Every Enterprise Is About to Have a 100,000 Agent Problem | Oren Michaels of Barndoor AI

0:00Why you compare agents to enthusiastic interns. Why do you think 2026 is an inflection point beyond open thought? While there's a lot of enthusiasm and excitement about agents, very few corporations or enterprises are putting them into production because exactly what you said, the trust issue. These systems are probabilistic. I think that as humans, we're pattern matchers. And so the more we see, the more we want to do. They will absolutely give you an answer. They will absolutely do something when you tell them to. Hi, Craig. I'm Oren Michaels. I'm the co-founder and CEO of Barndoor AI based in New York City.

0:44and I started Barn Door in October of 2024. I was seeing that the world was talking about AI coming into the enterprise, but we weren't seeing much of it actually happen. And I thought that I had something to add and my team had something to add to be a catalyst for AI to actually be successful at the enterprise. Before Barndoor, I co-founded and ran a company called Mashery. We started in 2006. We were the first API as a service company, which we built over the course of seven years and sold to Intel in 2013. Before that, I just had a variety of positions running companies in technology, wine, theater, and various other areas.

1:36yeah i i see the uh the the posters on your wall there you're also a broadway producer i understand i am i am these are all shows that i've that i worked on so yeah yeah that's wonderful very uh eclectic um and so yeah we're going to talk about barn door ai and then also then ai maybe you can explain the relation between them. Sure. And then talk about the 100 ,000 agent problem. And I read an article you wrote, you explained it very clearly with, you know, I can't remember how many employees, each employee has a certain number of agents, suddenly you got 100 ,000. Yeah. Yeah, so we believe that agents are going to become useful in companies.

2:30And when I talk about an agent, I believe an agent is something that actually takes action on behalf of an employee or on behalf of itself. It doesn't necessarily have to be tied to an employee, but most of them usually are at this point. And to take action, an agent doesn't merely do what our chat interface does, which is suggest something that we as the human should go do. But it actually doesn't merely suggest it. It actually takes the action and does it. It interacts with the same tools, the same systems that we use in the enterprise, whether it's something like Salesforce or email or Slack or Snowflake or QuickBooks or whatever it is that you use in your world.

3:16And so in order for that to happen, you need two things. You need the AIs to actually be able to connect to these tools. and you need the humans to trust the AIs will use those tools appropriately and not do things that they shouldn't. And the connectivity is something that's actually not that hard. About a year and a half ago, a protocol called MCP came out that Anthropic brought out, and that solved a decent chunk, not all, but a decent chunk of the connectivity issue. But it didn't do anything about the trust because MCPA is not a security protocol. It's merely a pipe. It's a way of connecting.

4:00And so it's my belief that in order to really trust an agent to act autonomously, you basically have to govern that agent to a point where you're giving the agent a task and the only things it's allowed to do are the things related to that task. so that if it decides to hallucinate or go off the rails or do the things that agents do, that the guardrails in place are keeping the agent narrowly focused on that task at hand. Well, we have lots of tasks, and we're going to have lots of agents doing these tasks. And so each agent that is off doing those tasks on behalf of me as an employee is going to need a different set of guardrails and a different set of rules about what it's allowed to do to carry on that task.

4:46And therein lies this challenge of having lots and lots of agents times lots of employees means tens, hundreds of thousands of agents in your company. And as agents come and go, because obviously we want to have the best possible agent doing the things for us, and new ones come up in the last couple of weeks, we've learned about OpenClaw. Well, nobody really knew about OpenClaw two months ago. and yet it's incredibly powerful and there are folks who are trying to figure out how to make it powerful and trust you know have it be something you can trust but there are going to be lots of it was written by one guy right there's going to be lots of different AIs that come out and you're not going to want to reconnect everything and redo all the rules every time a new interesting agent comes along so we believe that what needs to happen and this is the company that Barndor is We believe what needs to happen is there's a governance layer that manages all of these different agents on behalf of humans or not on behalf of humans.

