Okta's CEO is betting big on AI agent identity

20:50So what is Salesforce doing? What is ServiceNow doing? What is Claude doing? What agents do they have? And then, okay, now what are they connected to? And making sure that we control and secure what the agents are connected to. Because again, the tension is between more and more data, more and more connections. This is, by the way, why the companies like Palantir and Snowflake and Databricks are doing so well. Because what they allow companies to do is instead of having to actually connect their agentic enterprise to all these separate systems, they pull it into one data warehouse. So that's one model.

21:25You can pull it all into one data warehouse and run the agents on that. But I think the longer term, more scalable model is you actually have the right permissions and the right access tokens to the agents to access the data directly. So when you go back to the example of OpenClaw, it's like mindset. Everyone knows what these things can do now. And you have to facilitate access. You have to facilitate making sure that these connections are made in a secure way and in a way that can be understood and monitored. And when things go too far, you can pull them back. And as you experiment in the lab, you can say, these are the connections we need.

22:03This is, you know, we should add more here. We should change this. We should filter this permission. That's what companies have to do. And that's the rail. Those are the rails we're trying to put in place.

22:13Nilay Patel:When I said this was going to be an emotional conversation on software development, the nature of our relationship to databases is at the very heart of that existential crisis that I feel every week on this show. Let me just get your answer to this directly. It sounds like you're saying Saspocalypse might be real, but it's not real for Okta in the way that most people think Saspocalypse is real. I think what people miss is that the pie is getting much, much larger. If you look at the amount spent on software, it's about, if you do infrastructure and SaaS and everything, hyperscalers, software, it's about$1.2 or$3 trillion,$1.2 trillion roughly.

22:54If you look at the amount of people, the services, the IT services market, it's about 1.8 trillion. So the markets are getting bigger. We're going to be spending more of that money on software, and the pie is getting bigger. That's one thing that's true. The second thing that's true is that every piece of technology in the stack, whether it's SaaS apps or whether it's devices or OSs or infrastructure, they're all going to get agentic features. They're all going to do things more on their own. They're going to be able to talk to more of them, and they're going to optimize for Agendic. And I think the last thing is that there is a new layer, and that is the digital worker layer.

23:34And I'm sure some of the existing companies are going to make the leap, and they're going to have real digital workers that come from Microsoft and Salesforce and Amazon. I think it's probably more likely it's going to come from companies that weren't born in the legacy way of building an app. I think it's hard when you grew up building an app in a certain functional silo, it's hard to build a digital worker because digital workers need to go across different things. That's why they're called workers. That's why they're not called one app. And so it's really hard for companies that have focused on collaboration or HR or one silo to say, hey, now my digital worker really can span all these silos.

24:17Because if you look inside those companies, the whole org structures of these companies and the politics of these companies are someone owns one silo. So it's very hard to break through and go broad. So anyways, I think everything's getting bigger. I think a lot of the apps will have agentic features. I think there's a new layer of digital workers. Now back to your question, which is like, what's going on with the SaaSpocalypse? The reality is there will be some losers and there will be some companies disrupted and there'll be new people take over categories that are now. But I mean, that's back to challenges and making it fun.

24:53That's what fires me up. And I think it fires up a lot of people too.

24:58Nilay Patel:We have to take a quick break here. We'll be right back.

25:09Nilay Patel:Support for the show comes from MongoDB. If you're tired of database limitations and architectures that break when you scale, it's time to think outside of rows and columns. Because let's be honest, you didn't get into tech to babysit a broken database. You got into it to actually build something. MongoDB lets you do that. It's flexible, developer-first, asset-compliant, enterprise-ready, and built for the AI era. Say goodbye to bottlenecks and legacy code. Start innovating with MongoDB. There's a reason it's trusted by so many of the Fortune 500. And that's because it's a platform built by developers for developers.

25:51Nilay Patel:MongoDB. It's a great freaking database. Start building at mongodb.com slash build.

26:01Nilay Patel:Support for this show comes from Framer. If updates to your site are feeling harder than they should, Framer is the shortcut you've been looking for. Framer is a website builder that can transform your dot-com from a formality into a tool for growth. They've helped thousands of businesses from early-stage startups to Fortune 500s build better websites faster. Framer is an enterprise-grade, no-code website builder used by teams at companies like Perplexity and Miro to move faster. With real-time collaboration, a robust CMS, and everything you need for great SEO and advanced analytics that include integrated A-B testing, your designers and marketers are empowered to build and maximize your dot-com from day one.

26:46Nilay Patel:Learn how you can get more out of your dot-com from a Framer specialist or get started building for free today at framer.com slash decoder for 30 % off a Framer Pro annual plan. That's framer.com slash decoder for 30 % off. framer.com slash decoder. Rules and restrictions may apply. This episode is brought to you by Indeed. Stop waiting around for the perfect candidate. Instead, use Indeed Sponsored Jobs to find the right people with the right skills fast. It's a simple way to make sure your listing is the first candidate C. According to Indeed data, sponsored jobs have four times more applicants than non-sponsored jobs.

