. I don't know about you, Allie. I see a lot of folks trying to build these Uber agents, and I don't mean Uber the company, I mean like a super agent, like because they can, right? And This tendency to over-engineer everything is is something I've seen throughout my entire career.

So I'm always trying big on let's simplify this. That's why the book is a guide for business leaders. That's why I have this picture on my wall. That the answer is simple, because it's not easy, but it should be simple. Trying to make little microagents that do very small amounts of job that are tightly scoped just to do that one job. When they go off the rails, you just turn off that one thing. You've got a kill switch that's a micro impact. And sure you've got a process that backs it up for the impact, but yeah, I think it's desperately needed, especially as we're getting more capable models and enabling AI to do more work. we've got to be very intentional about what we're having them do so that we have all the knobs and dials we need to correct them when they don't things don't do things the way we want them to.

Allie Howe: Yes, a hundred percent. That's such a good point. because yeah, like you know, security is a secondary market. You don't want to like turn off your business or like what's making money for you, or you don't have wanna work stoppage. and so being able to use like you know, fine-grained kill switches or to have that ability to have the what an agent should be doing or not, like thought out ahead of time and having different like microagents. And I feel like I've seen that a pattern more than like we did like a year and a half ago. I think people are starting to converge on that as well. they used to have like these like mega agents where they did everything.

Everything, or monolithic agents, and now we've got agents that like kind of act as like a router and they like route work to like the right little like subagent.

Josh Woodruff: Right. And I think the whole tokenomics movement has helped that, right? Don't use the same very large, expensive model for everything. great. So now I've got to break down the work into smaller units and dispatch different jobs to different models just for cost efficiency. That also forces the reduction of scope and the more fine-grained, least privileged access control that you can enable through the use of AI. So that's why I keep thinking a lot of the patterns that we've learned throughout security. Are really great for a business to enable a business with AI and security really should be getting into the driver's seat and enabling the business to experiment.

It's this is an opportunity for security to build the roll cage so the business can take corners at 200 miles an hour because it's governed and they can get out of pilot purgatory. They can actually ship to production. What a great opportunity for security and governance professionals. if we can get this right.

Allie Howe: Yes, absolutely. Yeah, and I feel like it's a you know, a double win for engineering and security, which helps with adoption as well if you've got little like smaller agents that do smaller subsets of work, they typically perform better too. because they don't choose

Josh Woodruff: Exactly.

Allie Howe: the wrong tools, which is yeah, awesome. And then it forces you to think through, okay, I have like ten different agents versus one. does you know employee A need access to all ten or maybe just three?

Josh Woodruff: Right. In fact, we have a saying within my business, constraints are rocket fuel. So not only do constraints of an AI agent enable least privileged fine grained access control, it performs better. As you just said, it gets less confused about tool decision. It's a smaller context window because it's very focused on just one thing. So it performs better, the engineers are happy, the business is happy, they're getting more consistent results, and security's happy because it's least privileged fine grained access. It's a win it's a three way. Win, Allie, not just two way, but yes, it's pretty

Allie Howe: Yes, no, that's so true. Very good point. what's coming up next from CSA? I know we've got the runtime trust virtual summit here on Wednesday, Thursday. we're doing AARM Intercept night, Wednesday night. her and I are help putting that on at Vanta's HQ to do some demos from the community of how people are solving you know, the runtime security pieces and enforcing what an agent can access dynamically there at that event. So super excited to see how some of Technologies work in person. what else is going on from CSA? I feel like there's so much good work coming out of CSA these days.

Josh Woodruff: Yeah, there's a few regular events that we always do. The Zero Trust Annual Summit is something that's always done. It's now, of course, pivoted to AI. So that's about mid-November. It's virtual. It's also two days. I love what you and Herman are putting together for the AARM event. And I think there's even a follow-on thing that Herman's driving in February and in-person called Intercept, a whole conference on AARM, which is really exciting. Within the ATF circles, what we've driven in hand with Dick, with Dick Hardt and AAuth, along with a few others, is putting together what we call the Verifiable Agent Summit. we had a virtual on September 9th.