5:48And what the agents are allowed to do, given the tools they're trying to use, the context, the data they're acting on, what specific task they're doing. And that's what we built at Barndor. And that's a great platform for companies to go and manage that. But the challenge we have today is that a lot of people still don't know what to do with that because MCP is relatively new. And MCP has, while it's taken off a bit on the developer set because it's kind of a technical thing to get up and running, your average finance, HR, salesperson isn't really doing much with it yet. And so because they don't know what it can do, they don't understand the power.

6:31we do. All of us use it every day here at our company because we've been playing with it for a while. But people really need to understand what it can do. And so in order to make that happen more broadly, we've introduced a tool called Venn. And what Venn is, is everything I just described to you, but for one person. So the idea is that you as an individual can come to Venn.ai, sign up, Get started for free. And you can use it to hook up to all those same things, email, Slack, calendar, all the different tools you use, whether at your company or in your personal life. And now some companies will have security that will cause it to not allow you to use vent on corporate systems.

7:16You might have to go get special permission to do it. or you can play with it in your own life on your own personal products and learn the things that you're able to do when you hook your AI up directly to the tools that you use. And our belief is that as people start learning that, that they're going to be able to bring those learnings back to their companies and their companies are going to be more likely to implement something like Barndor in order to allow everyone in the company to benefit from this productivity. Just for listeners that aren't following, MCP is Model Context Protocol, and it's basically a bit of code that allows models to talk to tools or to APIs as well, doesn't it?

8:11And when you refer, you talk about how AI has been in advisor mode and that enterprises are facing action mode where they're actually going to have AI doing things in the enterprise. I spoke to a guy at EY. Sure. I don't know if it's still called Ernst & Young. I think it's EY. In fact, my co-founder, my technical co-founder came from UI. That was his last job. Okay, yeah. Yeah. And he was saying that while there's a lot of enthusiasm and excitement about agents, very few corporations or enterprises are putting them into production because exactly what you said, the trust issue, that these systems are probabilistic.

9:09And even if they do a wonderful job 90 % of the time, there's going to be a small percentage of the time where they do something unintended. Yeah. Can you talk about that and then why you compare agents to enthusiastic interns? I thought that was an interesting. So at their heart, these models, these AIs are probabilistic systems. They basically, you give them a task or you give them a prompt, you tell them something, and with a lot of really, really complicated math, they give you what they feel is the most likely set of words or pixels or video or whatever you're asking for that is to them the most likely answer to the question that you're asking.

10:03And that is different than when you program an API. When you program something that uses an API, the API has certain capabilities and certain ways of using it that are documented. And the programmer writes a program that accesses that and does a specific thing with it. And if you run that program 100 times, it's going to do the exact same thing all 100 times. But probabilistic things don't work that way. And so what you then have is you have these systems that basically say, gosh, I'm being asked this. What's the most likely answer? And the more context you give, the more likely the answer is going to be close to what you intend.

10:45And people are starting to learn to do that. But absent a lot of context and even sometimes with a lot of context, you're still going to come into cases where an instruction is interpreted. not in the way it was intended. And we see that with humans as well. That's why I like to call them enthusiastic interns. They will absolutely give you an answer. They will absolutely do something when you tell them to. Whether it has what you have intended, who knows, right? And so the potential blast radius of this, if you have an intern, you tend to manage them with a bit of skepticism at the beginning. And you say, okay, I want you to go do these things and I'm going to keep an eye on you.

11:30And I'm going to give you, you know, start you on something that's not terribly, you know, important. Or if you screw it up, it's not going to be catastrophic to the company. And as we work together, and I see that you're capable of doing these things without causing a problem, I'll let you do more. And I'll ask you to do more and I'll give you broader access and broader capabilities and broader autonomy as you prove yourself capable of doing it. And I think that that's actually how a lot of people, either intentionally or unintentionally, are embarking on their AI journey. So, you know, you first start using it as basically glorified search.

12:18And then it becomes, you know, it becomes something more than that. when you perhaps ask it to write some code or you perhaps ask it to interpret something for you. And then you get to a thing. One of my colleagues yesterday said that she gets so many Slack messages and at the end of the day she wants to feel like she can log off and go be with her family. So the last thing she does each day is she says, look at all my unread Slack messages and tell me which five are important for me to answer before I quit for the day. And that's something you can't do unless your AI is hooked up to your Slack.