27:27Nilay Patel:So go build your dream team today with Indeed. Get a$75 sponsored job credit at Indeed.com slash podcast. Terms and conditions apply. Support for Decoder comes from Adobe. For every big idea, your documents folder tells a story. Let's say you've just finished pulling together a brief. So you hit export on finalversion.pdf. But then you open the file. and you immediately notice a typo. Several versions later, you're exporting finalv4.actualfinaldraft.pdf. Adobe Acrobat can save you the digital clutter with PDF Spaces. It takes your documents and turns them into a living project that you can engage with, get insights from, and collaborate with others on.

28:13Nilay Patel:You can gather all your files into one workspace and have a whole conversation with your AI assistant about it and ask questions to get deep insights about your project. You can even invite people to your PDF space and let them add files, comments, notes, and more. You could doodle in the margins or even turn your project into your own personal podcast episode. Acrobat lets you generate an audio overview of your project in just one click. Learn more at adobe.com slash do that with Acrobat.

28:52Nilay Patel:Welcome back. I'm talking with Okta CEO Todd McKinnon about org charts and how deeply weird they're starting to get in the age of agentic AI. You have brilliantly opened the door to the decoder questions by talking about org charts. I actually think we're on the cusp of some of the weirdest org charts we've ever seen. So tell me about Okta. What was your org chart in the past? I mean, you founded the company. I'm sure you've gone through many iterations of it. Where are you at now? And as you talk about changing the balance of change of the company, how are you changing your org chart? I think the guiding principle is try to give the great people an area that they can be great in.

29:28So it's really kind of a people-driven org chart. It's like reward people, promote people, bring in new people, give them an area that could really excite them and motivate them. And it's kind of people-centric. The second principle is where possible, try to cluster things. So you minimize communication paths and you let people be more autonomous and small teams. I found that's pretty hard. I think pretty quickly, unless you have very distinct separate business units and really almost separate companies inside your company, it's pretty hard to cut down on the lines of communication. There's got to be lines of communication somewhere.

30:08No matter how you slice the org, you're kind of moving around where the people have to cross org boundaries. But you do try to take that into consideration. And then I think beyond that, I think a lot of people think things that people try to do with org charts, you know, whether it's get people aligned on goals and get a culture that is shipping things quickly is it's really not an org chart thing. It's a management thing. It's a leadership thing. And you'd better, instead of moving the org around all the time, you'd be better spent to make sure you have the right management team and the right leadership team to instill those cultural elements versus, you know, taking your people team and telling them to move stuff around to have a more nimble culture.

30:51You probably should just like get the right managers.

30:55Nilay Patel:So this, I mean, this is my joke on Decoder, right? If you tell me the structure of your company, I can tell you 80 % of your problems because the tensions just exist in certain structures and predictable ways. And it's at last 20%, which is priorities and leadership and management. So it sounds like you're pretty functionally structured, but how is Okta actually structured? Are you structured by business line? Do you just have a crack AI team that's off in the corner? How does this all work? On the go-to-market side, it's functional. On the G &A side, it's functional. On the R &D side, it's by platform.

31:26We have two platforms. There's Okta platform and Auth0 platform. And the R &D is by platform.

31:32Nilay Patel:The other question I ask everybody who comes on Decoder is about decisions. Again, it's always great to have a founder because your frameworks change as you come up with a company. How do you make decisions? What's your framework? And how has that changed over time? I would say we're doing introspection here. I told you to be emotional. Yeah. This is Decoder. Decoder is just therapy for me personally. At this point, it's just like you can tell what my problems are, right? That's right. Because you're like casting them out amongst guys. But it's interesting. So when I started Okta, you know, I'd worked at Salesforce and I had a decent sized team there and felt like I was very decisive.

32:10I was like, we got to do something. Here are the options. Decide. And then I started Okta and I found something interesting. My decision making process slowed down. And when I was thinking about why, it's like I feel I realized that when I was at Salesforce, my boss was always a safety net. ultimately, right? It's like, if I was going to make a bad decision, there was theoretically a boss to stop me. But when I started doing Okta and the company started getting successful, I was, you know, my decision was like the decision and I better think about it and get it right. And so it slowed down, it slowed down.

32:43And then the company got bigger and we got into this phase of, you know, we were public and got closer to a billion dollars of revenue. And then I kind of felt like maybe I didn't, uh, I needed more input and I really needed to get expert advice on a lot of things. And what I realized over those years is that my instincts were still pretty good and I probably should trust my instincts more. Um, and, and so I think that's kind of the mode I've been in for the last three years. Yeah. It's the company's bigger than it's ever been. I'm managing a company that's bigger than I've ever managed by definition, but, uh, I think I've been leaning into my more, my instincts more.