We're actually throwing a we're doing an on-site in San Francisco on November sixteenth. It's four hours in the afternoon. It's free, just like everything else Cloud Security Alliance does. And three of us are gonna get come and together and display a working model of verifiable activity, granting a certain autonomy level that's shipped through the protocol, which is AAuth. Of course, it's up to the receiving party to read that and do something with it. Like you said, if it's going to Notion, Notion needs to have the capability to say, well, they can read, but they can't write. Right. So it doesn't solve everything, but it's a, we're calling it the verifiable agent summer.

We're very excited about that. on November sixteenth, and the zero trust summit is just a couple of days after and that that one's virtual.

Allie Howe: Amazing. Yeah, that's a great title for an event. so I yeah, I hope you guys get lots of like registrants and good experiences there because yeah, I feel like that's super needed as well. and it's a good example too of an event probably where all of these concepts like that we talked about come together, the CO2 framework, AARM, some of the things from like agent baseline. so yeah, it makes sense that people are trying to figure out how to like verify, you know, what's running, what capabilities does it have, and then from there on like how do we, you know track that and do something about it like in the residents and for example and with the Yath budget and shutting that down.

Josh Woodruff: Exactly. Exactly. In the verifiable agent summit, it's about it's chain of custody. It's, you know, can an agent prove what it did, how much freedom it's earned? And so a system can check this before saying yes. Like it's building smarter systems. and I think so many of us, what you're doing there with Keycard and what Herman's doing with AARM, what we're doing with CSA, I th there's the convergence is really exciting. I think we're all working our way towards explainability, auditability, traceability, and control. I think I always come back to control, but I think all of this keeps coming back to governance as the accelerator.

Like you know, well, I won't keep saying that, but I get very excited about governance being the accelerator for experimentation and innovation. It's great time. Great time for us.

Allie Howe: Yes, absolutely. And I think, yeah, too, for like for any company, that's like having that audibility is just is huge because it gives them the ability to say, okay, I understand like in the event that something goes wrong, at the end of the day, like humans are always like liable for whatever like actions like take place. like in the fortunately in the Resident incident, like the user, whether right or wrong, like h held the liability there. so while some of those like questions of like who's liable when things go wrong with agents, like might still be like up in the air for certain scenarios, and in certain different like countries, different like legislations and then th things, having that audibility to understand, okay, like why did this happen?

Who are they working on behalf of? and also be able to like for evals as well, like over time, be okay, like these were the actions that took place. Like how do we improve our systems, like you were saying?

Josh Woodruff: Exactly. I think the use of all of this it makes the evals that much more meaningful and reusable and it all comes down to evals. So we know this by now, right, Allie? I mean it's your

Allie Howe: Yeah, yeah.

Josh Woodruff: AI's only as good as the evals that you've got around it to measure the performance and the improvements.

Allie Howe: It's super interesting too, 'cause I just like last week I was at AIE NYC and one of my takeaways, because I did a few podcasts with some of the folks that were attending that conference, and of course there are a lot of folks that are working in the financial services industries, they are very deep on evals. Like evals are some of the like core businesses of what these folks are doing, because some of these like businesses are providing financial audits of some kind where like the end result or the work outcome that they like produce and sell to someone else is like lit is an opinion.

And so if you try to reduce that work with agents, I feel like yeah, there's probably like no one further ahead in evals than the financial services industry. And they need governance for that, of course.

Josh Woodruff: They helped to drive you know reduction of latency decades back, right? Because that trading floor needed low latency, so they built very fat pipes, which gave us the cloud, and now we have AI. So thank you to the financial industry. Yeah, they're driving yet again on that. I think that's really interesting. but the explainability, the auditability, I think is is key, and I think it's also key to Fix an AI agent when it goes wrong. If it's an irre irreversible action, the agent should never do that because the agent's not going to do the same thing. In fact, it's going to do something different every single time.