13:03But it is something incredibly useful to her. Yeah. And in the past, access to these systems by software, by more deterministic software, was controlled by identity and access management systems. Yes. And, you know, we've all worked with those. And then there's a higher level in the stack. There's some that kind of sit outside the database and check the identity of who's accessing the database and check what's being taken out of the database and they can have limits and that sort of thing. Why is that not enough for Gentic AI? because identity supposes that you have a human and the human comes with their own governance.

13:55I, as Oren, know that it's stupid to delete Salesforce opportunities. I'm allowed to, but I know I shouldn't. And I know that if I do it a lot, I'm going to get fired. And so that's a level of governance beyond merely identity. And it comes with my role. It comes with my identity. but it also comes with my history of proving to the world that I'm not going to go do stupid stuff. And the nature and identity is generally over-provisioned intentionally because we trust people to a certain point and we don't want to have to rush back and every single time I need to do something in Salesforce, I've got to go to the Salesforce admin and have them flip one more switch for me.

14:40So in general, they say, okay, this guy's been hired and he's shown himself to be reasonably trustworthy. So generally speaking, we're going to give him broad latitude and assume that he's likely to not misbehave.

14:59And you don't want to take that authority away from me as a human just because I'm now using AI. but you also recognize that I as a human probably am not perfect at using AI and I'm probably going to give some instructions that are not necessarily definitive to my AIs. And so my AIs, the AIs I'm using need by definition to have a smaller blast radius than I do. The only thing about AIs is they can cause a lot of trouble really, really quickly. And they're much faster at this than I am. And so it's likely that you want to dial back what these things are capable of doing, certainly at least until you have the opportunity to say, okay, I've given this AI a task.

15:52And now I'm going to look and see how it attempts to carry out that task. And for the things it does, the MCP calls it makes, the requests it makes, if all of those are consistent with the task I've given it, great. I'll turn those capabilities on and let it go do those things. But I probably want to try it that way first and limit how much it's allowed to do before I let it just sort of run autonomously every day and go do stuff for me. Yeah. Although even, I mean, there's something called automation bias where, you know, you run a system 10 times and it does it perfectly each time and pretty soon you stop checking.

16:38because you just assume. But if the thing is 97 % accurate, you're not going to see those 3 % go by where it makes a mistake. So how do you control that? Well, you probably have another agent that checks it. Right? And I think we're going to see a lot. We have that in, we've had that in IT for many, many years. I remember one company I ran was a employee benefits administration sort of online sign up for benefits thing. Very, very complicated data. And we're dealing with dozens of insurance companies and hundreds of client companies. And it was very, very complicated. And so every night we would run a program that basically went through and looked at everything and made sure it all made sense.

17:28Because people would make mistakes or something would get corrupted or whatever. And it just made sense to go through and just have that double check. And I think that as we look at agents being able to take action autonomously, we look at how you QA that. It's the same thing with software. So my software engineers write some code. And the first thing that happens before that code gets committed is another engineer looks at it and blesses the pull request. And in many cases, a bot comes through and does a bunch of QAs and tests on it as well. So I think we have always had a culture of making sure that the work that people do is checked.

18:23You've been a journalist a long time. I'm sure you've had editors and fact checkers and all those sorts of things. And it's something we do. Yeah. Okay, so tell us more about Barn Door and then Venn. I mean, you're really targeting enterprising. You talked about how individuals can use Venn, but you're focused on the enterprise. It's very early days, as I said. Enterprises are very cautious. but last time we spoke you were explaining how I don't know if it's Barndor or Venn allows you to set very narrow Yeah, and Barndor is the enterprise grade product that lets you really do this. So for instance, as you start allowing people in a company to hook in their corporate systems and use them with AIs.

19:27There are various things you know that you don't want to be able to happen. Some of them are company-wide. So for instance, one of the companies we deal with, the first policy they created is no AI is allowed to post to a Slack channel that starts with hash EXT, because those are the channels that include people from other companies. So we're like, for now, let's just limit the blast radius of AI on Slack to inside the company, right? No AI is allowed post to anything that writes, whether it's email or Slack or anything like that, with anything that looks like a social security number, a phone number, an address, you know, anything that resembles PII.