33:23And I think to inform those, there's, and then to put more, you know, detail on that, I think two things are very important. One is that you, you have to decide which decisions to make. So that's really important. So there's a bunch of decisions that I should, I shouldn't be involved and I shouldn't be making. The inverse of that is super important, which is the ones that I, that I am making a better focus on them and concentrate that, concentrate on them and really get those right. And for me, doing that in an effective way, having a detailed grasp of what's going on is incredibly important. So being in the details, and it's at a scale where it's hard to know every little thing, but you can really dive into areas and get enough details throughout the year so that when it comes to make those big decisions that you've narrowed down and focused on, you can use those details and use your judgment and trust your instinct to make good, high-quality decisions.

34:21It's the most important thing I do, deciding which decisions to make and getting a high success rate on them.

34:27Nilay Patel:Put this into practice for me. The big decision we've been talking about is, OK, Okta is going to chase the idea of being the framework for agents in the workforce. That's a huge market. It is so big that maybe you're not as worried about Sespocalypse as some of the other enterprise CEOs that I talk to because the market's going to grow is so big and we're going to force change the company from the top down to make sure that the rate of change is higher and we're all focused on this opportunity. How did you make that decision? Was it, did you stare at the ocean for a while and it came to you in a lightning bolt?

34:59Nilay Patel:Like what, what was the process there? The high order bit there is recognizing, recognizing a world where everything in the stack is going to change. Um, and I think it's not kind of, it's kind of similar like when I started Okta and that, I mean, you never want to exactly follow the past because history doesn't repeat, it rhymes. But a lot of it was, I remember in 2009, I was looking at the world and saying, Hey, you know, there's going to be a cloud version of everything in the stack. And what are the big, unique opportunities there? And what's happening with, you know, a Gentic call it a Gentic is that everything is going to be revisited in this Gentic world, whether it's current solutions are going to have Agentec capabilities.

35:46I mean, it's crazy. Like AWS. AWS is like the infrastructure business, the most unassailable business. That market is, with all the changes with Agentec and people building agents and running models, it's up for grabs, which is crazy. So all this change, and then you just look at what's going to be required in all this change, and you say it's these connections between all these agents and where they're running, the demand for that is going to be massive because there's going to be this onrush of agentic capabilities. And there's going to be new stuff that's built. There's going to be native vendors that come out of nowhere and take market share.

36:28There's going to be new markets. And so it's kind of a, it's a macro thing, but now it's like, all right, what do you know about the details of your company, Todd? What are you guys good at? You're good at building something that scales, building something that's reliable, building something that connects to a lot of different systems. You know, how can you position yourselves in that new market? And I think that's, you know, those are the big essential things. That's the bet we're making.

36:52Nilay Patel:Take me inside the moment, though, right? You're realizing this happens. Did you write an email? Did you open a Google Doc? Did you just dictate to ChatGPT and say, fire off an email from the agent? Like, how did that actually work at the company? Last year, I was in process of meeting all our 100 largest customers in person. And the purpose of the meetings was I wanted to tell them about our vision of this unified identity platform where we're the only ones in the industry that have all these capabilities across customer identity and governance and privilege. And at the same time, the teams were working on essentially agent identity.

37:34and these meetings, I would pitch what I was talking about. And then there would be interest in, you know, oh, we should look at this. We didn't know how far along you were. And then I started throwing in this agentic stuff at the end of the meeting. And whenever I would get to that, the people in the meeting would just stop and they'd be like, wait, talk about that some more. And then that kept happening and happening until, you know, where, you know, 25, 30 meetings, 40 meetings in, I would flip it around and we would start with the agents and the new identity type and what customers were thinking about doing with agents and how they're seeing the potential of the digital worker and agents and all the confusion.

38:13And we wouldn't get to the other stuff. We had our big conference in the fall and, you know, it was like the last vestiges of the old pitch followed by the agents. And after that conference, I just said, listen, And we got to flip this around. People want to hear about the agents. That's the direction they're going. And that's what we need to pivot and totally focus on.

38:36Nilay Patel:All right. So let me ask you my crash out questions about all of this. Here's my first one. And you're a great person to ask this question, too, because you build a lot of software. You've built a company around building software, like very bespoke, very complicated software. And you're trying to sell a lot of software to people who, like you said, would like to replace labor with technology, right? And that is there's a lot there. I'm looking at the state of the art in AI right now, and I see some cool stuff happening, and I find myself constantly wondering, can the LLM technology we have today that is a foundation of all of these AI systems, can it bear the weight of our expectations?

39:14Nilay Patel:Can it actually, on any reasonable timeline, do all of the things that people think it can do? because I can see it doing some things and then I see it just hit walls over and over again. And I say, well, if it's brittle, people are not going to adopt it because that brittleness is exactly where you want a human being to just be available to overcome whatever boundary the AI is going to find for itself. And I can give you examples, but I'm curious if you see that broadly and if you think the technology can actually develop to the point where the market becomes as big as what you're describing.

39:49Absolutely. the technology can develop. I think there's a lot of wild extrapolations going on right now, which, you know, but I think that even if you don't meet the wild extrapolations people are talking about, the market is still massive. And I think it's going to take a lot of innovation and good product work and good engineering work and good process work to make sure that the benefits that we can achieve these benefits, even though it's not some wild extrapolation of some magic LLM that can do everything in the world.