If it's irreversible, how do you roll back from that? and I know in talks with a lot of finance colleagues, that that's always a big deal with reversibility and the what we call the never list. And of course you don't just Give the never list to the agent and hope it listens. Because just like some are you, you know, if she said, Don't delete my email, that's just a suggestion. It's a context window. It's like a whiteboard. It's going to erase whatever it's going to erase to put more context in, and that might be your instruction. The never list is almost like an architectural guardrail. so, and you do that through identity and tightly scoped credentials and you know, a gateway enforcement.

So All these pieces come together to enforce the needs of these real high volume business critical use cases of the use of AI, such as finance.

Allie Howe: Absolutely. Well yeah, so many good insights for folks that want to check out the Agentic Trust Framework, AARM, those are on CSA's website. Josh, is there any other resources that you would point folks to or any other upcoming events that we didn't talk about?

Josh Woodruff: well, let's see, that's a great question. we mentioned the Intercept con conference. that's something that Herman's doing in I think it's in February. Of course, [un]prompted is next week. I don't know if this episode's gonna come out, but [un]prompted is the last week of October. I'll be speaking there about some of the work I've done from IANS. I'm an IANS faculty member. I've talked to probably 90 different security leaders just this year alone about agent governance and through IANS and my own consulting practice, developed some patterns that have worked and some governance models. So I'll be talking about that unprompted in the last week of October.

So really looking forward to that. if it's not too late by the time this comes out, I encourage everyone to join. It's only the second time. The first one was in March. This is in San Francisco. amazing conference. So nothing but practitioners, very little vendor push, just a bunch of folks sharing what they've learned and Trying to learn from each other. So really good event.

Allie Howe: Cool. Well yes, we'll have to keep in touch. I'll know how your talk goes. that's super exciting. And yes, definitely will keep tabs on the AARM event, that full conference in February. Very, very exciting. but yeah, any last closing thoughts before we wrap?

Josh Woodruff: I think I just I love this and I keep coming back to this, but it's something I get most excited about as this governance allows us to go faster with agents, with the use of AI. And the other concept that why ATF is a thing is is we need to secure action, not just access. So if you take these, if you have this mindset. It's a really great opportunity to partner with your business units, partner with the units that are ahead of the game, figure out what they're doing, help them do it, and help them do it right. Make that path of least resistance the safest, most secure path. it's a great time for us to be doing that.

So I would encourage everybody to think about it that way. I still run into a lot of teams that are trying to ban or block. I don't think that's a successful path. so I would highly recommend against that approach. and the last thing I'll mention is I don't know for those who saw there is, I think it's only the second bill that's gone in the US government. That there's a bill that's gone in the US government called this stop rogue AI bill. And it's a bipartisan house bill. It asks for NIST to help write more stuff on agent governance. but it's interesting because it really speaks to the same kind of four things that we just talked about.

They require a running inventory of every agent. They want a verified identity for each agent. They want real time of watching agents. We talked about behavior. and they want allow, deny, and revoke at any time, which is really that that checkpoint and the roster and even arm. so I Again, another good sign of convergence where a lot of what we've been doing just as professionals to try to help our businesses be successful with this may now very well become law. And those of us who have already embraced this and have already kind of working with us, and I'm always available. I'd love to talk about this stuff.

I'm through CSA, I'm on LinkedIn. I'm always happy to meet, would love to meet in San Francisco. I think the more we do this right when it becomes law, we're gonna be ahead of the game and we're gonna actually be able to say, Yeah, we have we've actually fulfilled the duty of the law because we help shape the law. Like how often can you say you've done that? Like that's pretty cool.

Allie Howe: No, that's really cool. That's very exciting. I'm glad that everything, in including like legislation potentially, is converging on the same ideas. so yeah, we're super excited to be part of this community. Thank you so much for all the work that you've done in the community as well across CSA and elsewhere. but yes, we'll definitely keep in touch and thank you so much, Josh, for coming on. And the main takeaway for me was for sure, yeah, governance is the unlock for more autonomy. So thank you so much.

Josh Woodruff: Thank you, Allie. It's such a pleasure to be here. Thanks for your time.