20:12So you sort of filter that stuff out. You basically say, If it's attempting to do that, reject the attempt. So there are some very broad rules you can create. But then when you start getting into the sort of the more narrow rules, if you have a specific, like I have an agent that after I do a sales call, it goes to my calendar, pulls who was on the call, goes to Zoom, gets the transcript, summarizes it, It goes to Salesforce and logs the call with the folks who are there. AIs are not, because they're not determinative, sometimes they're unable to find what they're looking for in Salesforce. So I allow my AI to create this call log, but I don't allow that particular AI to add new contacts to Salesforce.

21:09Because what I found in the past is that sometimes it will say, oh, that person's not in Salesforce. I'm just going to add them. They actually were in Salesforce. They just didn't find them. And what I don't want is 20 of the same person showing up in Salesforce. So I'd rather not complete the task and let me know and have me help it find the person than it goes and makes a bunch of nonsense in our Salesforce instance. And that's a specific thing there. Whereas a different task I have, which would be, for instance, I attended a Wall Street Journal conference last week and I got a list of people who were at the conference.

21:45I wanted to make sure all of them were in our sales force and I knew most of them probably weren't. So I was happy to have this agent go through and actually create contacts for each of them. Yeah. You talk about a difference between safe read actions and destructive write actions for agents. Is this an example when you say, yeah. Absolutely. And the thing about writing is again, I believe that for an agent to actually be an agent and be useful, it has to write. And when people talk about MCP and they talk about the connections in collateral, the terms being used for what is ultimately MCP, most out-of-the-box connections don't allow writing because they don't have the governance.

22:42So if you sign up with Claude and you say, okay, connect to my calendar, it won't actually create calendar events for you. It'll just tell you what's there because they don't have built-in this governance. And so MCP, you sort of touched on it earlier. What MCP is, you have an underlying API which generally can do everything. It has, as long as you have the access and you are allowed to use those capabilities, an API can pretty much do anything that you could do with the user interface. When you create an MCP, the person creating that MCP chooses to expose a subset of that set of capabilities to the model.

23:32So you might have many, many, many, many things that can be done. Some are reads, some are writes, some are deletes, some are drops. They're fairly catastrophic things that one can do programmatically. And the person creating the MCP will rationally say, out of all those things, here is the subset I want to expose. So out of the box, most of these MCPs only expose things that do reading that can't write or overwrite or do things that cause problems because there's no governance that manages that. By using Barn Door or Venn, we provide MCPs that actually do have those capabilities because they come with the governance that allows you to turn on and off the things you don't want them to be able to do.

24:18Right. And how do you, is this a page of toggles? Yeah, so on Venn it is exactly that. It's a page of toggles for every single service that you're signed up for. In Barndor, it's a lot more capable than that because it's an enterprise product. So you can use the toggles. You can write in a language called JSON. You can write a set of very, very specific policies around it. And you can also do that not just through our user interface, but you can do it through our API. Because we believe that there are going to be so many of these agents out there that at a certain point, humans are not going to be able to create and manage all the policies that are going to be necessary.

25:03So you're going to have a series of, you know, whether they're AIs or programmatically driven systems that actually ultimately turn on and off these capabilities based on the context. Yeah. Is there a conversational interface given that, you know, LLMs are pretty good? We actually, yes, we have an MCP. So there is an MCP to Barndor. And so you're able to, using whatever conversational interface you prefer, you can use our MCP to do these various things. Absolutely. Yeah. And talk a little bit about some of the challenges with agents. I mean, what is context window exhaustion? Yeah, you know, that's been a big issue.

25:56And when you think about how your AIs work, the AIs are managed through these things called tokens, which are essentially a measure of how much is coming into the model and a measure of how much is going out. And I talked about the MCP. The MCP is essentially a tool and a user manual on how to use that tool for every tool that you have exposed. So a typical MCP for, let's say, Gmail might have 40 or 50 or 100 different tools, each of which comes with a very significant manual that tells that AI how to access that tool. And so if you open one of these, every time that you say, I need to use this MCP, the first thing it does is it brings in all of those tools and all of those user manuals, which burns lots and lots of tokens, even though you're not going to use most of them.