40:19Nilay Patel:So I see one example, right? Every software developer I know is like, especially the senior ones are like, I'm now just describing software. Like I'm just like writing. That's a great example. That's a great example. So now I believe that is very real and very powerful, but I also believe that there's going to be more software engineers in five years than there are now. And the reason I believe that is not because I think those people are wrong, but I think that what's going to happen is there's, first of all, there's just way more software that we need to build that can be built. And two, what's going to happen is the software engineers are going to be figuring out how to make it work at scale, how to make sure that systems can be maintained, how to make sure we understand how the agentic workflows, what they actually built.

41:01And we need to modify them for the next way. No one's ever maintained an agentically developed system for five years. No one's ever figured out how to make it scale. That's where all the work is. And when you combine that on, you know, we're going to build 10 times more software that adds up to more people being required to do it. So I think both can be true.

41:20Nilay Patel:Where are those people going to learn how to do it, right? You've already described this, right? The traditional career path, the traditional org chart is breaking down. I think Meta announced that like one manager will now oversee 50 ICs. When I say we're on the cusp of some wild org charts, that's what I mean. Like some very strange corporate structures are going to blossom here. If the problem is, okay, no one's ever maintained an agentic system for five years and we need more developers to do it, where are all those developers going to learn the skills to evaluate the code that agents are writing and deploying and saying, okay, you got it wrong.

41:56Nilay Patel:Here's how you need to maintain it. It's maybe not what everyone's saying because people like to extrapolate and say everything in the world is changing. The education system is going to change. Everything's going to change. I think a lot of the things where people learn, they'll learn. Like in college, I think we'll still teach computer science. It'll just be different. Just like, you know, 50 years ago, we didn't teach modern compilers. We taught machine code and assembly, right? And so now we'll teach how do you coordinate agents and how do you architect systems and how do you, you know, you'll probably take some, you know, Java development classes, kind of like when I was in college, I took machine code classes to understood how it really works under the covers.

42:37But you have to learn the new way. It's modernization. You'll have to learn new challenges. And I think it'll be better because we're going to learn how to build stuff at scale, not just in terms of the amount of load it can handle, but build a large, complex system at scale. learning that in college and learning that on the job and people that are early in their career leveling up. There's also this narrative out there that, oh, we don't need any entry-level developers anymore. That's a bad mindset to have because, first of all, those are the people that are probably most open to doing things differently.

43:11They're the least set in their ways. So I think entry-level folks will learn how to use these tools and command these workflows to do things of scale in a way that people that learned 10, 15 years ago didn't.

43:22Nilay Patel:So when I think about the value of agents going out in the world, as you've described, they need access to a lot of data. The notion that my company has a bunch of disparate databases and that I should hire an agent to go look at all those databases and put them together and use the software. The thing that gets me at that every time is the notion that they're going to build software because I'm not sure the agents are building software for anything but agents to use. And at some point that software just gets very specialized and very narrow. And it is access to the databases that becomes the most valuable thing.

43:56Nilay Patel:One of our own designers here at The Verge said to me right before I came to talk to you, he heard I was talking to you and he said, all software development in 2026 is just calibrating the interface between your brain and a database. Right. And like right now, all AI development is like, would you like to just chat with this database? And the answer in the enterprise appears to be yes. Like, let me just talk to my analytics database directly like a person, and it will give me some insights. And the answer in consumer maybe is no, right? Like Google Photos just walked back its AI search because it turns out people prefer the regular search.

44:29Nilay Patel:And I don't know which one is going to win out over time and where it habits for everybody across work and their personal lives will change. But the notion that the database is the important thing, and that's where the value is because anybody can ask an agent to go make up a piece of software to do some business function. Doesn't it seem likely that the database vendors will just raise their prices or increase the barriers to access or find other ways to extract more value from having that data? Because that's what all the agents really need access to. I think there's data, and then there's intelligence.

45:05And I think a lot of the intelligence is now in the past has been codified in the application. Raw database is not that helpful. I mean, when you say you want to talk to the database, what you're really saying is you want some kind of analysis or intelligence done by something. You don't want to have the ones and zeros and gigabytes of data coming at you. So you're really talking about intelligence. And that's the big debate about Saspocalypse. Who's going to do that intelligence? Is it the app vendors we have now? I mean, even, you know, I mentioned the data warehouse companies like Databricks and Snowflake and Palantir.

45:42They're not really, I mean, they're selling, essentially, they're selling some kind of intelligence. They're not, the valuable part of their business is not the ones and zeros. So the question is, like, who's going to do the intelligence? And I think that the application companies are going to add some to their, you know, capabilities, and there's going to be new ones. And there's going to be new ones that intelligence actually becomes work, not in the sense of, you know, app work, but sense of work people would have done.

46:12Nilay Patel:We're going to pause here for one more quick break. We'll be back in just a minute.

46:31Nilay Patel:All my boxes like that savory McChicken biscuit for just two 49. Consider my boxes checked. If I'm feeling spicy, a hot and spicy chicken McGriddles is breakfast checkmate. Whatever's on your checklist, a two 49 chicken breakfast sandwich at McDonald's. We'll check all your breakfast boxes. Buh-duh-duh-duh-duh. Prices and participation may vary. Cannot be combined with any of the offer or combo meal. Spring Black Friday is on at the Home Depot. Save on grills and patio sets that will be sure to bring your hosting game up a notch. Fire up your feast with help from the Home Depot and save on grills.

47:02Nilay Patel:Like the next grill four-burner propane gas grill was$249, now in special buy for$199. Or give everyone the best seat in the yard with the Hampton Bay Mayfield Park four-piece conversation set for only$399. Save on grills and patio sets with low prices guaranteed during Spring Black Friday, only at the Home Depot. Now through April 22nd, while supplies last. Exclusion supplies to homedepot.com slash price match for details. You tell yourself, no one wants your college-era band tees. But on Depop, people are searching for exactly what you've got. You once paid a small fortune for them at merch stands.

47:33Nilay Patel:Now, a teenager who calls them vintage will offer that same small fortune back. Sell them easily on Depop. Just snap a few photos and we'll take care of the rest. Who knew your questionable music taste would be a money-making machine? Your style can make you cash. Start selling on Depop, where taste recognizes taste. Hi, I'm Brene Brown. And I'm Adam Grant. And we're here to invite you to the Curiosity Shop. A podcast that's a place for listening, wondering, thinking, feeling, and questioning. It's going to be fun. We rarely agree. But we almost never disagree. And we're always learning. That's true.

48:12You can subscribe to the Curiosity Shop on YouTube or follow in your favorite podcast app to automatically receive new episodes every Thursday.

48:25Welcome back.

48:26Nilay Patel:I'm talking to Okta CEO Todd McKinnon about the uneven, messy shift into a tech world maybe driven by AI agents. When I'm saying I'm having an existential crisis, as a tech journalist, I have understood software in one way for my entire career. And it's been a pretty good career because the software industry and the tech industry has grown so fast in the 15 years since we've started The Verge. but every conversation I've had to Coder over the past few months is some CEO of like a web 2.0 company that put a beautiful mobile app interface on top of a database. And that thing felt like the application and they built huge businesses on top of it.

49:02Nilay Patel:And you can describe this in all kinds of ways. We just had the CEO of Zillow on. Zillow is just a beautiful interface to a database. And that's a really good business for them. I'm asking, okay, if you have agents and you're like, go find me a house and order me a sandwich, you're going to end up in a place where it might just want to use Zillow or it might want to cut Zillow out and go directly to the underlying or Zillow might build the killer agent or, or Zillow might build the agent. And I'm just not sure how any of that plays out because what you're really doing is unbundling the data and the intelligence that acts upon the data and the interface to that data into three very different things.

49:35Nilay Patel:And everybody still wants to make money and not go out of business. And you're sitting right at the center of it, right? You're providing access to everyone. How do you see that playing out right now? A different way to frame what you're saying is that there's an unbundling and there's like a data layer and an intelligence layer and a front-end layer. But what also is happening is that it's all kind of getting more connected. We think of an app and a database and a user interface as one thing. But as that unbundling happens, what really is happening is all the apps that you thought were in various silos are connecting to each other.

50:08And that's because there's agents on top of them that are connecting to all those silos. There's the apps themselves are becoming more agentic. And, you know, and we're as Okta as a company, this is why I'm so excited about this agentic identity and these guardrails we've talked about. It's also why we're, this needs to be standardized in the industry. There's no good standard for how, we have pretty good standards now for how, you know, when you single sign on into your applications, how that interaction works between you and your browser and your phone and the applications. there's no good standards for how agents connect to a bunch of other systems they need to get their data so there's some standardization that's required here too but i mean zooming out it's like isn't it exciting it's it's such a challenge it'd be much easier if if things were just stayed the same and we could kind of keep keep like in our own little lanes and i i agree it's exciting

51:01Nilay Patel:especially because you're gonna i think we're gonna see a wave of new companies and new ways of thinking. And certainly we'll see new ways of computing, which that's why the Verge exists. We were built around the concept that mobile phones would be important, which when we launched the site was not, people were like, what are you talking about? It's hard to even say now, but this was a real thing that we said that we got question marks around. What I would temper that with is when I have CEOs on the show and they say companies are interested in replacing their labor budgets with technology budgets, that is a pretty huge threat.

51:34Nilay Patel:When we talk about how much work will be automated by running around the agents and doing intelligence, one, I wonder, well, who will be spending all that money if no one is making any of that money? And then I think very importantly, this comes back to me asking about, can LLMs do it? I wonder if any new ideas will be generated in that process at all, right? If we're just going to automate our way into something that seems pretty boring, right? We're just going to run a bunch of business logic and no one at the bottom who's actually operating in business logic will think, oh, I could do this 10 times cheaper if I start my own company and go start a new company.