26:54Let's say you then turn on two or three more MCPs. Now you have calendar, you have mail, you have Slack, you have documents. now you've got so many tools and so many user manuals that you have already used up all the tokens your window allows before you actually do something and that's context window exhaustion and it's why when you and the other the other challenge by the way is with all of these tools it's just confusing it's like walking into home depot and you see a sea of tools in front of you you don't know where the hammer is you don't even know what a hammer is or how to use you're like well, I'll grab the nearest thing.

27:32And what you find in the models is you'll say something like, go to Salesforce and give me information on these three opportunities. And it will say, I will go to your Google Drive and get you information on it. Because it's overwhelmed. And so what we've built is what we call Tool IQ. To the model, all the model sees is a single MCP, and that's ours. and ours then abstracts all the different tools that you have hooked up. So the model says to us, hey, I'm trying to do this. And our tool writer says, okay, if you're trying to do that, here is the small subset of tools you need to go do that. And here's how you use them.

28:14And the model says, thank you very much, makes the call and off it goes. And it's sort of like, you know, you have a task, a chore to do at home and you just get the little tray of tools you need to do it. You're not bringing all of Home Depot with you, right? and so because of that you save a lot on tokens but you also get better response because you're actually having this sort of smart layer in between that that abstracts these tools and makes them more useful for them yeah and then then you're not wasting so much of the processing power. Absolutely. Absolutely. Yeah. Uh, the, uh, you know, we're at this, uh, inflection point.

28:56I, in my mind, particularly because of open claw. Absolutely. That was a huge, huge event for us. Yeah. Do you think, I mean, it just brought the power of agents into some segment of the public consciousness. Can Barndor or Ben run on top of OpenClaw? Absolutely. So OpenClaw by itself doesn't talk to MCP. Part of the ethos of OpenClaw is it shouldn't need to, it should just write whatever program it needs and go off and do whatever it wants. That's sort of the ethos. However, there is an extension to OpenClaw called MCP Ops, or MCPops, as some people call it, which essentially is an extension for OpenClaw, downloads with OpenClaw, and allows OpenClaw to access MCPs.

29:54And so that MCP Ops thing can, of course, access any MCP, including the Venn or the Barn Door Tool IQ MCP. Yeah. A lot of people, me, for example, have been using OpenClaw through something called MyClaw AI. I don't know who owns that. I don't know who did it either, but it's a lovely, it's the cloud for OpenClaw, right? Yeah. And it's just simplifies the, it's installed in the cloud. You just log into it rather than trying to set it up on your own IDE. uh does uh barn door or ven work with my i assume so because it's just a regular version of of open claw and it should be able to run mcpops so i i haven't tried it personally but uh i don't see why it wouldn't yeah and and so what you're saying is that yeah agents are great there's tremendous promise enterprises are scared of them uh and may be experimenting at the margin and that's largely because of a trust and control issue.

31:09And Barndoor provides a layer of control that then provides trust. Is that right? Exactly. Exactly. And I was at a conference with about 50 enterprise CIOs and CISOs last week, and very large companies. And they're all on this journey in various levels. And it's actually interesting to see. There's a lot of companies, even companies that have been around 50, 100 years, that have very active and capable IT teams who are actively experimenting with and building MCPs both to SaaS services they use but also to internal systems. And there's definitely a demand for this. And it seems this is an event I go to twice a year.

32:00And the change between six months ago and this past conference, it's the front of everyone's mind. Absolutely. Yeah. You know, I was at a conference last year with a company called, it was a customer conference for a company called Boomi. Oh, sure. yeah that is integration boomy actually i believe boomy now owns smashery which is the company i found it i think we sold it to intel and intel sold it to tibco and i think tibco may have sold it to boomy i'm but okay obviously not involved anymore but i think they own it yeah so i'm So, you know, that is a platform that connects applications, data, devices, cloud, on-prem.