52:07Nilay Patel:And there's something about all of that that I think I hear from our audience is that's why AI pulls as badly as AI pulls, even though the opportunities look exciting. There'll be a wave of people building agentic systems and agentic systems to do the jobs people do now or help people do the jobs people do now, then there'll be another wave of things that are automating processes that weren't possible before. We're still in the early parts of that second phase where we're thinking about, hey, we could build this new set of digital workers and we're going to get productivity. We really haven't gotten to this point where what is the process that should be happening in all these workflows if it could just be Agentec from the start.

52:51Nilay Patel:So AXA has announced a blueprint for Agentec Enterprise. It's basically got three big pillars, right? It's how to onboard agents as an identity, which is I'm very curious about what you think about the difference between agent identity and actual person to standardized connection points, which you've talked about a little bit. And then lastly, and this one is great, is to private a kill switch in case your agents go rogue. So talking about the first one, you want to create a new identity for agents in the workforce on your network. What does that look like? How is it defined differently than an employee or a person?

53:22Agents are a new identity type, and it's kind of like a combination of, it has some attributes of a human identity and some attributes of just a system. And it's basically a hybrid of both. And so from a definition perspective, it's pretty simple. I think where it gets interesting is it becomes a map that centralizes the list of agents from all your vendors. So it can represent agents from all the big platforms. It gives you this central way to kind of keep track of it all. And that's what companies are struggling with. They hear all the announcements and they're very excited about this. They just need a place.

54:02Hey, let me bring it in centrally and let me see what I have. and now once I see what I have, I can, you know, some of these things are very much just one-to-one with people. Some of them, there's a set of agents that multiple agents that work with one person. Some of them are totally headless and they're just on their own thing, automated and things, and they need a human in the loop. And you can kind of start to organize things that way, but it's all kind of, it's all kind of framed in this, in this concept of mapping across different silos. So you have, you have agents, you built yourself, you have platforms you're using like Amazon or Microsoft or Google, you have big apps you're using like Salesforce and service now.

54:42And, and it lets you centralize all that in a way that doesn't lock you into one of those silos. And then, like you said, it can, it can help you say, all right, all these things unequivocally need to connect to more things. And I can control where they connect to when they connect to that data warehouse, what permissions do they have in that data warehouse? And then across all the different various technologies. And then like you said, stuff is going to go wrong and there's going to be issues and threats and prompt injection. And when that happens, it gives you the ability to essentially pull the plug, like take the connections away, you know, in terms of like, oh, this agent is doing something that we didn't expect.

55:20Now what we can do is we can pull away its connections.

55:24Nilay Patel:How do you detect whether it's doing something you didn't expect? We don't have a magic solution to that because it kind of depends on the point of the agent. And that's kind of depending on the person that wrote the agent and the system it came from. But we are, we're working on standards for people to raise that issue or not, not, not from a, like from a technical sense, like raise an alert and, and have the other elements of the system respond to that. So is the call switch just, we're pulling your access, you're fired, get your stuff and go? Pulling the access to, to everything the agent can access, not access to the agent.

55:55Nilay Patel:Right. So it's just saying we revoked all your passwords agent. Yeah. Yeah, you're out of the system now. Almost like you would take a machine off the network. When you say that the agent identity is somewhere between a person and a system, go into that in more detail. What specifically do you mean? When you think about having a system that controls what something has access to, a lot of it's very similar to a person, meaning that just like you would give a person access to applications and then inside of those services and applications, you would say, here's their role, here's their group, here's their profile.

56:25That's a lot of the way these agents are being built and modeled. The reason it's not like a person is because you have relationship between the people and the agents in a way that they're on behalf of. And you want to always take the identity of the person and pass it to the agent and have it use that. And sometimes you want the agent to have its own identity and the systems that tech talks to do their permissions based on what the agent is. And then it goes back to the person as a human in the loop. So there's different patterns. So that if you actually look at the physical directory of agents, some of the elements are very much like a person, and some of them are only because they're these agents that can be on behalf of people or they can be connected to other agents, and they're more kind of like systems versus people.

57:09Nilay Patel:When you look at how the agents operate, you can go look at the chain of thinking at any one of these systems. A lot of times they're just talking to themselves in weird ways. I feel like you're provisioning identity. Obviously, Okta doesn't think about identity in the most deeply philosophical ways. You know, Anthropic is like very happy to hint that Claude is alive, right? When you think about, okay, I'm a provider of identity to these systems that are a hybrid between people and something else. Does it ever occur to you that like, they might be reasoning in a way that is more human or not, or that you need to address that in some way in the architecture of how you permission them?

57:47We're pretty pragmatic about it. meaning that it's, we know that they're, the behavior of these systems is non-deterministic and you have to, it's all about like getting this balance right between give it flexibility to what data and systems and things that can access and do and what operations, but then having the ability to rein it in when it goes too far. I think that's the right, ultimately that's the right way to balance effectiveness of these systems and the risk. There's no free lunch. You have to give it the data if you want it to be effective. And you kind of have to decide if you have zero tolerance for non-deterministic behavior, you can't give it the data.

58:31You can't give it the permission. And so that's kind of the balance that we're helping customers strike.

58:36Nilay Patel:How do you think about, you know, Okta sits in the middle. You were talking about, I don't know, there's Salesforce that has its own agents. There's other vendors that have their own agents. they are not going to want those agents to work across their databases, right? This comes back to, I think, the central challenge here. And the reason why something like OpenClaw was able to be so powerful so quickly, because it had nothing to do with any of those companies or those platforms. It was just clicking around in a browser. Yeah, like a manage just out of nowhere, yeah. Right, and it was because there was no security built into it.

59:06Nilay Patel:And instead of acting on behalf of a person, it just represented itself as a person, and it was off to the races. You know, Salesforce can't keep an actual human user from using a different system or orchestrating in their own head, right? Well, when you build the agents inside the corporate network, you can absolutely do those things. And Salesforce can absolutely write a terms of service that says we don't want the agent from your rival vendor using our system as well. Are those just politics? Is that negotiation? How's that going to work? There's only one thing. It's customers. I mean, customers will have the leverage eventually.

59:40And if the customers in like a market mechanism don't have a leverage, the government will step in and do antitrust. I mean, the reason we have a software industry, do you know why we have a software industry? Because customers finally got fed up with IBM and said, you have to sell software and operating systems and applications independent from the hardware. So this is like 50, 60 years ago, 70 years ago. IBM is like, you know, there is no software. There is no applications. There's this IBM box and you get it and we are technology. And customers want a choice and finally the government stepped in and said, you've got to split it up.

1:00:17You've got to have operating systems, you've got to have hardware, you've got to have software. And so I think a similar thing. It's like, yeah, of course, every big vendor that's trying to protect their entrenched things, whether it's Microsoft with their new bundle where they're trying to lock everyone in, they're going to say, you know, it all has to be on our thing. And you can't use other agents against our agents because our agents are better because they have our data and our workflow. And ultimately, it's going to be customers that demand change. And if there's so much monopolistic lock-in that we have to rely on regulators to come in and fix it.

1:00:51Nilay Patel:Well, I do think this is history that you've just made. You're the first CEO of a multibillion-dollar enterprise software company to advocate for vigorous antitrust enforcement on Decoder. So I'm just going to hold that close to my heart. If the market doesn't work, if customers can't force the choice. I do think the sort of like pre-Reagan antitrust environment that led to IBM being unbundled is very different than today, but we will set that aside. But I did impress you with my historical reference. It was very good. Again, the reason I didn't answer your question correctly is I'm very surprised that you went to antitrust.

1:01:23Nilay Patel:That doesn't usually happen on the show. Isn't there going to be just some weird pricing war in the middle of all that where Microsoft says, sure, let your other vendor's agent into 365. 65, we're just going to charge you a massive access fee to do it. Yeah, I think that's very likely. Yeah. Do you see that playing out now or you just see it on the horizon? I don't, not yet. What is happening now is that people are just getting familiar with the, call it the siloed agents. They're just getting familiar with the agents in Microsoft or the agents in Salesforce. We're not really to the, we're not really to the phase yet of really multi-silo agents, agents that can go from stovepipe to stovepipe and do these.

1:02:04In cases, there are, but that agent or that era is still ahead of us. And I think as you get more to that era, some of these issues have become more significant.

1:02:13Nilay Patel:Isn't that, and again, just to bring this back to OpenClaw, which I think probably most of the audience is most familiar with, that is the promise of that system, right? That's why it lit everyone's brains up because it was running just from system to system and then doing some logic and coming up with some outcomes. The thing about that, And I think a lot of these friends and ideas that remember is like that, you know, no one cares about the infrastructure. No one cares about the, well, this is obviously a dramatic statement. I'll explain what I mean. But people care about the app in the sense that they care about what it can do.

1:02:45And the reason why OpenClaw was such a lightning in a bottle is because they saw what was possible. They saw what it could do. Now, the fact that it had to do that by connecting to all these systems and it required access and there were security issues. It's like that's infrastructure and people, you know, that once their mindset gets set on the possible, then it's up to industry to figure out how it all works under this covers. But people care about the possible in the apps. And I think that you're going to see it ripple through. I think it's like I said, I thought it was the chat GPT of agents.

1:03:19And it's exciting.

1:03:20Nilay Patel:So you're kind of saying now is the time to build the guardrails. Make sure these actually work. Can I ask you about the flip side of that? You know, the promise of agents broadly, AI maybe broadly, is we will remove these intermediaries, right? The thing I keep saying is that your computer will just go access the databases all on its own. You don't need these app intermediaries or whatever. And we're going to reshape the app economy. Then I look at, okay, there's a bunch of scammers online who are just setting up like fake hotel service numbers and calling grandparents and like stealing bookings with like AI receptionists by just doing SEO hustles and collecting pennies.

1:03:56Nilay Patel:And like Okta has a role to play there too, right? By saying, okay, this is fraud. This is scam. You shouldn't hand over your identity here. I'm not sure anyone is paying attention to that, but I see it ballooning every day. Like just AI powered scams and frauds and identity theft. The idea that, you know, someone's going to call me and verify me by voice is under threat by AI in very specific ways. How do you see the flip side here of making sure that the core business Octa's in, which is making sure it's a real person doing the thing they're supposed to do at the right time, isn't just totally upended by the amount of AI-powered fraud that's occurring?

1:04:3140 % of our business is authenticating and validating customers, logging into customer websites and mobile apps. And this area is changing a lot with AI as well. And I think what you're seeing is that the offline identity, driver's license, passports, these are rapidly digitizing. And I think it's coming at a great time too, because it gives us something to offer people that really want to do a better job differentiating between agents and OpenClaw and bots logging into their sites and real people. And so as the offline identities digitize, people have mobile driver's license, the smartphone wallets are getting pretty capable now.

1:05:11And you can do fancy things just like you do Apple Pay. You can do a biometric authentication into your mobile driver's license. And then that becomes a very powerful thing to present to a website that will actually prove you're a person or in a better sense than was possible before. So it's a big deal. People need to really know in certain use cases when it's an agent, when it's a bot. This bot problem is not new. It's like the old problem on Twitter and X. And Elon Musk is on trial for talking about bots and how many bots there were. And now I think with AI, it's becoming supercharged. And I think with what we have with these national IDs and passports and mobile driver's license being digitized, we might have a shot to actually bring some sanity to that world.

1:06:01Nilay Patel:There's some real debates there, right, about privacy, about surveillance, about... Yeah, what does it mean to actually digitize identity from a credentials perspective? Are you guys in that mix? Is that something Okta is actively thinking about? Are you waiting for that to sort itself out? I mean, governments are deciding. And governments are deciding on that they want to digitize. They want to issue these passports and these national IDs. And in Europe, it's certain standards across the EU. In the United States, it's very much at a state level. And our customers are really excited about it. And we're giving them all the capabilities to take advantage of this stuff without really specific judgment about how they should do it.

1:06:43We're just trying to arm them to make sure that they can accept all the regulatory requirements and also all the identities and the digital formats that their users and their citizens want. So it's a big part of our future. And we're working hard on that.

1:06:56Nilay Patel:Right next to that is, you know, there's a big fight over age verification in the United States and the app stores and who gets to use what apps. Discord just had a big controversy because they went to an outside vendor. People had a lot of feelings about that outside vendor and Discord rolled that back. Are you seeing any of that controversy come your way around age verification? We work with the vendors that are trying to log people in and they want the best tools and technologies to do age verification. So we're going to make sure we equip them with that. It's a lot of times not a technical issue.

1:07:25It's like, you know, it's like, what ID system do you trust? And is there an ID system for someone that's 12, 13, 14 years old? And so I think one of the challenges has been out of the scope of a lot of the driver's license-based or, you know, passport national ID-based discussions. But I think that'll be a use case that'll be covered, I think, by governments fairly quickly.

1:07:45Nilay Patel:Do you think it's possible to do age verification and still protect people's privacy? I do, yeah. There's technical solutions. There's also process and regulatory parts of it. I think ultimately the most privacy-preserving thing is no technology. So there's going to be a trade-off. If you are trying to automate something and you're trying to bring technology to something, there's going to be a risk of centralization and privacy controls. But I do think it's possible to get the balance right. It seems like that's just the other front, right? The computers are going to get way more capable on their own.

1:08:16Nilay Patel:And then we are very interested in limiting what the people can do with computers in very specific ways. And it does seem like you sit at the middle of it. So, Todd, we're going to have to have you back. I feel like there's yet more emotional crash out for me to have with you. Tell people quickly what's next for Okta. What should they be looking for? I think they should be thinking about how they build the secure agentic enterprise and how they can use the blueprint we're proposing to the entire industry and how to make that possible. and we're excited to work with everyone in the industry and particularly the tools and technologies and products we're going to be building to make sure that reality comes to fruition.

1:08:54Nilay Patel:Amazing. Well, like I said, we're going to have to have you back to see how all this is going because it feels like it's going to change really fast. Thank you so much for being on Decoder. Thanks for having me. I'd like to thank Todd McKinnon for taking the time to join Decoder and thank you for listening. I hope you enjoyed it. To let us know what you thought about this episode or really anything else at all, you can drop us a line. You can email us at decoderattheverge.com. You really do read all the emails or you can hit me up directly on Threads or Blue Sky. We're also on YouTube. You can watch full episodes at Dakotarpod.

1:09:19Nilay Patel:We also have a TikTok and an Instagram. They're at Dakotarpod as well. They're a lot of fun. If you like Dakotar, please share it with your friends and subscribe wherever you get your podcasts. Dakotar's a production of The Verge and part of the Vox Media Podcast Network. The show is produced by Kate Cox and Nick Statt. It's edited by Ursa Wright. Our editorial director is Kevin McShane. The Dakotar music is by Breakmaster Cylinder. We'll see you next time.